LLM Honeypot Logs: Raw Cowrie Interaction Data for Security Research

Palisade Research released this collection of raw Cowrie honeypot logs in March 2026 to support cybersecurity research. The data captures network interactions and shell commands targeting custom LLM agents, accompanied by analysis scripts for processing the raw events.

Use Cases

• Analyzing attack patterns against LLM-integrated systems using raw Cowrie logs
• Filtering out internal testing traffic using the provided IP whitelist
• Developing intrusion detection signatures based on captured shell commands

Strengths

• Includes analysis scripts for raw log processing
• Captures interactions specifically targeting custom LLM agents
• Provides an IP whitelist to filter out manual testing noise

Limitations

• Unknown record count and data volume
• Lack of predefined column schema in the provided metadata
• Potential for high noise levels typical of raw honeypot captures

Provenance

Source

Palisade Research

Collection Method

Sensor (Cowrie honeypot)

Freshness

Last updated in March 2026.