Integrating Suricata IDS and Cowrie Honeypot Logs with Wazuh Manager (Without Agents)

Introduction

In my SOC project, I wanted to centralize security monitoring using Wazuh Manager. Instead of deploying agents, I configured the manager itself to collect logs directly from Suricata IDS and Cowrie Honeypot. This approach simplified the architecture and reduced overhead, while still providing complete visibility into network attacks and honeypot activity.

sudo nano /var/ossec/etc/ossec.conf

Open this path and add your Suricata (IDS/IPS) and Cowrie(Honypot) Logs file path Suricata IDS Integration

Suricata generates multiple log files, but the most important one for SIEM integration is eve.json, which contains structured JSON alerts.

Configuration in Wazuh (ossec.conf):

xml

<localfile>
  <log_format>json</log_format>
  <location>/var/log/suricata/eve.json</location>
</localfile>

<localfile>
  <log_format>json</log_format>
  <location>/var/log/suricata/eve.json</location>
</localfile>

After restarting Wazuh Manager, Suricata alerts (like port scans, suspicious traffic, DNS anomalies) started appearing in the dashboard.

Cowrie Honeypot Integration

Cowrie records attacker activity in two main files:

• cowrie.json → structured JSON logs of attacker commands and sessions
• cowrie.log → syslog‑style text logs

Configuration in Wazuh (ossec.conf):

xml

<localfile>
  <log_format>json</log_format>
  <location>/home/cowrie/cowrie/var/log/cowrie/cowrie.json</location>
</localfile>
<localfile>
  <log_format>syslog</log_format>
  <location>/home/cowrie/cowrie/var/log/cowrie/cowrie.log</location>
</localfile>

<localfile>
  <log_format>json</log_format>
  <location>/home/cowrie/cowrie/var/log/cowrie/cowrie.json</location>
</localfile>
<localfile>
  <log_format>syslog</log_format>
  <location>/home/cowrie/cowrie/var/log/cowrie/cowrie.log</location>
</localfile>

This allowed Wazuh to capture honeypot activity such as brute‑force attempts, fake SSH logins, and attacker commands. Than restart Wazuh-Manager Done!