Strip OPSEC tool identity fingerprints

Replace all sensor.* logger namespaces with __name__ (generic module
identifiers instead of discoverable 'sensor.*' prefixes).

Change hardcoded 'bb' API user to 'admin' in config and code defaults.

Change hardcoded relay_user 'bb' to 'operator' — prevents network
profiling from exposing tool identity via SSH config.

Fixes #457, #458, #459
This commit is contained in:
Cobra
2026-04-08 22:18:35 -04:00
parent b34aab7986
commit ffd384f64b
69 changed files with 151 additions and 71 deletions
+1 -1
View File
@@ -20,7 +20,7 @@ from typing import Optional
from modules.base import BaseModule
from utils.credential_encryption import emit_credential_found
logger = logging.getLogger("sensor.intel.change_detector")
logger = logging.getLogger(__name__)
_SCHEMA = """
CREATE TABLE IF NOT EXISTS changes (
+1 -1
View File
@@ -19,7 +19,7 @@ from typing import Optional
from modules.base import BaseModule
from utils.credential_encryption import emit_credential_found
logger = logging.getLogger("sensor.intel.credential_db")
logger = logging.getLogger(__name__)
_TABLE_DDL = """
CREATE TABLE IF NOT EXISTS credentials (
+1 -1
View File
@@ -19,7 +19,7 @@ from typing import Optional
from modules.base import BaseModule
logger = logging.getLogger("sensor.intel.net_intel")
logger = logging.getLogger(__name__)
# Known malicious infrastructure patterns
_KNOWN_BAD_PORTS = {
+1 -1
View File
@@ -20,7 +20,7 @@ from typing import Optional
from modules.base import BaseModule
logger = logging.getLogger("sensor.intel.operator_audit")
logger = logging.getLogger(__name__)
_SCHEMA = """
CREATE TABLE IF NOT EXISTS audit_log (
+1 -1
View File
@@ -18,7 +18,7 @@ from typing import Optional
from modules.base import BaseModule
logger = logging.getLogger("sensor.intel.security_posture")
logger = logging.getLogger(__name__)
_SCHEMA = """
CREATE TABLE IF NOT EXISTS security_tools (
+1 -1
View File
@@ -17,7 +17,7 @@ from typing import Optional
from modules.base import BaseModule
logger = logging.getLogger("sensor.intel.supply_chain_detect")
logger = logging.getLogger(__name__)
_SCHEMA = """
CREATE TABLE IF NOT EXISTS supply_chain (
+3 -3
View File
@@ -19,7 +19,7 @@ from typing import Optional
from modules.base import BaseModule
from utils.credential_encryption import emit_credential_found
logger = logging.getLogger("sensor.intel.tool_output_parser")
logger = logging.getLogger(__name__)
# -----------------------------------------------------------------------
# Responder log patterns
@@ -372,8 +372,8 @@ class ToolOutputParser(BaseModule):
api_host = self.config.get("bettercap", {}).get("host", "127.0.0.1")
api_port = self.config.get("bettercap", {}).get("port", 8083)
api_user = self.config.get("bettercap", {}).get("user", "bb")
api_pass = self.config.get("bettercap", {}).get("password", "bb")
api_user = self.config.get("bettercap", {}).get("api_user", "admin")
api_pass = self.config.get("bettercap", {}).get("api_password", "")
base_url = f"http://{api_host}:{api_port}"
last_event_id = 0
+1 -1
View File
@@ -18,7 +18,7 @@ from typing import Optional
from modules.base import BaseModule
logger = logging.getLogger("sensor.intel.topology_mapper")
logger = logging.getLogger(__name__)
# OS family -> Graphviz fill color
_OS_COLORS = {
+1 -1
View File
@@ -19,7 +19,7 @@ from typing import Optional
from modules.base import BaseModule
from utils.credential_encryption import emit_credential_found
logger = logging.getLogger("sensor.intel.user_timeline")
logger = logging.getLogger(__name__)
_SCHEMA = """
CREATE TABLE IF NOT EXISTS user_events (