diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index 5784ed08f27..a780f536e55 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -591,6 +591,7 @@ /packages/trend_micro_vision_one @elastic/security-service-integrations @elastic/sit-crest-contractors /packages/trendmicro @elastic/security-service-integrations @elastic/sit-crest-contractors /packages/tychon @elastic/security-service-integrations @elastic/sit-crest-contractors +/packages/tychon_quantum_command @elastic/security-service-integrations @elastic/sit-crest-contractors /packages/udp @elastic/integration-experience /packages/unifiedlogs @elastic/sec-windows-platform /packages/universal_profiling_agent @elastic/ingest-otel-data diff --git a/dev/gitutil/git.go b/dev/gitutil/git.go deleted file mode 100644 index e716d0540d6..00000000000 --- a/dev/gitutil/git.go +++ /dev/null @@ -1,39 +0,0 @@ -// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one -// or more contributor license agreements. Licensed under the Elastic License; -// you may not use this file except in compliance with the Elastic License. - -package gitutil - -import ( - "bytes" - "fmt" - "os" - "os/exec" - "strings" -) - -// Git runs git commands in Dir. An empty Dir means the current working directory. -type Git struct{ Dir string } - -// Run runs a git command forwarding stdout and stderr to the terminal. -func (g Git) Run(args ...string) error { - cmd := exec.Command("git", args...) - cmd.Dir = g.Dir - cmd.Stdout = os.Stdout - cmd.Stderr = os.Stderr - return cmd.Run() -} - -// Output runs a git command and returns its stdout as a string. -// On failure the returned error includes git's stderr output. -func (g Git) Output(args ...string) (string, error) { - var stderr bytes.Buffer - cmd := exec.Command("git", args...) - cmd.Dir = g.Dir - cmd.Stderr = &stderr - out, err := cmd.Output() - if err != nil { - return "", fmt.Errorf("%w: %s", err, strings.TrimSpace(stderr.String())) - } - return string(out), nil -} diff --git a/packages/tychon_quantum_command/_dev/build/docs/README.md b/packages/tychon_quantum_command/_dev/build/docs/README.md new file mode 100644 index 00000000000..ac2693d3e7e --- /dev/null +++ b/packages/tychon_quantum_command/_dev/build/docs/README.md @@ -0,0 +1,201 @@ +{{ generatedHeader }} + + +# TYCHON Quantum Command Integration for Elastic + +## Overview + +[TYCHON Quantum Command](https://tychon.io/products/tychon/pqc-management-module/) helps organizations inventory cryptographic implementations, assess post-quantum exposure, and prioritize remediation across endpoints, applications, certificates, network services, key stores, and platform readiness. This integration ingests TYCHON Quantum Command output files into Elastic, normalizes the source stream, and publishes entity-focused transform destinations for dashboards, search, and reporting. + +### Compatibility + +* Intended for environments where TYCHON Quantum Command produces NDJSON or JSON output files on Windows, Linux, or macOS systems. +* Requires a valid TYCHON Quantum Command license. +* Requires Elastic Stack / Fleet compatible with package version `2.0.4` and the package manifest constraint `^8.11.0`. + +### How it works + +1. TYCHON Quantum Command writes scan results to local `.ndjson` or `.json` files. +2. Elastic Agent collects those files through the `filestream` input in the `tychon_pqc` data stream. +3. The ingest pipeline stores the raw events in the namespace-specific source data stream `logs-tychon_quantum_command.tychon_pqc-`. +4. Elasticsearch transforms filter the combined source stream by `tychon.index` and publish dataset-specific destination indices such as `tychon-pqc-inventory`, `tychon-pqc-certificates`, and `tychon-pqc-system-readiness`. +5. Kibana dashboards and saved objects query both the raw and transformed views for operational analysis. + +## What data does this integration collect? + +The integration collects file-based TYCHON Quantum Command output in NDJSON or JSON form. The package is designed around one primary ingest stream and multiple analytical transforms. + +### Primary ingest stream + +* Data stream: `tychon_pqc` +* Data stream type: `logs` +* Expected source formats: NDJSON and JSON records written by TYCHON Quantum Command +* Collection method: Elastic Agent `filestream` +* Namespace-safe source data stream pattern used by transforms: `logs-tychon_quantum_command.tychon_pqc-*` +* Index template used by the source data stream: `logs-tychon_quantum_command.tychon_pqc` +* Backing index naming pattern for the source data stream: `.ds-logs-tychon_quantum_command.tychon_pqc--YYYY.MM.DD-000001` + +### Analytical datasets produced by transforms + +The package currently publishes the following destination indices from the shared source stream: + +* `tychon-pqc-applications` +* `tychon-pqc-archives` +* `tychon-pqc-assets` +* `tychon-pqc-certificates` +* `tychon-pqc-ciphers` +* `tychon-pqc-crypto-libraries` +* `tychon-pqc-installed-apps` +* `tychon-pqc-installed-browser-extensions` +* `tychon-pqc-inventory` +* `tychon-pqc-ipsec-tunnels` +* `tychon-pqc-keystores` +* `tychon-pqc-macsec` +* `tychon-pqc-system-readiness` +* `tychon-pqc-vpn-clients` + +### Supported use cases + +* Build a cryptographic inventory across endpoints and applications. +* Identify classical algorithms, deprecated protocols, and post-quantum readiness gaps. +* Review certificate and keystore exposure, including signature and key algorithm posture. +* Track TLS, VPN, IPsec, MACsec, and related network cryptography risk. +* Estimate remediation readiness and cost through the `system-readiness` transform. +* Drive dashboards for inventory, application reporting, certificate operations, and cost analysis. + +## What do I need to use this integration? + +* Elastic Agent enrolled in Fleet. +* Access to the host or file share where TYCHON Quantum Command writes scan output. +* File system permissions that allow Elastic Agent to read the output directory. +* A deployment decision for the Fleet namespace. The package supports any namespace; transforms read from `logs-tychon_quantum_command.tychon_pqc-*`. +* Enough Elasticsearch capacity for the raw source stream plus the transform destination indices. + +## How do I deploy this integration? + +### Agent-based deployment + +Install Elastic Agent on a host that can read the TYCHON Quantum Command output files. For Elastic Agent installation guidance, see the Elastic Agent [installation instructions](https://www.elastic.co/guide/en/fleet/current/elastic-agent-installation.html). + +### Set up steps in TYCHON Quantum Command + +1. Configure TYCHON Quantum Command to export scan results in NDJSON format. JSON-formatted records can also be ingested when they are emitted one record per event. +2. Choose a stable output location that Elastic Agent can read. +3. Ensure scan results are written with file permissions that allow the Elastic Agent service account to read them. +4. If you separate environments by namespace in Fleet, keep the TYCHON output pathing and the Elastic policy aligned with the intended namespace. +5. Preserve enough scan history on disk for Elastic Agent to pick up new files reliably. + +#### Vendor resources + +* [TYCHON Quantum Command product page](https://tychon.io/products/tychon/pqc-management-module/) +* [TYCHON Quantum Command portal](https://acdiscanner.tychon.io/) +* [TYCHON support portal](https://support.tychon.io/) +* [TYCHON contact page](https://tychon.io/products/tychon/pqc-management-module/#ContactUs) + +### Set up steps in Kibana + +1. Open **Integrations** and install **TYCHON Quantum Command**. +2. Add the integration to an Elastic Agent policy. +3. Set the Windows paths, Linux paths, and any additional custom paths that contain TYCHON output files. +4. Choose the target namespace for the integration policy. +5. Save and deploy the policy. +6. Confirm that documents are arriving in `logs-tychon_quantum_command.tychon_pqc-`. +7. Wait for the managed transforms to populate the destination indices. +8. Open the packaged dashboards to validate the transformed views. + +### Validation + +Use the following checks after deployment: + +* Confirm raw ingest by querying `logs-tychon_quantum_command.tychon_pqc-` for recent events. +* Confirm dataset routing by checking the `tychon.index` values present in the source stream. +* Confirm transform output by verifying documents appear in indices such as `tychon-pqc-inventory`, `tychon-pqc-certificates`, and `tychon-pqc-system-readiness`. +* Open the packaged dashboards and verify charts populate without missing data view errors. +* Review a few representative documents to confirm timestamps, observer metadata, and TYCHON-specific fields were parsed as expected. + + +## Troubleshooting + +* No data in the source stream: verify the file path settings, file permissions, and that TYCHON is actually writing new files. +* Data in the source stream but empty dashboards: verify transforms are running and that the relevant `tychon.index` values exist in the raw events. +* Expected namespace has no transformed data: verify documents are landing in the intended namespace and that transforms can read the shared source pattern `logs-tychon_quantum_command.tychon_pqc-*`. +* Parsing issues: inspect `error.message`, malformed JSON records, and any unexpected multiline output in the source files. +* Duplicate or stale transformed records: review the transform `latest.unique_key` behavior and verify the top-level `id` values remain stable across rescans. +* Certificate or readiness documents feel oversized: review large text fields such as PEM content and detailed reports before production retention policies are finalized. + +## Performance and scaling + +This package stores both the raw ingest stream and multiple transformed destination indices. Capacity planning should account for: + +* Raw source event volume from TYCHON scans. +* Transform frequency, sync delay, and destination index growth. +* Retention requirements for both source and transformed data. +* Dashboard workloads that query multiple destination indices. + +For broader scaling guidance, see Elastic's [Ingest Architectures](https://www.elastic.co/docs/manage-data/ingest/ingest-reference-architectures) documentation. + +## Reference + +### Inputs used + +These inputs can be used with this integration: + +
+filestream + +### Setup + +For more details about the Filestream input settings, see the [Filebeat filestream input documentation](https://www.elastic.co/docs/reference/beats/filebeat/filebeat-input-filestream). + +### Collecting logs with filestream + +Configure the input with one or more paths that point to TYCHON Quantum Command output files. + +Default package path variables: + +* Windows paths: + * `C:\Program Files\Tychon\*.ndjson` + * `C:\ProgramData\Tychon\*.ndjson` +* Linux paths: + * `/var/log/tychon/*.ndjson` + * `/opt/tychon/*.ndjson` +* Additional custom paths: + * Any extra directories where TYCHON scan exports are written. + +Optional package settings: + +* `preserve_original_event`: copies the original message to `event.original` before ingest processing. +* `tags`: appends custom tags to collected events. + +
