Cowralyze

Cowralyze is a command-line map-reduce tool designed for analyzing Cowrie honeypot log files across multiple time periods and locations. The tool processes multiple Cowrie JSON log files (cowrie.json.YYYY-MM-DD format) from both local and remote server locations to generate cumulative analysis and visualizations. It creates statistical reports showing event changes over time periods, allowing security researchers to track honeypot activity patterns. Key features include the ability to trace specific commands by session ID or IP address, generate Sankey command chain plots for individual log files, and produce HTML-based visualizations (stats.html and result.html) that display accumulated percentage changes and cross-time analysis. The tool was developed to address gaps in existing honeypot analysis tools, which typically focus on high-level aggregated statistics rather than individual log anomalies. It enables quick overview analysis of potentially hundreds of Cowrie honeypots simultaneously, making it suitable for longitudinal SSH honeypot research and monitoring.