Basic Defensive Lab (Honeypot)

Honeypot environment using Cowrie and an agent to collect attack data, integrated with a central Manager for monitoring and dashboard visualization.

Requirements

• Kali Linux (attacker)
• Ubuntu Server (honeypot)
• Ubuntu Server (Wazuh manager)

Topology & Addresses

This example uses private local static IPs on a lab network.

• Attacker (Kali) — 192.168.1.10
• Honeypot (Cowrie) — 192.168.1.100
• Manager (Wazuh) — 192.168.1.200

Components

1. Attacker (Kali)

   

   This VM simulates offensive activity (scans, exploits). Use Kali to run tools like nmap, hping3, or exploitation frameworks to generate malicious traffic toward the honeypot. Example IP: 192.168.1.10.

2. Honeypot (Cowrie)

   

   Cowrie is a low-interaction SSH/Telnet honeypot that logs attacker commands, credentials, and session data. In this lab we run Cowrie on the honeypot VM and forward logs to the Manager. Example IP: 192.168.1.100.

   

   • Cowrie — captures attacker sessions and writes logs.
   • Agent — a lightweight forwarder (Wazuh agent) that ships logs to the Manager.

   

   Keep Cowrie running and collect the cowrie.log and session files. Ship them with the Wazuh agent to your manager host for aggregation and visualization.

   Suricata

   Suricata is a network-based intrusion detection and prevention system that monitors live network traffic and analyzes packets using rules to detect attacks, scans, and malicious behavior in real time. Its main function is visibility and alerting across network activity, not interaction.

   

   Suricata passively observes all traffic, while Cowrie actively lures attackers into a fake system to study their actions.

3. Manager (Wazuh — Agent & Dashboard)

   The Manager runs Wazuh to ingest and analyze logs forwarded by the honeypot agent. Wazuh combines log aggregation, rule-based alerts, and a web dashboard for monitoring detection events.

   

   

   Key Manager responsibilities:

   • Receive logs from Wazuh agents (honeypot)
   • Index and store events
   • Provide dashboards and alerts for suspicious activity

   Example Manager services: Wazuh manager (indexer & rules engine), Wazuh API and Wazuh Dashboard integration for dashboards web ui. Example IP: 192.168.1.200.

   

   4) Attack Testing

   a. Nmap (port scanning)

   

   b. Hydra Bruteforce

   

   c. Ddos (flooding)