Strip OPSEC tool identity fingerprints
Replace all sensor.* logger namespaces with __name__ (generic module identifiers instead of discoverable 'sensor.*' prefixes). Change hardcoded 'bb' API user to 'admin' in config and code defaults. Change hardcoded relay_user 'bb' to 'operator' — prevents network profiling from exposing tool identity via SSH config. Fixes #457, #458, #459
This commit is contained in:
@@ -20,7 +20,7 @@ from typing import Optional
|
||||
from modules.base import BaseModule
|
||||
from utils.credential_encryption import emit_credential_found
|
||||
|
||||
logger = logging.getLogger("sensor.intel.change_detector")
|
||||
logger = logging.getLogger(__name__)
|
||||
|
||||
_SCHEMA = """
|
||||
CREATE TABLE IF NOT EXISTS changes (
|
||||
|
||||
@@ -19,7 +19,7 @@ from typing import Optional
|
||||
from modules.base import BaseModule
|
||||
from utils.credential_encryption import emit_credential_found
|
||||
|
||||
logger = logging.getLogger("sensor.intel.credential_db")
|
||||
logger = logging.getLogger(__name__)
|
||||
|
||||
_TABLE_DDL = """
|
||||
CREATE TABLE IF NOT EXISTS credentials (
|
||||
|
||||
@@ -19,7 +19,7 @@ from typing import Optional
|
||||
|
||||
from modules.base import BaseModule
|
||||
|
||||
logger = logging.getLogger("sensor.intel.net_intel")
|
||||
logger = logging.getLogger(__name__)
|
||||
|
||||
# Known malicious infrastructure patterns
|
||||
_KNOWN_BAD_PORTS = {
|
||||
|
||||
@@ -20,7 +20,7 @@ from typing import Optional
|
||||
|
||||
from modules.base import BaseModule
|
||||
|
||||
logger = logging.getLogger("sensor.intel.operator_audit")
|
||||
logger = logging.getLogger(__name__)
|
||||
|
||||
_SCHEMA = """
|
||||
CREATE TABLE IF NOT EXISTS audit_log (
|
||||
|
||||
@@ -18,7 +18,7 @@ from typing import Optional
|
||||
|
||||
from modules.base import BaseModule
|
||||
|
||||
logger = logging.getLogger("sensor.intel.security_posture")
|
||||
logger = logging.getLogger(__name__)
|
||||
|
||||
_SCHEMA = """
|
||||
CREATE TABLE IF NOT EXISTS security_tools (
|
||||
|
||||
@@ -17,7 +17,7 @@ from typing import Optional
|
||||
|
||||
from modules.base import BaseModule
|
||||
|
||||
logger = logging.getLogger("sensor.intel.supply_chain_detect")
|
||||
logger = logging.getLogger(__name__)
|
||||
|
||||
_SCHEMA = """
|
||||
CREATE TABLE IF NOT EXISTS supply_chain (
|
||||
|
||||
@@ -19,7 +19,7 @@ from typing import Optional
|
||||
from modules.base import BaseModule
|
||||
from utils.credential_encryption import emit_credential_found
|
||||
|
||||
logger = logging.getLogger("sensor.intel.tool_output_parser")
|
||||
logger = logging.getLogger(__name__)
|
||||
|
||||
# -----------------------------------------------------------------------
|
||||
# Responder log patterns
|
||||
@@ -372,8 +372,8 @@ class ToolOutputParser(BaseModule):
|
||||
|
||||
api_host = self.config.get("bettercap", {}).get("host", "127.0.0.1")
|
||||
api_port = self.config.get("bettercap", {}).get("port", 8083)
|
||||
api_user = self.config.get("bettercap", {}).get("user", "bb")
|
||||
api_pass = self.config.get("bettercap", {}).get("password", "bb")
|
||||
api_user = self.config.get("bettercap", {}).get("api_user", "admin")
|
||||
api_pass = self.config.get("bettercap", {}).get("api_password", "")
|
||||
|
||||
base_url = f"http://{api_host}:{api_port}"
|
||||
last_event_id = 0
|
||||
|
||||
@@ -18,7 +18,7 @@ from typing import Optional
|
||||
|
||||
from modules.base import BaseModule
|
||||
|
||||
logger = logging.getLogger("sensor.intel.topology_mapper")
|
||||
logger = logging.getLogger(__name__)
|
||||
|
||||
# OS family -> Graphviz fill color
|
||||
_OS_COLORS = {
|
||||
|
||||
@@ -19,7 +19,7 @@ from typing import Optional
|
||||
from modules.base import BaseModule
|
||||
from utils.credential_encryption import emit_credential_found
|
||||
|
||||
logger = logging.getLogger("sensor.intel.user_timeline")
|
||||
logger = logging.getLogger(__name__)
|
||||
|
||||
_SCHEMA = """
|
||||
CREATE TABLE IF NOT EXISTS user_events (
|
||||
|
||||
Reference in New Issue
Block a user