https://jesusoseguera.dev/tags/observability/Recent content in Observability on Jesus OsegueraHugoen-usFri, 01 May 2026 00:00:00 +0000https://jesusoseguera.dev/projects/cowrie-honeypot/Fri, 01 May 2026 00:00:00 +0000https://jesusoseguera.dev/projects/cowrie-honeypot/Overview Deployed an SSH/Telnet honeypot (Cowrie) on a DigitalOcean droplet with Terraform and logged real attacker behavior for 5 days: 41,700 inbound connections, 15,400 login attempts, and 868 successful logins from 106 countries. Observed post-exploitation patterns feed the Falco runtime rules used on the EKS and homelab platforms, so those rules are grounded in traffic this honeypot actually saw. Technologies: Terraform, Docker, Cowrie, Promtail, Grafana Loki, Grafana Features GeoIP-enriched pipeline: Cowrie to Promtail to Loki to Grafana, with a live attack world-map dashboard Surfaced automated post-exploitation behavior, including OS fingerprinting (uname) and shell-history suppression Chose Grafana Loki over heavier aggregators that exceeded a 1GB RAM droplet budget (~$7-10/mo total) docs/ttp-to-runtime-rules.