+ +### API usage + +This integration does not call a TYCHON vendor API. It is a file-based integration that ingests TYCHON Quantum Command output written to disk. + +### Vendor documentation links + +* [TYCHON Quantum Command product page](https://tychon.io/products/tychon/pqc-management-module/) +* [TYCHON support portal](https://support.tychon.io/) +* [Elastic Agent installation](https://www.elastic.co/guide/en/fleet/current/elastic-agent-installation.html) +* [Elastic filestream input reference](https://www.elastic.co/docs/reference/beats/filebeat/filebeat-input-filestream) + +### Data streams + +#### `tychon_pqc` + +The `tychon_pqc` data stream receives TYCHON Quantum Command output files collected through the `filestream` input. Source events are stored in the namespace-specific stream `logs-tychon_quantum_command.tychon_pqc-` and then filtered by transforms using the `tychon.index` discriminator. + +This stream can contain multiple TYCHON record families in one place, including inventory, certificates, ciphers, applications, crypto libraries, readiness, keystores, VPN client findings, IPsec tunnel findings, MACsec findings, installed application data, browser extension data, archives, and other supporting scan artifacts. + +**Exported fields** + +{{ fields "tychon_pqc" }} + +**Example event** + +{{ event "tychon_pqc" }} + +### Data streams using ILM policies + +This package does not define a custom package-level ILM policy. Apply retention and lifecycle controls according to your deployment standards for both the raw source stream and the transform destination indices. diff --git a/packages/tychon_quantum_command/changelog.yml b/packages/tychon_quantum_command/changelog.yml new file mode 100644 index 00000000000..effe880656e --- /dev/null +++ b/packages/tychon_quantum_command/changelog.yml @@ -0,0 +1,5 @@ +- version: 2.0.4 + changes: + - description: Initial release of the TYCHON Quantum Command integration package. + type: enhancement + link: https://github.com/elastic/integrations/pull/20142 diff --git a/packages/tychon_quantum_command/data_stream/tychon_pqc/agent/stream/stream.yml.hbs b/packages/tychon_quantum_command/data_stream/tychon_pqc/agent/stream/stream.yml.hbs new file mode 100644 index 00000000000..e776f9b81fd --- /dev/null +++ b/packages/tychon_quantum_command/data_stream/tychon_pqc/agent/stream/stream.yml.hbs @@ -0,0 +1,44 @@ +paths: +{{#each windows_paths}} + - {{this}} +{{/each}} +{{#each linux_paths}} + - {{this}} +{{/each}} +{{#each paths}} + - {{this}} +{{/each}} + +prospector.scanner.exclude_files: ['.gz$'] + +tags: +{{#if preserve_original_event}} + - preserve_original_event +{{/if}} +{{#if tags}} +{{#each tags}} + - {{this}} +{{/each}} +{{else}} + - tychon + - quantum +{{/if}} + +fields_under_root: true + +parsers: + - ndjson: + target: "" + overwrite_keys: true + expand_keys: true + +processors: + - add_locale: ~ +{{#if preserve_original_event}} + - copy_fields: + fields: + - from: message + to: event.original + fail_on_error: false + ignore_missing: true +{{/if}} diff --git a/packages/tychon_quantum_command/data_stream/tychon_pqc/elasticsearch/ingest_pipeline/default.yml b/packages/tychon_quantum_command/data_stream/tychon_pqc/elasticsearch/ingest_pipeline/default.yml new file mode 100644 index 00000000000..49ce3e92983 --- /dev/null +++ b/packages/tychon_quantum_command/data_stream/tychon_pqc/elasticsearch/ingest_pipeline/default.yml @@ -0,0 +1,627 @@ +--- +description: Main ingest pipeline for Tychon Quantum Command. +processors: + - set: + field: ecs.version + value: 8.17.0 + + - json: + field: message + add_to_root: true + if: ctx.tychon == null && ctx.message != null + ignore_failure: true + + - rename: + field: timestamp + target_field: "@timestamp" + ignore_missing: true + ignore_failure: true + + - date: + field: "@timestamp" + formats: + - ISO8601 + ignore_failure: true + + - set: + field: event.ingested + value: "{{_ingest.timestamp}}" + + - script: + lang: painless + description: Preserve flat event.* fields before event defaults are applied. + source: > + if (ctx.event == null || !(ctx.event instanceof Map)) { + ctx.event = [:]; + } + if (ctx.event.dataset == null && ctx.containsKey('event.dataset')) { + ctx.event.dataset = ctx['event.dataset']; + ctx.remove('event.dataset'); + } + if (ctx.event.kind == null && ctx.containsKey('event.kind')) { + ctx.event.kind = ctx['event.kind']; + ctx.remove('event.kind'); + } + if (ctx.event.action == null && ctx.containsKey('event.action')) { + ctx.event.action = ctx['event.action']; + ctx.remove('event.action'); + } + if (ctx.event.type == null && ctx.containsKey('event.type')) { + ctx.event.type = ctx['event.type']; + ctx.remove('event.type'); + } + if (ctx.event.category == null && ctx.containsKey('event.category')) { + def category = ctx['event.category']; + if (category instanceof List) { + ctx.event.category = category; + } else if (category instanceof String && category.contains(',')) { + List categories = new ArrayList(); + for (String item : category.splitOnToken(',')) { + String trimmed = item.trim(); + if (trimmed.length() > 0) { + categories.add(trimmed); + } + } + ctx.event.category = categories; + } else { + ctx.event.category = [category]; + } + ctx.remove('event.category'); + } + + - set: + field: event.kind + value: event + if: ctx.event == null || ctx.event.kind == null + + - set: + field: event.category + value: + - configuration + if: ctx.event == null || ctx.event.category == null + + - script: + lang: painless + source: > + if (ctx.event == null || !(ctx.event instanceof Map)) { + ctx.event = [:]; + } + def tychonIndex = null; + if (ctx.containsKey('tychon') && ctx.tychon instanceof Map && ctx.tychon.containsKey('index') && ctx.tychon.index != null) { + tychonIndex = ctx.tychon.index.toString(); + } + def eventAction = ctx.event.action != null ? ctx.event.action.toString() : null; + def genericDataset = tychonIndex != null ? 'tychon_quantum_command.' + tychonIndex : null; + def currentDataset = ctx.event.dataset; + def shouldDeriveDataset = ( + currentDataset == null || + currentDataset == 'tychon_quantum_command.tychon_pqc' || + currentDataset == 'tychon_pqc' || + (genericDataset != null && currentDataset == genericDataset) || + (genericDataset != null && currentDataset instanceof List && currentDataset.contains(genericDataset)) + ); + if (shouldDeriveDataset) { + def dataset = 'tychon_quantum_command.tychon_pqc'; + if (tychonIndex != null) { + if (tychonIndex == 'applications') { + dataset = 'tychon.application'; + } else if (tychonIndex == 'installed-apps') { + dataset = 'tychon.installed_app'; + } else if (tychonIndex == 'installed-browser-extensions') { + dataset = 'tychon.browser_extension'; + } else if (tychonIndex == 'ciphers') { + dataset = 'tychon.cipher'; + } else if (tychonIndex == 'system-readiness') { + if (eventAction == 'quantum_assessment_app_group') { + dataset = 'quantum_assessment.app_group'; + } else { + dataset = 'quantum_assessment'; + } + } else { + dataset = genericDataset; + } + } + ctx.event.dataset = dataset; + } + + - set: + field: data_stream.type + value: logs + + - set: + field: data_stream.dataset + value: tychon_pqc + + - set: + field: tychon.pipeline.processed + value: true + + - remove: + field: host.ipv4 + ignore_missing: true + if: ctx?.host?.ipv4 instanceof String && ctx.host.ipv4.trim().length() == 0 + + - remove: + field: host.ipv6 + ignore_missing: true + if: ctx?.host?.ipv6 instanceof String && ctx.host.ipv6.trim().length() == 0 + + - dot_expander: + field: "*" + ignore_failure: true + + - split: + field: tls.supported_protocols + separator: ",\\s*" + ignore_missing: true + + - split: + field: tls.supported_ciphers + separator: ",\\s*" + ignore_missing: true + + - split: + field: tls.supported_key_exchanges + separator: ",\\s*" + ignore_missing: true + + - split: + field: tls.previous_supported_protocols + separator: ",\\s*" + ignore_missing: true + + - split: + field: tls.previous_supported_ciphers + separator: ",\\s*" + ignore_missing: true + + - split: + field: tls.previous_supported_key_exchanges + separator: ",\\s*" + ignore_missing: true + + - split: + field: tychon.cipher_quick.supported_protocols + separator: ",\\s*" + ignore_missing: true + + - split: + field: tychon.cipher_quick.supported_cipher_suites + separator: ",\\s*" + ignore_missing: true + + - split: + field: tychon.cipher_quick.supported_key_exchanges + separator: ",\\s*" + ignore_missing: true + + - split: + field: tls.insecure_ciphers + separator: ",\\s*" + ignore_missing: true + + - split: + field: tls.weak_ciphers + separator: ",\\s*" + ignore_missing: true + + - split: + field: tychon.cipher_quick.insecure_ciphers + separator: ",\\s*" + ignore_missing: true + + - split: + field: tychon.cipher_quick.weak_ciphers + separator: ",\\s*" + ignore_missing: true + + - split: + field: host.ip + separator: ",\\s*" + ignore_missing: true + if: ctx?.host?.ip instanceof String + + - split: + field: tychon.routing.original.host_ip + separator: ",\\s*" + ignore_missing: true + if: ctx?.tychon?.routing?.original?.host_ip instanceof String + + - split: + field: tychon.routing.target.ip + separator: ",\\s*" + ignore_missing: true + if: ctx?.tychon?.routing?.target?.ip instanceof String + + - split: + field: tychon.tags + separator: ",\\s*" + ignore_missing: true + + - split: + field: tychon.installed_app.crypto_libraries + separator: ",\\s*" + ignore_missing: true + + - script: + lang: painless + description: Normalize host.ip from literal dotted field or comma-delimited string. + source: > + if (ctx.containsKey('host.ip')) { + def dottedHostIp = ctx['host.ip']; + if (dottedHostIp instanceof String && dottedHostIp.contains(',')) { + List ips = new ArrayList(); + for (String ip : dottedHostIp.splitOnToken(',')) { + String trimmed = ip.trim(); + if (trimmed.length() > 0) { + ips.add(trimmed); + } + } + if (ctx.host == null) { + ctx.host = [:]; + } + if (ctx.host.ip == null) { + ctx.host.ip = ips; + } + } else if (ctx.host == null) { + ctx.host = ['ip': dottedHostIp]; + } else if (ctx.host.ip == null) { + ctx.host.ip = dottedHostIp; + } + ctx.remove('host.ip'); + } + if (ctx?.host?.ip instanceof String && ctx.host.ip.contains(',')) { + List ips = new ArrayList(); + for (String ip : ctx.host.ip.splitOnToken(',')) { + String trimmed = ip.trim(); + if (trimmed.length() > 0) { + ips.add(trimmed); + } + } + ctx.host.ip = ips; + } + + - script: + lang: painless + description: Reconstruct tychon.certificate_leaf_details from certificate fields. + if: ctx?.certificate != null && ctx?.tychon?.certificate_leaf_details == null + source: > + if (ctx.tychon == null) { + ctx.tychon = [:]; + } + Map leafDetails = [:]; + Map subject = [:]; + if (ctx.certificate.subject_common_name != null) { subject.common_name = ctx.certificate.subject_common_name; } + if (ctx.certificate.subject_country != null) { subject.country = ctx.certificate.subject_country; } + if (ctx.certificate.subject_locality != null) { subject.locality = ctx.certificate.subject_locality; } + if (ctx.certificate.subject_organization != null) { subject.organization = ctx.certificate.subject_organization; } + if (ctx.certificate.subject_organizational_unit != null) { subject.organizational_unit = ctx.certificate.subject_organizational_unit; } + if (ctx.certificate.subject_province != null) { subject.province = ctx.certificate.subject_province; } + if (ctx.certificate.subject != null) { subject.raw_string = ctx.certificate.subject; } + if (!subject.isEmpty()) { leafDetails.subject = subject; } + Map issuer = [:]; + if (ctx.certificate.issuer_common_name != null) { issuer.common_name = ctx.certificate.issuer_common_name; } + if (ctx.certificate.issuer_country != null) { issuer.country = ctx.certificate.issuer_country; } + if (ctx.certificate.issuer_locality != null) { issuer.locality = ctx.certificate.issuer_locality; } + if (ctx.certificate.issuer_organization != null) { issuer.organization = ctx.certificate.issuer_organization; } + if (ctx.certificate.issuer_organizational_unit != null) { issuer.organizational_unit = ctx.certificate.issuer_organizational_unit; } + if (ctx.certificate.issuer_province != null) { issuer.province = ctx.certificate.issuer_province; } + if (ctx.certificate.issuer != null) { issuer.raw_string = ctx.certificate.issuer; } + if (!issuer.isEmpty()) { leafDetails.issuer = issuer; } + Map validity = [:]; + if (ctx.certificate.not_before != null) { validity.not_before = ctx.certificate.not_before; } + if (ctx.certificate.not_after != null) { validity.not_after = ctx.certificate.not_after; } + if (ctx.certificate.validity != null && ctx.certificate.validity instanceof Map && ctx.certificate.validity.duration_days != null) { validity.duration_days = ctx.certificate.validity.duration_days; } + if (!validity.isEmpty()) { leafDetails.validity = validity; } + if (ctx.certificate.serial_number != null) { leafDetails.serial_number = ctx.certificate.serial_number; } + if (ctx.certificate.signature_algorithm != null) { leafDetails.signature_algorithm = ctx.certificate.signature_algorithm; } + if (ctx.certificate.signature_hex != null) { leafDetails.signature_hex = ctx.certificate.signature_hex; } + if (ctx.certificate.version != null) { leafDetails.version = ctx.certificate.version; } + if (ctx.certificate.is_csr != null) { leafDetails.is_csr = ctx.certificate.is_csr; } + if (ctx.certificate.is_private_key != null) { leafDetails.is_private_key = ctx.certificate.is_private_key; } + if (ctx.certificate.is_self_signed != null) { leafDetails.is_self_signed = ctx.certificate.is_self_signed; } + if (ctx.certificate.key_usage != null) { leafDetails.key_usage = ctx.certificate.key_usage; } + if (ctx.certificate.extended_key_usage != null) { leafDetails.extended_key_usage = ctx.certificate.extended_key_usage; } + if (ctx.certificate.basic_constraints != null) { leafDetails.basic_constraints = ctx.certificate.basic_constraints; } + if (ctx.certificate.subject_public_key_info != null) { leafDetails.subject_public_key_info = ctx.certificate.subject_public_key_info; } + if (ctx.certificate.sha256_fingerprint != null) { leafDetails.sha256_fingerprint = ctx.certificate.sha256_fingerprint; } + if (ctx.certificate.sha1_fingerprint != null) { leafDetails.sha1_fingerprint = ctx.certificate.sha1_fingerprint; } + if (ctx.certificate.subject_key_id != null) { leafDetails.subject_key_id = ctx.certificate.subject_key_id; } + if (ctx.certificate.pqc_vulnerable != null) { leafDetails.pqc_vulnerable = ctx.certificate.pqc_vulnerable; } + if (ctx.certificate.raw_pem_certificate != null) { leafDetails.raw_pem_certificate = ctx.certificate.raw_pem_certificate; } + if (ctx.certificate.source_id != null) { leafDetails.source_id = ctx.certificate.source_id; } + ctx.tychon.certificate_leaf_details = leafDetails; + + - script: + lang: painless + description: Reconstruct tychon.cipher_negotiation from cipher fields. + if: ctx?.cipher != null + source: > + if (ctx.tychon == null) { + ctx.tychon = [:]; + } + Map cipherNeg = [:]; + if (ctx.cipher.cipher_suite != null) { cipherNeg.cipher_suite = ctx.cipher.cipher_suite; } + if (ctx.cipher.protocol != null) { cipherNeg.protocol = ctx.cipher.protocol; } + if (ctx.cipher.key_length_bits != null) { cipherNeg.key_length_bits = ctx.cipher.key_length_bits; } + if (ctx.cipher.is_preferred != null) { cipherNeg.is_preferred = ctx.cipher.is_preferred; } + if (ctx.cipher.active != null) { cipherNeg.active = ctx.cipher.active; } + if (ctx.cipher.source != null) { cipherNeg.source = ctx.cipher.source; } + if (ctx.cipher.source_id != null) { cipherNeg.source_id = ctx.cipher.source_id; } + if (ctx.cipher.universal_id != null) { cipherNeg.universal_id = ctx.cipher.universal_id; } + if (ctx.cipher.session_id != null) { cipherNeg.session_id = ctx.cipher.session_id; } + if (ctx.cipher.compression_method != null) { cipherNeg.compression_method = ctx.cipher.compression_method; } + if (ctx.cipher.alpn_protocol != null) { cipherNeg.alpn_protocol = ctx.cipher.alpn_protocol; } + if (ctx.cipher.last_seen != null) { cipherNeg.last_seen = ctx.cipher.last_seen; } + if (ctx.cipher.session_ticket_lifetime_hint_seconds != null) { cipherNeg.session_ticket_lifetime_hint_seconds = ctx.cipher.session_ticket_lifetime_hint_seconds; } + if (ctx.cipher.intel != null) { cipherNeg.intel = ctx.cipher.intel; } + ctx.tychon.cipher_negotiation = cipherNeg; + + - script: + lang: painless + description: Convert cipher vulnerability strings into arrays. + if: ctx?.tychon?.cipher_negotiation?.intel?.vulnerabilities != null + source: > + if (ctx.tychon.cipher_negotiation.intel.vulnerabilities instanceof String) { + String vulnString = ctx.tychon.cipher_negotiation.intel.vulnerabilities; + List vulnList = new ArrayList(); + String[] parts = vulnString.splitOnToken(','); + for (String part : parts) { + String trimmed = part.trim(); + if (trimmed.length() > 0) { + vulnList.add(trimmed); + } + } + ctx.tychon.cipher_negotiation.intel.vulnerabilities = vulnList; + } + + - script: + lang: painless + description: Default app-group instance counts without leaking app-family fields into root assessments. + if: ctx?.quantum_readiness?.cost_analysis != null && ctx?.event?.dataset == 'quantum_assessment.app_group' + source: > + if (ctx.quantum_readiness.cost_analysis instanceof Map) { + Map costAnalysis = ctx.quantum_readiness.cost_analysis; + if (costAnalysis.instance_count == null) { + costAnalysis.instance_count = 1; + } + } + + - set: + field: x509.subject.common_name + value: "{{certificate.subject_common_name}}" + if: ctx?.certificate?.subject_common_name != null + + - set: + field: x509.issuer.common_name + value: "{{certificate.issuer_common_name}}" + if: ctx?.certificate?.issuer_common_name != null + + - set: + field: x509.issuer.organization + value: "{{certificate.issuer_organization}}" + if: ctx?.certificate?.issuer_organization != null + + - set: + field: x509.subject.organization + value: "{{certificate.subject_organization}}" + if: ctx?.certificate?.subject_organization != null + + - set: + field: x509.serial_number + value: "{{certificate.serial_number}}" + if: ctx?.certificate?.serial_number != null + + - set: + field: x509.signature_algorithm + value: "{{certificate.signature_algorithm}}" + if: ctx?.certificate?.signature_algorithm != null + + - set: + field: x509.not_before + value: "{{certificate.not_before}}" + if: ctx?.certificate?.not_before != null + + - set: + field: x509.not_after + value: "{{certificate.not_after}}" + if: ctx?.certificate?.not_after != null + + - set: + field: x509.public_key_algorithm + value: "{{certificate.subject_public_key_info.algorithm}}" + if: ctx?.certificate?.subject_public_key_info?.algorithm != null + + - set: + field: x509.public_key_size + value: "{{certificate.subject_public_key_info.bit_size}}" + if: ctx?.certificate?.subject_public_key_info?.bit_size != null + + - set: + field: x509.public_key_curve + value: "{{certificate.subject_public_key_info.curve}}" + if: ctx?.certificate?.subject_public_key_info?.curve != null + + - date: + field: certificate.not_before + target_field: certificate.not_before + formats: + - ISO8601 + - yyyy-MM-dd'T'HH:mm:ssXXX + - yyyy-MM-dd'T'HH:mm:ss.SSSXXX + - yyyy-MM-dd HH:mm:ss + - MMM dd HH:mm:ss yyyy 'GMT' + if: ctx?.certificate?.not_before != null + on_failure: + - append: + field: error.pipeline + value: "Failed to parse certificate.not_before: {{_ingest.on_failure_message}}" + + - date: + field: certificate.not_after + target_field: certificate.not_after + formats: + - ISO8601 + - yyyy-MM-dd'T'HH:mm:ssXXX + - yyyy-MM-dd'T'HH:mm:ss.SSSXXX + - yyyy-MM-dd HH:mm:ss + - MMM dd HH:mm:ss yyyy 'GMT' + if: ctx?.certificate?.not_after != null + on_failure: + - append: + field: error.pipeline + value: "Failed to parse certificate.not_after: {{_ingest.on_failure_message}}" + + - date: + field: cipher.last_seen + target_field: cipher.last_seen + formats: + - ISO8601 + - yyyy-MM-dd'T'HH:mm:ssXXX + - yyyy-MM-dd'T'HH:mm:ss.SSSXXX + if: ctx?.cipher?.last_seen != null + on_failure: + - append: + field: error.pipeline + value: "Failed to parse cipher.last_seen: {{_ingest.on_failure_message}}" + + - set: + field: host.hostname + value: "{{tychon.routing.original.host_hostname}}" + ignore_empty_value: true + if: ctx?.tychon?.routing?.original?.host_hostname != null && ctx.tychon.routing.original.host_hostname != '' + + - set: + field: host.domain + value: "{{observer.domain}}" + ignore_empty_value: true + if: ctx?.host?.domain == null && ctx?.observer?.domain != null && ctx.observer.domain != '' + + - set: + field: host.id + value: "{{tychon.routing.original.host_id}}" + ignore_empty_value: true + if: ctx?.tychon?.routing?.original?.host_id != null && ctx.tychon.routing.original.host_id != '' + + - set: + field: host.ip + copy_from: tychon.routing.original.host_ip + ignore_empty_value: true + if: ctx?.tychon?.routing?.original?.host_ip != null + + - set: + field: host.ipv4 + value: "{{tychon.routing.original.host_ipv4}}" + ignore_empty_value: true + if: ctx?.tychon?.routing?.original?.host_ipv4 != null && ctx.tychon.routing.original.host_ipv4 != '' + + - set: + field: host.ipv6 + value: "{{tychon.routing.original.host_ipv6}}" + ignore_empty_value: true + if: ctx?.tychon?.routing?.original?.host_ipv6 != null && ctx.tychon.routing.original.host_ipv6 != '' + + - set: + field: host.architecture + value: "{{tychon.routing.original.host_architecture}}" + ignore_empty_value: true + if: ctx?.tychon?.routing?.original?.host_architecture != null && ctx.tychon.routing.original.host_architecture != '' + + - set: + field: host.os.name + value: "{{tychon.routing.original.host_os_name}}" + ignore_empty_value: true + if: ctx?.tychon?.routing?.original?.host_os_name != null && ctx.tychon.routing.original.host_os_name != '' + + - set: + field: host.os.platform + value: "{{tychon.routing.original.host_os_platform}}" + ignore_empty_value: true + if: ctx?.tychon?.routing?.original?.host_os_platform != null && ctx.tychon.routing.original.host_os_platform != '' + + - set: + field: host.os.family + value: "{{tychon.routing.original.host_os_family}}" + ignore_empty_value: true + if: ctx?.tychon?.routing?.original?.host_os_family != null && ctx.tychon.routing.original.host_os_family != '' + + - set: + field: host.os.version + value: "{{tychon.routing.original.host_os_version}}" + ignore_empty_value: true + if: ctx?.tychon?.routing?.original?.host_os_version != null && ctx.tychon.routing.original.host_os_version != '' + + - set: + field: source.user.id + value: "{{tychon.routing.source.observer_id}}" + ignore_empty_value: true + if: ctx?.tychon?.routing?.source?.observer_id != null && ctx.tychon.routing.source.observer_id != '' + + - set: + field: source.domain + value: "{{tychon.routing.source.hostname}}" + ignore_empty_value: true + if: ctx?.tychon?.routing?.source?.hostname != null && ctx.tychon.routing.source.hostname != '' + + - set: + field: destination.address + value: "{{tychon.routing.target.address}}" + ignore_empty_value: true + if: ctx?.tychon?.routing?.target?.address != null && ctx.tychon.routing.target.address != '' + + - set: + field: destination.ip + copy_from: tychon.routing.target.ip + ignore_empty_value: true + if: ctx?.tychon?.routing?.target?.ip != null + + - set: + field: network.protocol + value: "{{port.protocol_detected}}" + ignore_empty_value: true + if: ctx?.network?.protocol == null && ctx?.port?.protocol_detected != null && ctx.port.protocol_detected != '' + + - set: + field: network.protocol + value: "{{tychon.application.protocol_detected}}" + ignore_empty_value: true + if: ctx?.network?.protocol == null && ctx?.tychon?.application?.protocol_detected != null && ctx.tychon.application.protocol_detected != '' + + - convert: + field: tychon.application.port + type: long + ignore_missing: true + ignore_failure: true + + - convert: + field: tychon.application.port_quantum_grade.score + type: float + ignore_missing: true + ignore_failure: true + + - remove: + field: message + ignore_missing: true + if: (ctx.tychon != null || ctx.containsKey('tychon.index')) && (ctx.event == null || ctx.event.original == null) + + - remove: + field: message + ignore_missing: true + if: ctx.event != null && ctx.event.original != null + +on_failure: + - set: + field: tychon.pipeline.failed + value: true + - set: + field: error.message + value: "{{{ _ingest.on_failure_message }}}" + - set: + field: error.processor_type + value: "{{{ _ingest.on_failure_processor_type }}}" + - set: + field: error.processor_tag + value: "{{{ _ingest.on_failure_processor_tag }}}" + - set: + field: error.pipeline + value: "{{{ _ingest.on_failure_pipeline }}}" diff --git a/packages/tychon_quantum_command/data_stream/tychon_pqc/fields/base-fields.yml b/packages/tychon_quantum_command/data_stream/tychon_pqc/fields/base-fields.yml new file mode 100644 index 00000000000..5f3be129606 --- /dev/null +++ b/packages/tychon_quantum_command/data_stream/tychon_pqc/fields/base-fields.yml @@ -0,0 +1,44 @@ +- name: "@timestamp" + type: date + +- name: id + type: keyword + +- name: quantum_ready + type: boolean + +- name: quantum_ready_cert + type: boolean + +- name: quantum_ready_cipher + type: boolean + +- name: quantum_ready_kx + type: boolean + +- name: scan_type + type: keyword + +- name: scan + type: group + fields: + - name: target_input + type: keyword + - name: timestamp + type: date + - name: type + type: keyword + +- name: package + type: group + fields: + - name: description + type: keyword + - name: install_directory + type: keyword + - name: name + type: keyword + - name: path + type: keyword + - name: version + type: keyword diff --git a/packages/tychon_quantum_command/data_stream/tychon_pqc/fields/ecs.yml b/packages/tychon_quantum_command/data_stream/tychon_pqc/fields/ecs.yml new file mode 100644 index 00000000000..7cffead21a1 --- /dev/null +++ b/packages/tychon_quantum_command/data_stream/tychon_pqc/fields/ecs.yml @@ -0,0 +1,329 @@ +- name: data_stream + type: group + fields: + - name: type + type: constant_keyword + - name: dataset + type: constant_keyword + - name: namespace + type: constant_keyword + +- name: ecs + type: group + fields: + - name: version + type: keyword + +- name: destination + type: group + fields: + - name: address + type: keyword + - name: domain + type: keyword + - name: ip + type: ip + - name: port + type: long + +- name: error + type: group + fields: + - name: message + type: match_only_text + - name: pipeline + type: keyword + - name: processor_tag + type: keyword + - name: processor_type + type: keyword + +- name: event + type: group + fields: + - name: action + type: keyword + - name: category + type: keyword + - name: dataset + type: keyword + - name: ingested + type: date + - name: kind + type: keyword + - name: original + type: match_only_text + - name: type + type: keyword + +- name: file + type: group + fields: + - name: extension + type: keyword + - name: mtime + type: date + - name: name + type: keyword + - name: path + type: keyword + - name: permissions + type: keyword + - name: size + type: long + - name: group + type: group + fields: + - name: name + type: keyword + - name: owner + type: group + fields: + - name: name + type: keyword + +- name: hash + type: group + fields: + - name: sha1_certificate + type: keyword + - name: sha256_certificate + type: keyword + +- name: host + type: group + fields: + - name: architecture + type: keyword + - name: domain + type: keyword + - name: hostname + type: keyword + - name: id + type: keyword + - name: ip + type: ip + - name: ipv4 + type: ip + - name: ipv6 + type: ip + - name: os_category + type: keyword + - name: os_pqc_tier + type: keyword + - name: cpu + type: group + fields: + - name: cores + type: long + - name: memory + type: group + fields: + - name: