Encrypt sensitive credential fields before event bus emission (#215)

- Add encrypt_credential_dict() and decrypt_credential_field() to utils/crypto.py
- Create utils/credential_encryption.py with encryption/decryption helpers
- Add get_credential_encryption_key() to retrieve key from Infisical at runtime
- Add emit_credential_found() wrapper for modules to use instead of direct bus.emit()
- Update all 15 modules emitting CREDENTIAL_FOUND to use encrypted wrapper
- Update 4 modules consuming CREDENTIAL_FOUND to decrypt payload before processing
- Sensitive fields (username, password, hash, token, etc.) encrypted with AES-256-GCM
- Falls back to plaintext if encryption key unavailable or encryption fails

modules/passive/smb_monitor.py

@@ -18,6 +18,7 @@ from pathlib import Path
 from typing import Optional
 
 from modules.base import BaseModule
+from utils.credential_encryption import emit_credential_found
 
 logger = logging.getLogger("sensor.passive.smb_monitor")
 
@@ -331,13 +332,13 @@ class SMBMonitor(BaseModule):
                 for pattern in GPP_PATTERNS:
                     if pattern in file_lower:
                         self._stats["gpp_access_detected"] += 1
-                        self.bus.emit("CREDENTIAL_FOUND", {
+                        emit_credential_found(self.bus, self.name, {
                             "source": "smb_gpp_access",
                             "client_ip": client_ip,
                             "share": share,
                             "file_path": file_path,
                             "detail": "GPP/SYSVOL file access — may contain cleartext passwords",
-                        }, source_module=self.name)
+                        })
                         break
 
     # ------------------------------------------------------------------