Encrypt sensitive credential fields before event bus emission (#215)

- Add encrypt_credential_dict() and decrypt_credential_field() to utils/crypto.py
- Create utils/credential_encryption.py with encryption/decryption helpers
- Add get_credential_encryption_key() to retrieve key from Infisical at runtime
- Add emit_credential_found() wrapper for modules to use instead of direct bus.emit()
- Update all 15 modules emitting CREDENTIAL_FOUND to use encrypted wrapper
- Update 4 modules consuming CREDENTIAL_FOUND to decrypt payload before processing
- Sensitive fields (username, password, hash, token, etc.) encrypted with AES-256-GCM
- Falls back to plaintext if encryption key unavailable or encryption fails

This commit is contained in:

Cobra

2026-04-06 11:43:46 -04:00

parent f15b8994cd

commit edf2ea7c36

18 changed files with 256 additions and 63 deletions

									
										modules/active/ntlm_relay.py
									
		+1
		
												View File
												
				@@ -18,6 +18,7 @@ import time

				from typing import Optional

				from modules.base import BaseModule

				from utils.credential_encryption import emit_credential_found

				logger = logging.getLogger("sensor.active.ntlm_relay")