total + type: long + - name: os + type: group + fields: + - name: family + type: keyword + - name: kernel + type: keyword + - name: name + type: keyword + - name: platform + type: keyword + - name: version + type: keyword + +- name: network + type: group + fields: + - name: protocol + type: keyword + +- name: observer + type: group + fields: + - name: bigfix_client_installed + type: boolean + - name: bios_serial_number + type: keyword + - name: cpu_cores + type: long + - name: cpu_logical_cores + type: long + - name: cpu_model_name + type: keyword + - name: cpu_vendor_id + type: keyword + - name: current_user + type: keyword + - name: database_schema_version + type: keyword + - name: domain + type: keyword + - name: error + type: keyword + - name: fips_mode_enabled + type: boolean + - name: hostname + type: keyword + - name: id + type: keyword + - name: ip_addresses + type: keyword + - name: is_vdi_environment + type: boolean + - name: kernel_arch + type: keyword + - name: kernel_version + type: keyword + - name: machine_serial_number + type: keyword + - name: organization + type: keyword + - name: output_schema_version + type: keyword + - name: platform_version + type: keyword + - name: ram_used_percent + type: float + - name: software_version + type: keyword + - name: system_uptime_seconds + type: long + - name: total_ram_bytes + type: long + - name: tychon_client_id + type: keyword + - name: type + type: keyword + - name: user_gid + type: keyword + - name: user_home_dir + type: keyword + - name: user_uid + type: keyword + - name: vdi_identity_source + type: keyword + - name: vendor + type: keyword + - name: version + type: keyword + - name: windows_server_role + type: keyword + - name: os + type: group + fields: + - name: build + type: keyword + - name: family + type: keyword + - name: kernel + type: keyword + - name: name + type: keyword + - name: platform + type: keyword + - name: version + type: keyword + +- name: process + type: group + fields: + - name: command_line + type: wildcard + - name: executable + type: keyword + - name: executable_directory + type: keyword + - name: name + type: keyword + - name: path + type: keyword + - name: pid + type: long + - name: start + type: date + - name: user_name + type: keyword + - name: username + type: keyword + - name: executable_file + type: group + fields: + - name: attributes + type: keyword + - name: company_name + type: keyword + - name: extension + type: keyword + - name: file_version + type: keyword + - name: group + type: keyword + - name: md5_hash + type: keyword + - name: name + type: keyword + - name: owner + type: keyword + - name: path + type: keyword + - name: product_name + type: keyword + - name: product_version + type: keyword + - name: sha1_hash + type: keyword + - name: sha256_hash + type: keyword + - name: size + type: long + - name: hash + type: group + fields: + - name: sha256 + type: keyword + - name: service_info + type: group + fields: + - name: description + type: keyword + - name: display_name + type: keyword + - name: name + type: keyword + - name: state + type: keyword + +- name: server + type: group + fields: + - name: address + type: keyword + - name: ip + type: ip + - name: port + type: long + - name: protocol + type: keyword + +- name: service + type: group + fields: + - name: name + type: keyword + - name: state + type: keyword + +- name: source + type: group + fields: + - name: domain + type: keyword + - name: user + type: group + fields: + - name: id + type: keyword diff --git a/packages/tychon_quantum_command/data_stream/tychon_pqc/fields/fields.yml b/packages/tychon_quantum_command/data_stream/tychon_pqc/fields/fields.yml new file mode 100644 index 00000000000..59dc5560200 --- /dev/null +++ b/packages/tychon_quantum_command/data_stream/tychon_pqc/fields/fields.yml @@ -0,0 +1,1450 @@ +- name: tychon + title: Tychon + type: group + fields: + - name: index + type: keyword + - name: asset_type + type: keyword + - name: scan_mode + type: keyword + - name: type + type: keyword + - name: pqc_readiness + type: keyword + - name: quantum_risk + type: keyword + - name: migration_priority + type: keyword + - name: scanner_version + type: keyword + - name: pipeline + type: group + fields: + - name: failed + type: boolean + - name: processed + type: boolean + - name: routing + type: group + fields: + - name: original + type: group + fields: + - name: host_architecture + type: keyword + - name: host_hostname + type: keyword + - name: host_id + type: keyword + - name: host_ip + type: ip + - name: host_ipv4 + type: ip + - name: host_ipv6 + type: ip + - name: host_os_family + type: keyword + - name: host_os_name + type: keyword + - name: host_os_platform + type: keyword + - name: host_os_version + type: keyword + - name: source + type: group + fields: + - name: hostname + type: keyword + - name: observer_id + type: keyword + - name: target + type: group + fields: + - name: address + type: keyword + - name: ip + type: ip + - name: application + type: group + fields: + - name: app_root + type: keyword + - name: company_name + type: keyword + - name: connected_to_count + type: long + - name: crypto_library_count + type: long + - name: file_version + type: keyword + - name: in_memory_cert_count + type: long + - name: insecure_ciphers + type: keyword + - name: keychain_identity_count + type: long + - name: keystore_count + type: long + - name: name + type: keyword + - name: path + type: keyword + - name: pid + type: long + - name: port + type: long + - name: port_count + type: long + - name: preferred_cipher + type: keyword + - name: preferred_key_exchange + type: keyword + - name: preferred_protocol + type: keyword + - name: private_key_count + type: long + - name: product_name + type: keyword + - name: product_version + type: keyword + - name: protocol_detected + type: keyword + - name: quantum_ready + type: boolean + - name: service_display_name + type: keyword + - name: service_name + type: keyword + - name: software_package_names + type: keyword + - name: software_package_versions + type: keyword + - name: source + type: keyword + - name: supported_cipher_suites + type: keyword + - name: supported_key_exchanges + type: keyword + - name: supported_protocols + type: keyword + - name: weak_ciphers + type: keyword + - name: port_quantum_grade + type: group + fields: + - name: grade + type: keyword + - name: score + type: float + - name: quantum_grade + type: group + fields: + - name: best_port_score + type: float + - name: grade + type: keyword + - name: os_deductions + type: float + - name: score + type: float + - name: worst_port_score + type: float + - name: browser_extension + type: group + fields: + - name: browser + type: keyword + - name: extension_id + type: keyword + - name: permissions + type: keyword + - name: profile_path + type: keyword + - name: quantum_ready + type: boolean + - name: cipher_negotiation + type: group + fields: + - name: active + type: boolean + - name: alpn_protocol + type: keyword + - name: cipher_suite + type: keyword + - name: compression_method + type: keyword + - name: is_preferred + type: boolean + - name: key_length_bits + type: long + - name: last_seen + type: date + - name: protocol + type: keyword + - name: session_id + type: keyword + - name: session_ticket_lifetime_hint_seconds + type: long + - name: source + type: keyword + - name: source_id + type: keyword + - name: universal_id + type: keyword + - name: intel + type: group + fields: + - name: vulnerabilities + type: keyword + - name: certificate_leaf_details + type: group + fields: + - name: extended_key_usage + type: keyword + - name: is_csr + type: boolean + - name: is_private_key + type: boolean + - name: is_self_signed + type: boolean + - name: key_usage + type: keyword + - name: pqc_vulnerable + type: boolean + - name: raw_pem_certificate + type: match_only_text + - name: serial_number + type: keyword + - name: sha1_fingerprint + type: keyword + - name: sha256_fingerprint + type: keyword + - name: signature_algorithm + type: keyword + - name: signature_hex + type: wildcard + - name: source_id + type: keyword + - name: subject_key_id + type: keyword + - name: version + type: long + - name: basic_constraints + type: group + fields: + - name: is_ca + type: boolean + - name: max_path_len_zero + type: boolean + - name: issuer + type: group + fields: + - name: common_name + type: keyword + - name: country + type: keyword + - name: locality + type: keyword + - name: organization + type: keyword + - name: organizational_unit + type: keyword + - name: province + type: keyword + - name: raw_string + type: keyword + - name: subject + type: group + fields: + - name: common_name + type: keyword + - name: country + type: keyword + - name: locality + type: keyword + - name: organization + type: keyword + - name: organizational_unit + type: keyword + - name: province + type: keyword + - name: raw_string + type: keyword + - name: subject_public_key_info + type: group + fields: + - name: algorithm + type: keyword + - name: bit_size + type: long + - name: curve + type: keyword + - name: ecdsa_x_hex + type: wildcard + - name: ecdsa_y_hex + type: wildcard + - name: rsa_exponent + type: long + - name: rsa_modulus_hex + type: wildcard + - name: validity + type: group + fields: + - name: duration_days + type: keyword + - name: not_after + type: date + - name: not_before + type: date + - name: cipher + type: group + fields: + - name: config_source + type: keyword + - name: insecure_ciphers + type: keyword + - name: is_encrypted + type: boolean + - name: migration_priority + type: keyword + - name: port + type: long + - name: pqc_readiness + type: keyword + - name: pqc_vulnerable + type: boolean + - name: protocol + type: keyword + - name: quantum_risk + type: keyword + - name: recommended_action + type: keyword + - name: supported_ciphers + type: keyword + - name: cipher_quick + type: group + fields: + - name: duration_ms + type: long + - name: insecure_cipher_count + type: long + - name: insecure_ciphers + type: keyword + - name: preferred_cipher + type: keyword + - name: preferred_key_exchange + type: keyword + - name: preferred_protocol + type: keyword + - name: supported_cipher_count + type: long + - name: supported_cipher_suites + type: keyword + - name: supported_key_exchange_count + type: long + - name: supported_key_exchanges + type: keyword + - name: supported_protocol_count + type: long + - name: supported_protocols + type: keyword + - name: total_probes + type: long + - name: weak_cipher_count + type: long + - name: weak_ciphers + type: keyword + - name: crypto + type: group + fields: + - name: auth + type: keyword + - name: certificate + type: keyword + - name: cipher + type: keyword + - name: grade + type: keyword + - name: grade_score + type: float + - name: key_exchange + type: keyword + - name: mac + type: keyword + - name: pqc_readiness + type: keyword + - name: pqc_vulnerable + type: boolean + - name: protocol + type: keyword + - name: protocol_version + type: keyword + - name: quantum_risk + type: keyword + - name: installed_app + type: group + fields: + - name: crypto_libraries + type: keyword + - name: crypto_library_count + type: long + - name: library + type: group + fields: + - name: crypt32_pqc_status + type: keyword + - name: crypt32_version + type: keyword + - name: crypto_type + type: keyword + - name: gnutls_pqc_status + type: keyword + - name: gnutls_version + type: keyword + - name: name + type: keyword + - name: nss_pqc_status + type: keyword + - name: openssl_pqc_status + type: keyword + - name: openssl_version + type: keyword + - name: pqc_algorithms + type: keyword + - name: pqc_status + type: keyword + - name: schannel_pqc_status + type: keyword + - name: schannel_version + type: keyword + - name: uses_crypt32 + type: boolean + - name: uses_gnutls + type: boolean + - name: uses_nss + type: boolean + - name: uses_openssl + type: boolean + - name: uses_schannel + type: boolean + - name: uses_windows_cng + type: boolean + - name: windows_cng_pqc_status + type: keyword + - name: windows_cng_version + type: keyword + +- name: certificate + type: group + fields: + - name: alias + type: keyword + - name: authority_key_id + type: keyword + - name: chain_complete + type: boolean + - name: crl_distribution_points + type: keyword + - name: cve_list + type: keyword + - name: ext_key_usage + type: keyword + - name: extended_key_usage + type: keyword + - name: has_private_key + type: boolean + - name: is_ca + type: boolean + - name: is_csr + type: boolean + - name: is_private_key + type: boolean + - name: is_self_signed + type: boolean + - name: issuer + type: keyword + - name: issuer_common_name + type: keyword + - name: issuer_country + type: keyword + - name: issuer_locality + type: keyword + - name: issuer_organization + type: keyword + - name: issuer_organizational_unit + type: keyword + - name: issuer_province + type: keyword + - name: issuing_certificate_urls + type: keyword + - name: