# Graylog Phishing Detection (Screenshot-Backed Portfolio Project)

This repository documents a **phishing simulation lab** and **Graylog detection workflow** using screenshots plus safe, educational example files.

> **Note:** The real lab used Postfix, Filebeat, Graylog, and PhishTool. This repo includes screenshots and illustrative files so reviewers can understand the approach without any sensitive data.

---

## 📁 Project Structure

- [`scripts/`](scripts/) – Example script to generate a sample `.eml` (no actual sending)
- [`configs/`](configs/) – Example Filebeat and Postfix configs (educational)
- [`detections/`](detections/) – Example Graylog pipeline rule
- [`dashboards/`](dashboards/) – Placeholder JSON describing dashboard intent
- [`samples/`](samples/) – Redacted sample email and log lines
- [`docs/screenshots/`](docs/screenshots/) – All screenshots from the lab

---

## 🧭 Walkthrough (Screenshots)

![Phishing Email Script](docs/screenshots/phishing_email_script.png)

---

## 🔍 Detection Logic (Summary)

- **URL shorteners:** match on `bit.ly`, `t.co`, `tinyurl`, `goo.gl` in message content
- **Phishing phrases:** "account locked", "verify account", "unusual activity"
- **Context fields:** add `phishing_indicator=true` and `indicator_reason` when matched

See: [`detections/graylog_pipeline_rule.txt`](detections/graylog_pipeline_rule.txt)

---

## ⚙️ Example Ingest (Filebeat → Graylog)

Filebeat tails mail logs and ships them to a GELF UDP input in Graylog. See:
- [`configs/filebeat_config.yml`](configs/filebeat_config.yml)

---

## 🧪 Sample Artifacts

- [`samples/phishing_email.eml`](samples/phishing_email.eml) – educational example email
- [`samples/sample_log.txt`](samples/sample_log.txt) – truncated mail log lines

---

## 🚨 Disclaimer

This is a **lab simulation** for educational and portfolio purposes only. Do **not** use these techniques outside controlled environments without explicit permission.