Skip to content

Add TYCHON Quantum Command integration package#20142

Open
Audience2801 wants to merge 7 commits into
elastic:mainfrom
Audience2801:main
Open

Add TYCHON Quantum Command integration package#20142
Audience2801 wants to merge 7 commits into
elastic:mainfrom
Audience2801:main

Conversation

@Audience2801

Copy link
Copy Markdown

Proposed commit message

Add the TYCHON Quantum Command integration package for Elastic Agent and Fleet

This change introduces the initial 2.0.4 release of the tychon_quantum_command integration package aligned to the current TYCHON Quantum Command release.

WHAT:

  • Adds the tychon_pqc logs data stream for TYCHON Quantum Command NDJSON/JSON output collected through the filestream input.
  • Adds the ingest pipeline and field mappings required to normalize TYCHON source events into ECS-aligned and product-specific fields.
  • Adds transform definitions that read from the namespace-safe source data stream pattern logs-tychon_quantum_command.tychon_pqc-* and publish analytical destination indices for TYCHON datasets including inventory, applications, certificates, ciphers, crypto libraries, keystores, VPN clients, IPsec tunnels, MACsec, installed apps, browser extensions, assets, archives, and system readiness.
  • Adds packaged Kibana assets including dashboards, visualizations, searches, tags, and index patterns for the supported TYCHON reporting views.
  • Adds package documentation, screenshots, validation configuration, sample events, and local tests to verify manifest assets, README generation, package readiness, stream configuration, changelog links, and Kibana saved object integrity.

WHY:

  • TYCHON Quantum Command produces security-relevant cryptographic inventory and post-quantum readiness data that benefits from centralized ingestion, normalization, analytics, and visualization in Elastic.
  • This package provides a supported ingestion path for TQC file output while preserving namespace-safe source indexing and producing dataset-focused transform destinations for dashboards and reporting.
  • The package version is intentionally kept at 2.0.4 so the initial integration release matches the currently released TQC version.

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.
  • I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

  • Verified elastic-package check completes successfully.
  • Verified elastic-package build produces tychon_quantum_command-2.0.4.zip.
  • Verified package docs use the generated README template flow.
  • Verified the root sample_event.json is a real event and not the default placeholder.
  • Verified transforms use the namespace-safe source pattern logs-tychon_quantum_command.tychon_pqc-*.
  • Verified local Python test suite passes.

How to test this PR locally

  1. Clone or update a local checkout of elastic/integrations.
  2. Copy this package into packages/tychon_quantum_command.
  3. From the repository root or package directory, run:
    elastic-package check
    elastic-package build

@cla-checker-service

cla-checker-service Bot commented Jul 15, 2026

Copy link
Copy Markdown

💚 CLA has been signed

@elastic-vault-github-plugin-prod

Copy link
Copy Markdown
Contributor

Reviewers

Buildkite won't run for external contributors automatically; you need to add a comment:

  • /test : will kick off a build in Buildkite.

NOTE: https://github.com/elastic/integrations/blob/main/.buildkite/pull-requests.json contains all those details.

@andrewkroh andrewkroh added needs CLA User must sign the Elastic Contributor License before review. New Integration Issue or pull request for creating a new integration package. documentation Improvements or additions to documentation. Applied to PRs that modify *.md files. labels Jul 15, 2026
@andrewkroh andrewkroh removed the needs CLA User must sign the Elastic Contributor License before review. label Jul 16, 2026
@Audience2801
Audience2801 marked this pull request as ready for review July 16, 2026 14:58
@Audience2801
Audience2801 requested a review from a team as a code owner July 16, 2026 14:58

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please re-export all the dashboards using elastic-package. The direct API save leaves the object as a JSON-encoded object in a string instead of a JSON object.

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I re-exported the dashboards and dependencies with elastic-package However, the resulting files still contain Kibana JSON-string fields such as panelsJSON, searchSourceJSON, and index pattern fields like fieldAttrs and fields. Could you clarify the exact normalization/export workflow you expect for package-ready saved objects in this repo?

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

How did you do that? Did you follow the instruction here?

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

that is correct, used 'elastic-package export dashboards' command. I provided them in latest commit. Let me know if there's something I'm missing in this process.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please remove the tests directory.

Comment on lines +200 to +220
**Exported fields**

| Field | Description | Type |
|---|---|---|
| @timestamp | | date |
| event.category | | keyword |
| event.dataset | | keyword |
| event.ingested | | date |
| host.hostname | | keyword |
| host.id | | keyword |
| id | Tychon unique document identifier for the application record. | keyword |
| kerberos.config_source | | keyword |
| kerberos.has_aes128 | | boolean |
| kerberos.has_aes256 | | boolean |
| kerberos.has_des | | boolean |
| kerberos.has_rc4 | | boolean |
| kerberos.is_quantum_safe | | boolean |
| kerberos.raw_bitmask | | long |
| kerberos.supported_types | | keyword |
| observer.domain | | keyword |
| observer.hostname | | keyword |

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These should not be included in the _dev/build/docs file, they should be templated into the final file in README.md by addition of the short code.

@Audience2801
Audience2801 requested a review from a team as a code owner July 17, 2026 20:32
… in README Template with {{ fields tychon_pqc }} and {{ event tychon_pqc }} - replaced dashboard and supporting objects with those output from 'elastic-package export dashboards' command.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

documentation Improvements or additions to documentation. Applied to PRs that modify *.md files. New Integration Issue or pull request for creating a new integration package.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants