Telegram Cowrie functionality

[0x2ANHUK]

How to use the original Cowrie function of putting a telegram API key and chat id to get notifications from tpot cowrie ?

[Ganesh-403]

@0x2ANHUK
The original Cowrie project does support configurable output plugins, but T-Pot packages and manages Cowrie differently, so simply adding a Telegram Bot API token and chat ID to Cowrie's configuration is generally not sufficient for notifications to work inside T-Pot.

From what I can find, T-Pot does not document or expose Cowrie's Telegram notification functionality as a supported feature. Instead, T-Pot is designed around a centralized logging pipeline:

Cowrie
   ↓
JSON logs
   ↓
Logstash
   ↓
Elasticsearch
   ↓
Kibana

and the recommended workflow is to use those logs for alerting or monitoring. :contentReference[oaicite:0]{index=0}

If your goal is Telegram alerts for Cowrie events, you have a few options:

Option 1 (Recommended): Alert from Elasticsearch

Since all Cowrie events are indexed into Elasticsearch, you can create alerts using:

• Kibana Alerting (if available with your deployment/license),
• ElastAlert 2,
• or a small Python script that periodically queries Elasticsearch and sends Telegram messages.

This approach has the advantage of working for all honeypots, not just Cowrie.

---

Option 2: Enable Cowrie's native output plugin

Cowrie supports additional output plugins beyond JSON (ELK, Splunk, SQL, etc.), and custom output plugins can be added. :contentReference[oaicite:1]{index=1}

However, from what I can tell, I couldn't find documentation confirming that the Telegram output plugin is included or enabled in the version of Cowrie bundled with T-Pot. If it isn't present, you would need to:

• customize the Cowrie container,
• install or implement the plugin,
• and ensure your changes persist across T-Pot updates.

This is possible, but it falls outside the standard T-Pot deployment model.

---

Option 3: Monitor the JSON log directly

If you only want notifications for Cowrie, another simple approach is to watch:

cowrie.json

and send a Telegram message whenever a matching event appears.

This avoids modifying the Cowrie container while still leveraging the raw event stream.

---

Could you clarify one thing?

• Which T-Pot version are you running?
• Are you referring to an official Cowrie Telegram output plugin, or a third-party plugin/example you found?

That will help determine whether the functionality can simply be enabled, or whether it would require customizing the Cowrie container within T-Pot.

If this solves your problem, feel free to mark it as the accepted answer so others can find it easily.