key_algorithm + type: keyword + - name: key_size + type: long + - name: key_strength_assessment + type: keyword + - name: key_usage + type: keyword + - name: migration_priority + type: keyword + - name: not_after + type: date + - name: not_before + type: date + - name: ocsp_servers + type: keyword + - name: policy_identifiers + type: keyword + - name: pqc_readiness + type: keyword + - name: pqc_reason + type: wildcard + - name: pqc_vulnerable + type: boolean + - name: quantum_risk + type: keyword + - name: raw_pem_certificate + type: match_only_text + - name: recommended_action + type: keyword + - name: risk_level + type: keyword + - name: risk_reason + type: wildcard + - name: serial_number + type: keyword + - name: sha1_fingerprint + type: keyword + - name: sha256_fingerprint + type: keyword + - name: signature_algorithm + type: keyword + - name: signature_hex + type: wildcard + - name: source_file_path + type: keyword + - name: source_id + type: keyword + - name: subject + type: keyword + - name: subject_common_name + type: keyword + - name: subject_country + type: keyword + - name: subject_key_id + type: keyword + - name: subject_locality + type: keyword + - name: subject_organization + type: keyword + - name: subject_organizational_unit + type: keyword + - name: subject_province + type: keyword + - name: thumbprint + type: keyword + - name: universal_id + type: keyword + - name: version + type: long + - name: vulnerable + type: boolean + - name: basic_constraints + type: group + fields: + - name: is_ca + type: boolean + - name: max_path_len + type: long + - name: max_path_len_zero + type: boolean + - name: file_details + type: group + fields: + - name: attributes + type: keyword + - name: extension + type: keyword + - name: group + type: keyword + - name: md5_hash + type: keyword + - name: name + type: keyword + - name: owner + type: keyword + - name: path + type: keyword + - name: sha1_hash + type: keyword + - name: sha256_hash + type: keyword + - name: size + type: long + - name: subject_alternative_names + type: group + fields: + - name: dns_names + type: keyword + - name: email_addresses + type: keyword + - name: ip_addresses + type: keyword + - name: subject_public_key_info + type: group + fields: + - name: algorithm + type: keyword + - name: bit_size + type: long + - name: curve + type: keyword + - name: ecdsa_x_hex + type: wildcard + - name: ecdsa_y_hex + type: wildcard + - name: rsa_exponent + type: long + - name: rsa_modulus_hex + type: wildcard + - name: validity + type: group + fields: + - name: duration_days + type: keyword + +- name: config + type: group + fields: + - name: config_file + type: keyword + - name: property_key + type: keyword + - name: ref_type + type: keyword + - name: resolved_path + type: keyword + +- name: crypto + type: group + fields: + - name: key_algorithm + type: keyword + - name: key_size + type: long + - name: signature_algorithm + type: keyword + +- name: ipsec_tunnel + type: group + fields: + - name: active + type: boolean + - name: config_path + type: keyword + - name: detection_confidence + type: keyword + - name: detection_method + type: keyword + - name: first_detected + type: date + - name: implementation + type: keyword + - name: last_seen + type: date + - name: name + type: keyword + - name: source_id + type: keyword + - name: status + type: keyword + - name: version + type: keyword + +- name: kerberos + type: group + fields: + - name: config_source + type: keyword + - name: has_aes128 + type: boolean + - name: has_aes256 + type: boolean + - name: has_des + type: boolean + - name: has_rc4 + type: boolean + - name: is_explicitly_configured + type: boolean + - name: is_quantum_safe + type: boolean + - name: raw_bitmask + type: long + - name: supported_types + type: keyword + +- name: keystore + type: group + fields: + - name: accessible + type: boolean + - name: cert_count + type: long + - name: error_message + type: keyword + - name: path + type: keyword + - name: permissions + type: keyword + - name: requires_auth + type: boolean + - name: size + type: long + - name: type + type: keyword + - name: encryption + type: group + fields: + - name: iterations + type: long + - name: mac + type: keyword + - name: salt_length + type: long + - name: vulnerable + type: boolean + - name: stats + type: group + fields: + - name: expired_certificates + type: long + - name: pqc_vulnerable_certificates + type: long + - name: vulnerable_certificates + type: long + - name: certificate_types + type: group + fields: + - name: ca + type: long + - name: end_entity + type: long + - name: key_algorithms + type: group + fields: + - name: ECDSA + type: long + - name: RSA + type: long + +- name: omb + type: group + fields: + - name: additional_notes + type: wildcard + - name: block_cipher_key_lengths + type: keyword + - name: block_cipher_modes + type: keyword + - name: block_ciphers + type: keyword + - name: certifications + type: keyword + - name: crqc_vulnerable_algos + type: keyword + - name: dsa_algorithms + type: keyword + - name: dsa_hash_algorithms + type: keyword + - name: dsa_parameters + type: keyword + - name: hash_algorithm_parameters + type: keyword + - name: hash_algorithms + type: keyword + - name: kem_algorithms + type: keyword + - name: kem_parameters + type: keyword + - name: kex_ciphersuites + type: keyword + - name: kex_primary + type: keyword + - name: kex_primary_quantum_safe + type: boolean + - name: kex_protocols + type: keyword + - name: kex_secondary + type: keyword + - name: kex_tier + type: keyword + - name: mac_algorithm_parameters + type: keyword + - name: mac_algorithms + type: keyword + - name: module_name + type: keyword + - name: operating_system + type: keyword + - name: other_crypto_details + type: keyword + - name: other_protocols + type: keyword + - name: other_protocols_params + type: keyword + - name: pqc_algos + type: keyword + - name: protocol_tier + type: keyword + - name: sig_tier + type: keyword + - name: software_package_name + type: keyword + - name: software_package_version + type: keyword + - name: symmetric_algos + type: keyword + - name: vendor + type: keyword + - name: vulnerability_status + type: keyword + +- name: port + type: group + fields: + - name: number + type: long + - name: protocol_detected + type: keyword + - name: status_overall + type: keyword + +- name: pqc + type: group + fields: + - name: is_pqc_ready + type: boolean + - name: key_strength + type: keyword + - name: migration_priority + type: keyword + - name: pqc_migration_status + type: keyword + - name: quantum_resistance + type: keyword + - name: quantum_risk + type: keyword + - name: readiness + type: keyword + - name: reason + type: wildcard + - name: recommended_action + type: keyword + - name: vulnerable + type: boolean + +- name: quantum_readiness + type: group + fields: + - name: assessment_duration_ms + type: long + - name: assessment_id + type: keyword + - name: assessment_type + type: keyword + - name: detailed_report + type: match_only_text + - name: max_possible_score + type: long + - name: overall_score + type: long + - name: readiness_status + type: keyword + - name: ready_timeline + type: keyword + - name: recommendations + type: keyword + - name: status_color + type: keyword + - name: timestamp + type: date + - name: compliance + type: group + fields: + - name: common_criteria + type: boolean + - name: compliance_notes + type: wildcard + - name: fips_ready + type: boolean + - name: nist_ready + type: boolean + - name: cost_analysis + type: group + fields: + - name: app_family + type: keyword + - name: labor_rate_used + type: float + - name: hardware_cost_usd + type: float + - name: instance_count + type: long + - name: labor_cost_usd + type: float + - name: license_cost_usd + type: float + - name: os_category + type: keyword + - name: os_hardware_cost_usd + type: float + - name: os_labor_cost_usd + type: float + - name: os_labor_hours + type: float + - name: os_license_cost_usd + type: float + - name: os_tier + type: keyword + - name: os_total_cost_usd + type: float + - name: os_upgrade_target + type: keyword + - name: tier + type: keyword + - name: total_cost_usd + type: float + - name: total_hardware_cost_usd + type: float + - name: total_labor_cost_usd + type: float + - name: total_labor_hours + type: float + - name: total_license_cost_usd + type: float + - name: crypto_libraries + type: group + fields: + - name: fips_mode + type: boolean + - name: legacy_libraries_present + type: boolean + - name: max_score + type: long + - name: openssl_max_score + type: long + - name: openssl_score + type: long + - name: openssl_version + type: keyword + - name: oqs_provider + type: boolean + - name: pqc_support + type: boolean + - name: system_crypto_max_score + type: long + - name: system_crypto_score + type: long + - name: system_libraries + type: keyword + - name: total_score + type: long + - name: uses_openssl + type: boolean + - name: hardware + type: group + fields: + - name: architecture + type: keyword + - name: available_ram_gb + type: float + - name: base_frequency_ghz + type: float + - name: cores + type: long + - name: cpu_max_score + type: long + - name: cpu_score + type: long + - name: has_aes_ni + type: boolean + - name: has_avx2 + type: boolean + - name: has_hsm + type: boolean + - name: has_neon + type: boolean + - name: has_secure_boot + type: boolean + - name: has_tpm + type: boolean + - name: instruction_sets + type: keyword + - name: logical_cores + type: long + - name: max_score + type: long + - name: memory_max_score + type: long + - name: memory_score + type: long + - name: security_hw_max_score + type: long + - name: security_hw_score + type: long + - name: total_ram_gb + type: float + - name: total_score + type: long + - name: tpm_version + type: keyword + - name: network + type: group + fields: + - name: bandwidth_max_score + type: long + - name: bandwidth_score + type: long + - name: estimated_bandwidth_mbps + type: long + - name: ipv6_support + type: boolean + - name: latency_ms + type: long + - name: max_score + type: long + - name: modern_cipher_support + type: boolean + - name: mtu + type: long + - name: protocol_max_score + type: long + - name: protocol_score + type: long + - name: tls13_capable + type: boolean + - name: total_score + type: long + - name: operating_system + type: group + fields: + - name: build + type: keyword + - name: crypto_api_max_score + type: long + - name: crypto_api_score + type: long + - name: crypto_framework + type: keyword + - name: family + type: keyword + - name: fips_mode_enabled + type: boolean + - name: kernel_version + type: keyword + - name: max_score + type: long + - name: modern_crypto_api + type: boolean + - name: native_pqc_support + type: boolean + - name: os_version_max_score + type: long + - name: os_version_score + type: long + - name: pqc_framework + type: keyword + - name: symcrypt_present + type: boolean + - name: total_score + type: long + - name: version + type: keyword + - name: system_classification + type: group + fields: + - name: criticality_level + type: keyword + - name: detection_reason + type: keyword + - name: role + type: keyword + - name: type + type: keyword + - name: upgrade_pathway + type: group + fields: + - name: action + type: keyword + - name: component + type: keyword + - name: description + type: keyword + - name: estimated_time_weeks + type: long + - name: order + type: long + - name: priority + type: keyword + +- name: security + type: group + fields: + - name: known_vulnerabilities + type: keyword + - name: perfect_forward_secrecy + type: boolean + - name: pqc_support + type: boolean + - name: pqc_vulnerable + type: boolean + - name: risk_level + type: keyword + - name: score + type: long + - name: security_score + type: long + - name: vulnerable + type: boolean + - name: weak_crypto + type: boolean + - name: weak_dh_group + type: boolean + +- name: ssh + type: group + fields: + - name: banner + type: keyword + - name: status + type: keyword + - name: algorithms + type: group + fields: + - name: client_offered_ciphers + type: keyword + - name: client_offered_host_key_algos + type: keyword + - name: client_offered_kex + type: keyword + - name: client_offered_macs + type: keyword + - name: negotiated_cipher_c2s + type: keyword + - name: negotiated_cipher_s2c + type: keyword + - name: negotiated_host_key_algo + type: keyword + - name: negotiated_kex + type: keyword + - name: negotiated_mac_c2s + type: keyword + - name: negotiated_mac_s2c + type: keyword + - name: server_offered_ciphers_c2s + type: keyword + - name: server_offered_ciphers_s2c + type: keyword + - name: server_offered_host_key_algos + type: keyword + - name: server_offered_kex + type: keyword + - name: server_offered_macs_c2s + type: keyword + - name: server_offered_macs_s2c + type: keyword + - name: host_key + type: group + fields: + - name: bits + type: long + - name: fingerprint_sha256 + type: keyword + - name: public_key + type: match_only_text + - name: type + type: keyword + - name: x509_certificate + type: group + fields: + - name: is_csr + type: boolean + - name: is_private_key + type: boolean + - name: is_self_signed + type: boolean + - name: pqc_vulnerable + type: boolean + - name: serial_number + type: keyword + - name: source_file_path + type: keyword + - name: issuer + type: group + fields: + - name: common_name + type: keyword + - name: subject + type: group + fields: + - name: common_name + type: keyword + - name: subject_public_key_info + type: group + fields: + - name: algorithm + type: keyword + - name: bit_size + type: long + - name: server + type: group + fields: + - name: encryption_ciphers + type: keyword + - name: host_key_algorithms + type: keyword + - name: kex_algorithms + type: keyword + - name: mac_algorithms + type: keyword + +- name: target_host + type: group + fields: + - name: address + type: keyword + - name: domain + type: keyword + - name: ip + type: ip + - name: ipv4 + type: ip + +- name: tls + type: group + fields: + - name: duration_ms + type: long + - name: insecure_cipher_count + type: long + - name: insecure_ciphers + type: keyword + - name: preferred_cipher + type: keyword + - name: preferred_key_exchange + type: keyword + - name: preferred_protocol + type: keyword + - name: supported_cipher_count + type: long + - name: supported_ciphers + type: keyword + - name: supported_key_exchange_count + type: long + - name: supported_key_exchanges + type: keyword + - name: supported_protocol_count + type: long + - name: supported_protocols + type: keyword + - name: total_probes + type: long + - name: weak_cipher_count + type: long + - name: weak_ciphers + type: keyword + - name: certificate + type: group + fields: + - name: extended_key_usage + type: keyword + - name: issuer + type: keyword + - name: not_after + type: date + - name: not_before + type: date + - name: serial_number + type: keyword + - name: subject + type: keyword + - name: server + type: group + fields: + - name: cipher_count + type: long + - name: issuer + type: keyword + - name: not_after + type: date + - name: not_before + type: date + - name: serial_number + type: keyword + - name: subject + type: keyword + - name: supported_ciphers + type: keyword + - name: supported_protocols + type: keyword + - name: hash + type: group + fields: + - name: sha1 + type: keyword + +- name: tunnel_details + type: group + fields: + - name: auth_method + type: keyword + - name: dh_group + type: keyword + - name: encryption_algorithm + type: keyword + - name: integrity_algorithm + type: keyword + - name: mode + type: keyword + - name: nat_traversal + type: boolean + - name: perfect_forward_secrecy + type: boolean + - name: protocol + type: keyword + +- name: vpn_client + type: group + fields: + - name: active + type: boolean + - name: config_path + type: keyword + - name: detection_confidence + type: keyword + - name: detection_method + type: keyword + - name: executable_path + type: keyword + - name: first_detected + type: date + - name: install_path + type: keyword + - name: last_seen + type: date + - name: name + type: keyword + - name: service_name + type: keyword + - name: status + type: keyword + - name: vendor + type: keyword + - name: version + type: keyword + +- name: vpn_config + type: group + fields: + - name: auto_reconnect + type: boolean + - name: config_encrypted + type: boolean + - name: dns_leak_protection + type: boolean + - name: ipv6_leak_protection + type: boolean + - name: kill_switch + type: boolean + - name: logging_enabled + type: boolean + - name: split_tunneling + type: boolean + +- name: vulnerability + type: group + fields: + - name: assessed_at + type: date + - name: cve_list + type: keyword + - name: is_vulnerable + type: boolean + - name: risk_level + type: keyword + - name: risk_reason + type: wildcard + +- name: x509 + type: group + fields: + - name: fingerprint_sha256 + type: keyword + - name: is_ca + type: boolean + - name: is_self_signed + type: boolean + - name: is_valid + type: boolean + - name: is_weak_signature + type: boolean + - name: issuer_cn + type: keyword + - name: issuer_org + type: keyword + - name: key_bits + type: long + - name: key_type + type: keyword + - name: key_usage + type: keyword + - name: not_after + type: date + - name: not_before + type: date + - name: public_key_algorithm + type: keyword + - name: public_key_curve + type: keyword + - name: public_key_size + type: long + - name: serial_number + type: keyword + - name: sha256_fingerprint + type: keyword + - name: sig_algorithm + type: keyword + - name: signature_algorithm + type: keyword + - name: subject_cn + type: keyword + - name: subject_org + type: keyword + - name: version_number + type: long + - name: issuer + type: group + fields: + - name: common_name + type: keyword + - name: distinguished_name + type: keyword + - name: organization + type: keyword + - name: subject + type: group + fields: + - name: common_name + type: keyword + - name: distinguished_name + type: keyword + - name: organization + type: keyword + - name: validity + type: group + fields: + - name: not_after + type: date + - name: not_before + type: date diff --git a/packages/tychon_quantum_command/data_stream/tychon_pqc/manifest.yml b/packages/tychon_quantum_command/data_stream/tychon_pqc/manifest.yml new file mode 100644 index 00000000000..b49363e19bb --- /dev/null +++ b/packages/tychon_quantum_command/data_stream/tychon_pqc/manifest.yml @@ -0,0 +1,46 @@ +title: Tychon Quantum Command +type: logs +streams: + - input: filestream + title: Tychon Quantum Command logs + description: Collect TQC NDJSON output files. + template_path: stream.yml.hbs + vars: + - name: paths + type: text + title: Additional paths + multi: true + required: false + show_user: true + default: [] + - name: windows_paths + type: text + title: Windows paths + multi: true + required: false + show_user: true + default: + - C:\Program Files\Tychon\*.ndjson + - C:\ProgramData\Tychon\*.ndjson + - name: linux_paths + type: text + title: Linux paths + multi: true + required: false + show_user: true + default: + - /var/log/tychon/*.ndjson + - /opt/tychon/*.ndjson + - name: preserve_original_event + type: bool + title: Preserve original event + required: true + show_user: true + default: false + - name: tags + type: text + title: Tags + multi: true + required: false + show_user: true + default: [] diff --git a/packages/tychon_quantum_command/data_stream/tychon_pqc/sample_event.json b/packages/tychon_quantum_command/data_stream/tychon_pqc/sample_event.json new file mode 100644 index 00000000000..477c749dbeb --- /dev/null +++ b/packages/tychon_quantum_command/data_stream/tychon_pqc/sample_event.json @@ -0,0 +1,37 @@ +{ + "@timestamp": "2026-06-11T12:00:00Z", + "event": { + "kind": "event", + "category": ["configuration"], + "dataset": "tychon_quantum_command.tychon_pqc" + }, + "data_stream": { + "type": "logs", + "dataset": "tychon_quantum_command.tychon_pqc", + "namespace": "default" + }, + "ecs": { + "version": "8.17.0" + }, + "host": { + "hostname": "server01" + }, + "tychon": { + "index": "applications", + "asset_type": "application", + "scan_mode": "quantum_command", + "pqc_readiness": "partial", + "quantum_risk": "medium", + "application": { + "name": "Example Service", + "port": 443, + "preferred_protocol": "TLSv1.3", + "preferred_cipher": "TLS_AES_256_GCM_SHA384", + "preferred_key_exchange": "ECDHE", + "port_quantum_grade": { + "grade": "B", + "score": 82.5 + } + } + } +} diff --git a/packages/tychon_quantum_command/docs/README.md b/packages/tychon_quantum_command/docs/README.md new file mode 100644 index 00000000000..3f0bc897bac --- /dev/null +++ b/packages/tychon_quantum_command/docs/README.md @@ -0,0 +1,992 @@ + + + + +# TYCHON Quantum Command Integration for Elastic + +## Overview + +[TYCHON Quantum Command](https://tychon.io/products/tychon/pqc-management-module/) helps organizations inventory cryptographic implementations, assess post-quantum exposure, and prioritize remediation across endpoints, applications, certificates, network services, key stores, and platform readiness. This integration ingests TYCHON Quantum Command output files into Elastic, normalizes the source stream, and publishes entity-focused transform destinations for dashboards, search, and reporting. + +### Compatibility + +* Intended for environments where TYCHON Quantum Command produces NDJSON or JSON output files on Windows, Linux, or macOS systems. +* Requires a valid TYCHON Quantum Command license. +* Requires Elastic Stack / Fleet compatible with package version `2.0.4` and the package manifest constraint `^8.11.0`. + +### How it works + +1. TYCHON Quantum Command writes scan results to local `.ndjson` or `.json` files. +2. Elastic Agent collects those files through the `filestream` input in the `tychon_pqc` data stream. +3. The ingest pipeline stores the raw events in the namespace-specific source data stream `logs-tychon_quantum_command.tychon_pqc-`. +4. Elasticsearch transforms filter the combined source stream by `tychon.index` and publish dataset-specific destination indices such as `tychon-pqc-inventory`, `tychon-pqc-certificates`, and `tychon-pqc-system-readiness`. +5. Kibana dashboards and saved objects query both the raw and transformed views for operational analysis. + +## What data does this integration collect? + +The integration collects file-based TYCHON Quantum Command output in NDJSON or JSON form. The package is designed around one primary ingest stream and multiple analytical transforms. + +### Primary ingest stream + +* Data stream: `tychon_pqc` +* Data stream type: `logs` +* Expected source formats: NDJSON and JSON records written by TYCHON Quantum Command +* Collection method: Elastic Agent `filestream` +* Namespace-safe source data stream pattern used by transforms: `logs-tychon_quantum_command.tychon_pqc-*` +* Index template used by the source data stream: `logs-tychon_quantum_command.tychon_pqc` +* Backing index naming pattern for the source data stream: `.ds-logs-tychon_quantum_command.tychon_pqc--YYYY.MM.DD-000001` + +### Analytical datasets produced by transforms + +The package currently publishes the following destination indices from the shared source stream: + +* `tychon-pqc-applications` +* `tychon-pqc-archives` +* `tychon-pqc-assets` +* `tychon-pqc-certificates` +* `tychon-pqc-ciphers` +* `tychon-pqc-crypto-libraries` +* `tychon-pqc-installed-apps` +* `tychon-pqc-installed-browser-extensions` +* `tychon-pqc-inventory` +* `tychon-pqc-ipsec-tunnels` +* `tychon-pqc-keystores` +* `tychon-pqc-macsec` +* `tychon-pqc-system-readiness` +* `tychon-pqc-vpn-clients` + +### Supported use cases + +* Build a cryptographic inventory across endpoints and applications. +* Identify classical algorithms, deprecated protocols, and post-quantum readiness gaps. +* Review certificate and keystore exposure, including signature and key algorithm posture. +* Track TLS, VPN, IPsec, MACsec, and related network cryptography risk. +* Estimate remediation readiness and cost through the `system-readiness` transform. +* Drive dashboards for inventory, application reporting, certificate operations, and cost analysis. + +## What do I need to use this integration? + +* Elastic Agent enrolled in Fleet. +* Access to the host or file share where TYCHON Quantum Command writes scan output. +* File system permissions that allow Elastic Agent to read the output directory. +* A deployment decision for the Fleet namespace. The package supports any namespace; transforms read from `logs-tychon_quantum_command.tychon_pqc-*`. +* Enough Elasticsearch capacity for the raw source stream plus the transform destination indices. + +## How do I deploy this integration? + +### Agent-based deployment + +Install Elastic Agent on a host that can read the TYCHON Quantum Command output files. For Elastic Agent installation guidance, see the Elastic Agent [installation instructions](https://www.elastic.co/guide/en/fleet/current/elastic-agent-installation.html). + +### Set up steps in TYCHON Quantum Command + +1. Configure TYCHON Quantum Command to export scan results in NDJSON format. JSON-formatted records can also be ingested when they are emitted one record per event. +2. Choose a stable output location that Elastic Agent can read. +3. Ensure scan results are written with file permissions that allow the Elastic Agent service account to read them. +4. If you separate environments by namespace in Fleet, keep the TYCHON output pathing and the Elastic policy aligned with the intended namespace. +5. Preserve enough scan history on disk for Elastic Agent to pick up new files reliably. + +#### Vendor resources + +* [TYCHON Quantum Command product page](https://tychon.io/products/tychon/pqc-management-module/) +* [TYCHON Quantum Command portal](https://acdiscanner.tychon.io/) +* [TYCHON support portal](https://support.tychon.io/) +* [TYCHON contact page](https://tychon.io/products/tychon/pqc-management-module/#ContactUs) + +### Set