Which credentials got attackers in

The textbook brute-force pattern is "many failures, then a success" from one source. On this honeypot that pattern almost never appears: Cowrie accepts nearly any password, so on a typical day every source that tries gets in at the first attempt, and only one or two ever fail. A detection tuned for the textbook pattern would stay silent here. Know your data before you trust a rule.

The useful question is therefore which credentials attackers bring. Count successful logins per username and password pair, and the number of distinct sources using each. A pair used by dozens of unrelated sources comes from a shared wordlist (default IoT and router passwords); a pair used by one source only may be something an attacker learned elsewhere.

Watch out for empty values: an empty username or password is a real attempt, but Wazuh's JSON decoder drops empty fields, so in Wazuh they are missing, not empty. Without "missing": "" the Wazuh query silently loses those rows.

index=honeypot_demo sourcetype=cowrie:json eventid="cowrie.login.success"
| stats count AS logins dc(src_ip) AS sources by username password
| sort - sources - logins

HP_Cowrie
| where eventid == "cowrie.login.success"
| summarize logins = count(), sources = array_length(make_set(src_ip)) by username, password
| sort by sources desc, logins desc

rule.id:100101

{
  "query": { "term": { "rule.id": "100101" } },
  "aggs": {
    "username": { "terms": { "field": "data.username", "size": 10000, "missing": "" },
      "aggs": {
        "password": { "terms": { "field": "data.password", "size": 10000, "missing": "" },
          "aggs": {
            "logins":  { "value_count": { "field": "rule.id" } },
            "sources": { "cardinality": { "field": "data.src_ip", "precision_threshold": 40000 } }
          } }
      } }
  }
}