<![CDATA[Background: Clone phishing can exploit trusted message formats and user behavior, while delayed event ingestion into a SIEM can prolong the interval during which a Blue Team remains unaware of a credential-compromise attempt. This study addresses the operational gap between phishing simulation events and automated security monitoring. Objective: This study develops and evaluates an early-notification framework that integrates Gophish, Wazuh SIEM, API-based event forwarding, and Telegram notifications, with the measurable objective of reducing phishing-event detection latency relative to manual event injection. Methods: A controlled comparative experiment was conducted in a Docker-based simulation environment using Gophish, MailHog, a Python API-polling engine, Wazuh SIEM, a Python integrator, and a Telegram bot. Manual Injection served as the baseline, while API Polling Forwarding served as the proposed mechanism. Detection latency was operationalized as the interval from the Gophish click timestamp to the Wazuh detection timestamp; Telegram delivery occurred after detection and was therefore not included in the mean time to detection (MTTD). Results: The aggregate comparison reported in the experiment showed an average detection latency of 72.60 seconds for Manual Injection and 3.73 seconds for API Polling Forwarding, corresponding to a 94.86% reduction in mean detection latency and a mean-detection-latency ratio of 19.46. These figures describe detection latency, not notification-delivery latency. Conclusion: Automated API-based forwarding substantially reduced the observed detection latency between Gophish and Wazuh and enabled automated post-detection notification to the Blue Team. Because polling introduces an interval-dependent delay, the framework is appropriately characterized as near-real-time rather than real-time.]]>
