« Back

Cowrie Event IDs

There doesn't seem to be much documentation on the EventIDs generated by Kippo (or it's fork Cowire), other than what's in the source. This post is just for reference.

# KIPP0001 : create session
# KIPP0002 : succesful login
# KIPP0003 : failed login
# KIPP0004 : TTY log opened
# KIPP0005 : handle command
# KIPP0006 : handle unknown command
# KIPP0007 : file download
# KIPP0008 : INPUT
# KIPP0009 : SSH Version
# KIPP0010 : Terminal Size
# KIPP0011 : Connection Lost
# KIPP0012 : TTY log closed
# KIPP0013 : env var requested

Kippo Source - Github