Honeypot Workbench
Cowrie & OpenCanary evidence review · local processing · no uploads
Import telemetry
Original-input SHA-256 · record-level provenanceOr paste JSON events
No telemetry loaded
Import a sensor log to inspect sessions, artifact references and data quality. No live sensor is hosted here.
UTC window, source scope & duplicate handling
Time bounds exclude undated records. Source IPs identify addresses, not people. Invalid exclusions are reported and ignored.
Activity over time
UTC · current filtersSource concentration
Event countsClick a source for exact address filtering.
Sessions & recorded behaviour
Session keys include sensor + session ID. Missing IDs remain ungrouped. Filtering shows only matching events within a session.
Artifact references
Reported hashes and paths are unverified references. This tool does not retrieve, execute or classify files.
| Reported SHA-256 | First URL / path (inert text) | Observations | Input records |
|---|
Event explorer
Raw credential fields and authentication messages are omitted. Commands may still contain secrets. CSV formula prefixes are escaped. Reports include input provenance, filters and analyst reviews.
| Record / UTC | Sensor / source | Event | Recorded detail |
|---|
Give every result a denominator
Compare matched runs using verified uptime. Different protocols, providers and dates can explain differences.
Enter hours per sensor for sensors with equal monitored uptime. Split unequal-uptime cohorts into separate rows. Meaningful sessions must follow the same behaviour definition in both runs.
No universal winner is inferred. Log time span is not uptime. Cost per meaningful session is not cost per validated intelligence finding.
Start with a measurable objective
Choose a goal to get a tool fit, evidence checklist and downloadable operating plan.
Evidence before observation
This is a planning checklist, not a deployment or security certification. No public exposure or infrastructure changes happen in this browser.
Progression
Counting rules & limitations
Events are accepted input records after your filters. Sessions use sensor + Cowrie session ID; OpenCanary alerts without IDs are never grouped into invented sessions. Engaged sessions contain command input, forwarding or artifact records. These are behaviour observations, not confirmed compromises.
Duplicate detection compares complete input JSON objects after key ordering. Source addresses may be inherited only within an unambiguous sensor/session. Missing timestamps are retained unless a UTC window is active. A log span cannot establish uptime, detection recall or delivery latency.
Input hashes identify the imported bytes; they do not authenticate the sensor or establish chain of custody. Artifact hashes and URLs are reported by the sensor and are never fetched. Analyst labels remain separate from recorded facts. All data and notes remain in this tab until cleared or closed; export before leaving.
Cowrie event specification · OpenCanary logging configuration