Public monitoring temporarily paused
The public feed is temporarily unavailable. Internal monitoring continues.
MONITORING.
Infrastructure health, maintenance and security. One clear view, with details when you need them.
Systems & maintenance
Select any system to inspect alerts, uptime, storage, updates and reboot status.
Cowrie × Wazuh
Cowrie is an open-source SSH/Telnet honeypot that imitates a server and records connection attempts, login attempts and commands. It is a way to study what happens when an SSH service is exposed to the internet — automated scanners may find it quickly, but every environment is different. Follow the guided simulation below to see how Cowrie events can be collected and analyzed by Wazuh. No real connection is made.
Learn what attackers try — without giving them access.
Cowrie is a community-maintained, open-source project available on GitHub ↗. An exposed SSH endpoint can attract scanning, password guessing and command attempts. The goal is to observe and learn, not to give anyone access to a real server.
Only expose what is necessary. Segment networks, use least-privilege accounts, restrict access and keep systems updated. A honeypot is never a substitute for those controls.
Connect, log in with the demo account, then explore the pretend Linux filesystem. Hint: ls lists files, and cat reads a file. Your commands will appear as demo events on the right.
Select Start SSH Simulation to begin. Follow the prompts; the matching example events appear on the right.
demo · Demo password: demo. Never enter a real password. Password attempts are not stored or displayed.Example IP and country are fictional; they do not identify you or a real visitor. Country is approximate in real deployments.
Your simulated SSH events will appear here when you interact with the terminal.
DEMO ONLY — Host health, uptime, patch state, vulnerability findings, certificate checks and SSH events shown here are fictional examples. No endpoint is connected. The eventual public data feed and private pause control require a protected backend; internal monitoring will continue independently.