--- /dev/null
+<!-- Rules for Modern Honeypot Network - Cowrie, -->
+
+<!-- IDs: 53830 - 53840 -->
+<!-- include /var/log/mhn/mhn-json.log to ossec.conf -->
+
+<group name="mhn,json">
+
+ <rule id="53830" level="8">
+ <decoded_as>cowrie</decoded_as>
+ <action>SSH login attempted on cowrie honeypot</action>
+ <description>SSH login attempted on cowrie honeypot</description>
+ </rule>
+
+ <rule id="53831" level="8">
+ <decoded_as>cowrie</decoded_as>
+ <action>SSH session on cowrie honeypot</action>
+ <description>SSH session established on cowrie honeypot</description>
+ </rule>
+
+ <rule id="53832" level="8">
+ <decoded_as>cowrie</decoded_as>
+ <action>command attempted on cowrie honeypot</action>
+ <description>A command was attempted in SSH session on cowrie honeypot</description>
+ </rule>
+
+</group>