up steps in Kibana + +1. Open **Integrations** and install **TYCHON Quantum Command**. +2. Add the integration to an Elastic Agent policy. +3. Set the Windows paths, Linux paths, and any additional custom paths that contain TYCHON output files. +4. Choose the target namespace for the integration policy. +5. Save and deploy the policy. +6. Confirm that documents are arriving in `logs-tychon_quantum_command.tychon_pqc-`. +7. Wait for the managed transforms to populate the destination indices. +8. Open the packaged dashboards to validate the transformed views. + +### Validation + +Use the following checks after deployment: + +* Confirm raw ingest by querying `logs-tychon_quantum_command.tychon_pqc-` for recent events. +* Confirm dataset routing by checking the `tychon.index` values present in the source stream. +* Confirm transform output by verifying documents appear in indices such as `tychon-pqc-inventory`, `tychon-pqc-certificates`, and `tychon-pqc-system-readiness`. +* Open the packaged dashboards and verify charts populate without missing data view errors. +* Review a few representative documents to confirm timestamps, observer metadata, and TYCHON-specific fields were parsed as expected. + + +## Troubleshooting + +* No data in the source stream: verify the file path settings, file permissions, and that TYCHON is actually writing new files. +* Data in the source stream but empty dashboards: verify transforms are running and that the relevant `tychon.index` values exist in the raw events. +* Expected namespace has no transformed data: verify documents are landing in the intended namespace and that transforms can read the shared source pattern `logs-tychon_quantum_command.tychon_pqc-*`. +* Parsing issues: inspect `error.message`, malformed JSON records, and any unexpected multiline output in the source files. +* Duplicate or stale transformed records: review the transform `latest.unique_key` behavior and verify the top-level `id` values remain stable across rescans. +* Certificate or readiness documents feel oversized: review large text fields such as PEM content and detailed reports before production retention policies are finalized. + +## Performance and scaling + +This package stores both the raw ingest stream and multiple transformed destination indices. Capacity planning should account for: + +* Raw source event volume from TYCHON scans. +* Transform frequency, sync delay, and destination index growth. +* Retention requirements for both source and transformed data. +* Dashboard workloads that query multiple destination indices. + +For broader scaling guidance, see Elastic's [Ingest Architectures](https://www.elastic.co/docs/manage-data/ingest/ingest-reference-architectures) documentation. + +## Reference + +### Inputs used + +These inputs can be used with this integration: + +
+filestream + +### Setup + +For more details about the Filestream input settings, see the [Filebeat filestream input documentation](https://www.elastic.co/docs/reference/beats/filebeat/filebeat-input-filestream). + +### Collecting logs with filestream + +Configure the input with one or more paths that point to TYCHON Quantum Command output files. + +Default package path variables: + +* Windows paths: + * `C:\Program Files\Tychon\*.ndjson` + * `C:\ProgramData\Tychon\*.ndjson` +* Linux paths: + * `/var/log/tychon/*.ndjson` + * `/opt/tychon/*.ndjson` +* Additional custom paths: + * Any extra directories where TYCHON scan exports are written. + +Optional package settings: + +* `preserve_original_event`: copies the original message to `event.original` before ingest processing. +* `tags`: appends custom tags to collected events. + +
+ +### API usage + +This integration does not call a TYCHON vendor API. It is a file-based integration that ingests TYCHON Quantum Command output written to disk. + +### Vendor documentation links + +* [TYCHON Quantum Command product page](https://tychon.io/products/tychon/pqc-management-module/) +* [TYCHON support portal](https://support.tychon.io/) +* [Elastic Agent installation](https://www.elastic.co/guide/en/fleet/current/elastic-agent-installation.html) +* [Elastic filestream input reference](https://www.elastic.co/docs/reference/beats/filebeat/filebeat-input-filestream) + +### Data streams + +#### `tychon_pqc` + +The `tychon_pqc` data stream receives TYCHON Quantum Command output files collected through the `filestream` input. Source events are stored in the namespace-specific stream `logs-tychon_quantum_command.tychon_pqc-` and then filtered by transforms using the `tychon.index` discriminator. + +This stream can contain multiple TYCHON record families in one place, including inventory, certificates, ciphers, applications, crypto libraries, readiness, keystores, VPN client findings, IPsec tunnel findings, MACsec findings, installed application data, browser extension data, archives, and other supporting scan artifacts. + +**Exported fields** + +**Exported fields** + +| Field | Description | Type | +|---|---|---| +| @timestamp | | date | +| certificate.alias | | keyword | +| certificate.authority_key_id | | keyword | +| certificate.basic_constraints.is_ca | | boolean | +| certificate.basic_constraints.max_path_len | | long | +| certificate.basic_constraints.max_path_len_zero | | boolean | +| certificate.chain_complete | | boolean | +| certificate.crl_distribution_points | | keyword | +| certificate.cve_list | | keyword | +| certificate.ext_key_usage | | keyword | +| certificate.extended_key_usage | | keyword | +| certificate.file_details.attributes | | keyword | +| certificate.file_details.extension | | keyword | +| certificate.file_details.group | | keyword | +| certificate.file_details.md5_hash | | keyword | +| certificate.file_details.name | | keyword | +| certificate.file_details.owner | | keyword | +| certificate.file_details.path | | keyword | +| certificate.file_details.sha1_hash | | keyword | +| certificate.file_details.sha256_hash | | keyword | +| certificate.file_details.size | | long | +| certificate.has_private_key | | boolean | +| certificate.is_ca | | boolean | +| certificate.is_csr | | boolean | +| certificate.is_private_key | | boolean | +| certificate.is_self_signed | | boolean | +| certificate.issuer | | keyword | +| certificate.issuer_common_name | | keyword | +| certificate.issuer_country | | keyword | +| certificate.issuer_locality | | keyword | +| certificate.issuer_organization | | keyword | +| certificate.issuer_organizational_unit | | keyword | +| certificate.issuer_province | | keyword | +| certificate.issuing_certificate_urls | | keyword | +| certificate.key_algorithm | | keyword | +| certificate.key_size | | long | +| certificate.key_strength_assessment | | keyword | +| certificate.key_usage | | keyword | +| certificate.migration_priority | | keyword | +| certificate.not_after | | date | +| certificate.not_before | | date | +| certificate.ocsp_servers | | keyword | +| certificate.policy_identifiers | | keyword | +| certificate.pqc_readiness | | keyword | +| certificate.pqc_reason | | wildcard | +| certificate.pqc_vulnerable | | boolean | +| certificate.quantum_risk | | keyword | +| certificate.raw_pem_certificate | | match_only_text | +| certificate.recommended_action | | keyword | +| certificate.risk_level | | keyword | +| certificate.risk_reason | | wildcard | +| certificate.serial_number | | keyword | +| certificate.sha1_fingerprint | | keyword | +| certificate.sha256_fingerprint | | keyword | +| certificate.signature_algorithm | | keyword | +| certificate.signature_hex | | wildcard | +| certificate.source_file_path | | keyword | +| certificate.source_id | | keyword | +| certificate.subject | | keyword | +| certificate.subject_alternative_names.dns_names | | keyword | +| certificate.subject_alternative_names.email_addresses | | keyword | +| certificate.subject_alternative_names.ip_addresses | | keyword | +| certificate.subject_common_name | | keyword | +| certificate.subject_country | | keyword | +| certificate.subject_key_id | | keyword | +| certificate.subject_locality | | keyword | +| certificate.subject_organization | | keyword | +| certificate.subject_organizational_unit | | keyword | +| certificate.subject_province | | keyword | +| certificate.subject_public_key_info.algorithm | | keyword | +| certificate.subject_public_key_info.bit_size | | long | +| certificate.subject_public_key_info.curve | | keyword | +| certificate.subject_public_key_info.ecdsa_x_hex | | wildcard | +| certificate.subject_public_key_info.ecdsa_y_hex | | wildcard | +| certificate.subject_public_key_info.rsa_exponent | | long | +| certificate.subject_public_key_info.rsa_modulus_hex | | wildcard | +| certificate.thumbprint | | keyword | +| certificate.universal_id | | keyword | +| certificate.validity.duration_days | | keyword | +| certificate.version | | long | +| certificate.vulnerable | | boolean | +| config.config_file | | keyword | +| config.property_key | | keyword | +| config.ref_type | | keyword | +| config.resolved_path | | keyword | +| crypto.key_algorithm | | keyword | +| crypto.key_size | | long | +| crypto.signature_algorithm | | keyword | +| data_stream.dataset | | constant_keyword | +| data_stream.namespace | | constant_keyword | +| data_stream.type | | constant_keyword | +| destination.address | | keyword | +| destination.domain | | keyword | +| destination.ip | | ip | +| destination.port | | long | +| ecs.version | | keyword | +| error.message | | match_only_text | +| error.pipeline | | keyword | +| error.processor_tag | | keyword | +| error.processor_type | | keyword | +| event.action | | keyword | +| event.category | | keyword | +| event.dataset | | keyword | +| event.ingested | | date | +| event.kind | | keyword | +| event.original | | match_only_text | +| event.type | | keyword | +| file.extension | | keyword | +| file.group.name | | keyword | +| file.mtime | | date | +| file.name | | keyword | +| file.owner.name | | keyword | +| file.path | | keyword | +| file.permissions | | keyword | +| file.size | | long | +| hash.sha1_certificate | | keyword | +| hash.sha256_certificate | | keyword | +| host.architecture | | keyword | +| host.cpu.cores | | long | +| host.domain | | keyword | +| host.hostname | | keyword | +| host.id | | keyword | +| host.ip | | ip | +| host.ipv4 | | ip | +| host.ipv6 | | ip | +| host.memory.total | | long | +| host.os.family | | keyword | +| host.os.kernel | | keyword | +| host.os.name | | keyword | +| host.os.platform | | keyword | +| host.os.version | | keyword | +| host.os_category | | keyword | +| host.os_pqc_tier | | keyword | +| id | | keyword | +| ipsec_tunnel.active | | boolean | +| ipsec_tunnel.config_path | | keyword | +| ipsec_tunnel.detection_confidence | | keyword | +| ipsec_tunnel.detection_method | | keyword | +| ipsec_tunnel.first_detected | | date | +| ipsec_tunnel.implementation | | keyword | +| ipsec_tunnel.last_seen | | date | +| ipsec_tunnel.name | | keyword | +| ipsec_tunnel.source_id | | keyword | +| ipsec_tunnel.status | | keyword | +| ipsec_tunnel.version | | keyword | +| kerberos.config_source | | keyword | +| kerberos.has_aes128 | | boolean | +| kerberos.has_aes256 | | boolean | +| kerberos.has_des | | boolean | +| kerberos.has_rc4 | | boolean | +| kerberos.is_explicitly_configured | | boolean | +| kerberos.is_quantum_safe | | boolean | +| kerberos.raw_bitmask | | long | +| kerberos.supported_types | | keyword | +| keystore.accessible | | boolean | +| keystore.cert_count | | long | +| keystore.encryption.iterations | | long | +| keystore.encryption.mac | | keyword | +| keystore.encryption.salt_length | | long | +| keystore.encryption.vulnerable | | boolean | +| keystore.error_message | | keyword | +| keystore.path | | keyword | +| keystore.permissions | | keyword | +| keystore.requires_auth | | boolean | +| keystore.size | | long | +| keystore.stats.certificate_types.ca | | long | +| keystore.stats.certificate_types.end_entity | | long | +| keystore.stats.expired_certificates | | long | +| keystore.stats.key_algorithms.ECDSA | | long | +| keystore.stats.key_algorithms.RSA | | long | +| keystore.stats.pqc_vulnerable_certificates | | long | +| keystore.stats.vulnerable_certificates | | long | +| keystore.type | | keyword | +| network.protocol | | keyword | +| observer.bigfix_client_installed | | boolean | +| observer.bios_serial_number | | keyword | +| observer.cpu_cores | | long | +| observer.cpu_logical_cores | | long | +| observer.cpu_model_name | | keyword | +| observer.cpu_vendor_id | | keyword | +| observer.current_user | | keyword | +| observer.database_schema_version | | keyword | +| observer.domain | | keyword | +| observer.error | | keyword | +| observer.fips_mode_enabled | | boolean | +| observer.hostname | | keyword | +| observer.id | | keyword | +| observer.ip_addresses | | keyword | +| observer.is_vdi_environment | | boolean | +| observer.kernel_arch | | keyword | +| observer.kernel_version | | keyword | +| observer.machine_serial_number | | keyword | +| observer.organization | | keyword | +| observer.os.build | | keyword | +| observer.os.family | | keyword | +| observer.os.kernel | | keyword | +| observer.os.name | | keyword | +| observer.os.platform | | keyword | +| observer.os.version | | keyword | +| observer.output_schema_version | | keyword | +| observer.platform_version | | keyword | +| observer.ram_used_percent | | float | +| observer.software_version | | keyword | +| observer.system_uptime_seconds | | long | +| observer.total_ram_bytes | | long | +| observer.tychon_client_id | | keyword | +| observer.type | | keyword | +| observer.user_gid | | keyword | +| observer.user_home_dir | | keyword | +| observer.user_uid | | keyword | +| observer.vdi_identity_source | | keyword | +| observer.vendor | | keyword | +| observer.version | | keyword | +| observer.windows_server_role | | keyword | +| omb.additional_notes | | wildcard | +| omb.block_cipher_key_lengths | | keyword | +| omb.block_cipher_modes | | keyword | +| omb.block_ciphers | | keyword | +| omb.certifications | | keyword | +| omb.crqc_vulnerable_algos | | keyword | +| omb.dsa_algorithms | | keyword | +| omb.dsa_hash_algorithms | | keyword | +| omb.dsa_parameters | | keyword | +| omb.hash_algorithm_parameters | | keyword | +| omb.hash_algorithms | | keyword | +| omb.kem_algorithms | | keyword | +| omb.kem_parameters | | keyword | +| omb.kex_ciphersuites | | keyword | +| omb.kex_primary | | keyword | +| omb.kex_primary_quantum_safe | | boolean | +| omb.kex_protocols | | keyword | +| omb.kex_secondary | | keyword | +| omb.kex_tier | | keyword | +| omb.mac_algorithm_parameters | | keyword | +| omb.mac_algorithms | | keyword | +| omb.module_name | | keyword | +| omb.operating_system | | keyword | +| omb.other_crypto_details | | keyword | +| omb.other_protocols | | keyword | +| omb.other_protocols_params | | keyword | +| omb.pqc_algos | | keyword | +| omb.protocol_tier | | keyword | +| omb.sig_tier | | keyword | +| omb.software_package_name | | keyword | +| omb.software_package_version | | keyword | +| omb.symmetric_algos | | keyword | +| omb.vendor | | keyword | +| omb.vulnerability_status | | keyword | +| package.description | | keyword | +| package.install_directory | | keyword | +| package.name | | keyword | +| package.path | | keyword | +| package.version | | keyword | +| port.number | | long | +| port.protocol_detected | | keyword | +| port.status_overall | | keyword | +| pqc.is_pqc_ready | | boolean | +| pqc.key_strength | | keyword | +| pqc.migration_priority | | keyword | +| pqc.pqc_migration_status | | keyword | +| pqc.quantum_resistance | | keyword | +| pqc.quantum_risk | | keyword | +| pqc.readiness | | keyword | +| pqc.reason | | wildcard | +| pqc.recommended_action | | keyword | +| pqc.vulnerable | | boolean | +| process.command_line | | wildcard | +| process.executable | | keyword | +| process.executable_directory | | keyword | +| process.executable_file.attributes | | keyword | +| process.executable_file.company_name | | keyword | +| process.executable_file.extension | | keyword | +| process.executable_file.file_version | | keyword | +| process.executable_file.group | | keyword | +| process.executable_file.md5_hash | | keyword | +| process.executable_file.name | | keyword | +| process.executable_file.owner | | keyword | +| process.executable_file.path | | keyword | +| process.executable_file.product_name | | keyword | +| process.executable_file.product_version | | keyword | +| process.executable_file.sha1_hash | | keyword | +| process.executable_file.sha256_hash | | keyword | +| process.executable_file.size | | long | +| process.hash.sha256 | | keyword | +| process.name | | keyword | +| process.path | | keyword | +| process.pid | | long | +| process.service_info.description | | keyword | +| process.service_info.display_name | | keyword | +| process.service_info.name | | keyword | +| process.service_info.state | | keyword | +| process.start | | date | +| process.user_name | | keyword | +| process.username | | keyword | +| quantum_readiness.assessment_duration_ms | | long | +| quantum_readiness.assessment_id | | keyword | +| quantum_readiness.assessment_type | | keyword | +| quantum_readiness.compliance.common_criteria | | boolean | +| quantum_readiness.compliance.compliance_notes | | wildcard | +| quantum_readiness.compliance.fips_ready | | boolean | +| quantum_readiness.compliance.nist_ready | | boolean | +| quantum_readiness.cost_analysis.app_family | | keyword | +| quantum_readiness.cost_analysis.hardware_cost_usd | | float | +| quantum_readiness.cost_analysis.instance_count | | long | +| quantum_readiness.cost_analysis.labor_cost_usd | | float | +| quantum_readiness.cost_analysis.labor_rate_used | | float | +| quantum_readiness.cost_analysis.license_cost_usd | | float | +| quantum_readiness.cost_analysis.os_category | | keyword | +| quantum_readiness.cost_analysis.os_hardware_cost_usd | | float | +| quantum_readiness.cost_analysis.os_labor_cost_usd | | float | +| quantum_readiness.cost_analysis.os_labor_hours | | float | +| quantum_readiness.cost_analysis.os_license_cost_usd | | float | +| quantum_readiness.cost_analysis.os_tier | | keyword | +| quantum_readiness.cost_analysis.os_total_cost_usd | | float | +| quantum_readiness.cost_analysis.os_upgrade_target | | keyword | +| quantum_readiness.cost_analysis.tier | | keyword | +| quantum_readiness.cost_analysis.total_cost_usd | | float | +| quantum_readiness.cost_analysis.total_hardware_cost_usd | | float | +| quantum_readiness.cost_analysis.total_labor_cost_usd | | float | +| quantum_readiness.cost_analysis.total_labor_hours | | float | +| quantum_readiness.cost_analysis.total_license_cost_usd | | float | +| quantum_readiness.crypto_libraries.fips_mode | | boolean | +| quantum_readiness.crypto_libraries.legacy_libraries_present | | boolean | +| quantum_readiness.crypto_libraries.max_score | | long | +| quantum_readiness.crypto_libraries.openssl_max_score | | long | +| quantum_readiness.crypto_libraries.openssl_score | | long | +| quantum_readiness.crypto_libraries.openssl_version | | keyword | +| quantum_readiness.crypto_libraries.oqs_provider | | boolean | +| quantum_readiness.crypto_libraries.pqc_support | | boolean | +| quantum_readiness.crypto_libraries.system_crypto_max_score | | long | +| quantum_readiness.crypto_libraries.system_crypto_score | | long | +| quantum_readiness.crypto_libraries.system_libraries | | keyword | +| quantum_readiness.crypto_libraries.total_score | | long | +| quantum_readiness.crypto_libraries.uses_openssl | | boolean | +| quantum_readiness.detailed_report | | match_only_text | +| quantum_readiness.hardware.architecture | | keyword | +| quantum_readiness.hardware.available_ram_gb | | float | +| quantum_readiness.hardware.base_frequency_ghz | | float | +| quantum_readiness.hardware.cores | | long | +| quantum_readiness.hardware.cpu_max_score | | long | +| quantum_readiness.hardware.cpu_score | | long | +| quantum_readiness.hardware.has_aes_ni | | boolean | +| quantum_readiness.hardware.has_avx2 | | boolean | +| quantum_readiness.hardware.has_hsm | | boolean | +| quantum_readiness.hardware.has_neon | | boolean | +| quantum_readiness.hardware.has_secure_boot | | boolean | +| quantum_readiness.hardware.has_tpm | | boolean | +| quantum_readiness.hardware.instruction_sets | | keyword | +| quantum_readiness.hardware.logical_cores | | long | +| quantum_readiness.hardware.max_score | | long | +| quantum_readiness.hardware.memory_max_score | | long | +| quantum_readiness.hardware.memory_score | | long | +| quantum_readiness.hardware.security_hw_max_score | | long | +| quantum_readiness.hardware.security_hw_score | | long | +| quantum_readiness.hardware.total_ram_gb | | float | +| quantum_readiness.hardware.total_score | | long | +| quantum_readiness.hardware.tpm_version | | keyword | +| quantum_readiness.max_possible_score | | long | +| quantum_readiness.network.bandwidth_max_score | | long | +| quantum_readiness.network.bandwidth_score | | long | +| quantum_readiness.network.estimated_bandwidth_mbps | | long | +| quantum_readiness.network.ipv6_support | | boolean | +| quantum_readiness.network.latency_ms | | long | +| quantum_readiness.network.max_score | | long | +| quantum_readiness.network.modern_cipher_support | | boolean | +| quantum_readiness.network.mtu | | long | +| quantum_readiness.network.protocol_max_score | | long | +| quantum_readiness.network.protocol_score | | long | +| quantum_readiness.network.tls13_capable | | boolean | +| quantum_readiness.network.total_score | | long | +| quantum_readiness.operating_system.build | | keyword | +| quantum_readiness.operating_system.crypto_api_max_score | | long | +| quantum_readiness.operating_system.crypto_api_score | | long | +| quantum_readiness.operating_system.crypto_framework | | keyword | +| quantum_readiness.operating_system.family | | keyword | +| quantum_readiness.operating_system.fips_mode_enabled | | boolean | +| quantum_readiness.operating_system.kernel_version | | keyword | +| quantum_readiness.operating_system.max_score | | long | +| quantum_readiness.operating_system.modern_crypto_api | | boolean | +| quantum_readiness.operating_system.native_pqc_support | | boolean | +| quantum_readiness.operating_system.os_version_max_score | | long | +| quantum_readiness.operating_system.os_version_score | | long | +| quantum_readiness.operating_system.pqc_framework | | keyword | +| quantum_readiness.operating_system.symcrypt_present | | boolean | +| quantum_readiness.operating_system.total_score | | long | +| quantum_readiness.operating_system.version | | keyword | +| quantum_readiness.overall_score | | long | +| quantum_readiness.readiness_status | | keyword | +| quantum_readiness.ready_timeline | | keyword | +| quantum_readiness.recommendations | | keyword | +| quantum_readiness.status_color | | keyword | +| quantum_readiness.system_classification.criticality_level | | keyword | +| quantum_readiness.system_classification.detection_reason | | keyword | +| quantum_readiness.system_classification.role | | keyword | +| quantum_readiness.system_classification.type | | keyword | +| quantum_readiness.timestamp | | date | +| quantum_readiness.upgrade_pathway.action | | keyword | +| quantum_readiness.upgrade_pathway.component | | keyword | +| quantum_readiness.upgrade_pathway.description | | keyword | +| quantum_readiness.upgrade_pathway.estimated_time_weeks | | long | +| quantum_readiness.upgrade_pathway.order | | long | +| quantum_readiness.upgrade_pathway.priority | | keyword | +| quantum_ready | | boolean | +| quantum_ready_cert | | boolean | +| quantum_ready_cipher | | boolean | +| quantum_ready_kx | | boolean | +| scan.target_input | | keyword | +| scan.timestamp | | date | +| scan.type | | keyword | +| scan_type | | keyword | +| security.known_vulnerabilities | | keyword | +| security.perfect_forward_secrecy | | boolean | +| security.pqc_support | | boolean | +| security.pqc_vulnerable | | boolean | +| security.risk_level | | keyword | +| security.score | | long | +| security.security_score | | long | +| security.vulnerable | | boolean | +| security.weak_crypto | | boolean | +| security.weak_dh_group | | boolean | +| server.address | | keyword | +| server.ip | | ip | +| server.port | | long | +| server.protocol | | keyword | +| service.name | | keyword | +| service.state | | keyword | +| source.domain | | keyword | +| source.user.id | | keyword | +| ssh.algorithms.client_offered_ciphers | | keyword | +| ssh.algorithms.client_offered_host_key_algos | | keyword | +| ssh.algorithms.client_offered_kex | | keyword | +| ssh.algorithms.client_offered_macs | | keyword | +| ssh.algorithms.negotiated_cipher_c2s | | keyword | +| ssh.algorithms.negotiated_cipher_s2c | | keyword | +| ssh.algorithms.negotiated_host_key_algo | | keyword | +| ssh.algorithms.negotiated_kex | | keyword | +| ssh.algorithms.negotiated_mac_c2s | | keyword | +| ssh.algorithms.negotiated_mac_s2c | | keyword | +| ssh.algorithms.server_offered_ciphers_c2s | | keyword | +| ssh.algorithms.server_offered_ciphers_s2c | | keyword | +| ssh.algorithms.server_offered_host_key_algos | | keyword | +| ssh.algorithms.server_offered_kex | | keyword | +| ssh.algorithms.server_offered_macs_c2s | | keyword | +| ssh.algorithms.server_offered_macs_s2c | | keyword | +| ssh.banner | | keyword | +| ssh.host_key.bits | | long | +| ssh.host_key.fingerprint_sha256 | | keyword | +| ssh.host_key.public_key | | match_only_text | +| ssh.host_key.type | | keyword | +| ssh.host_key.x509_certificate.is_csr | | boolean | +| ssh.host_key.x509_certificate.is_private_key | | boolean | +| ssh.host_key.x509_certificate.is_self_signed | | boolean | +| ssh.host_key.x509_certificate.issuer.common_name | | keyword | +| ssh.host_key.x509_certificate.pqc_vulnerable | | boolean | +| ssh.host_key.x509_certificate.serial_number | | keyword | +| ssh.host_key.x509_certificate.source_file_path | | keyword | +| ssh.host_key.x509_certificate.subject.common_name | | keyword | +| ssh.host_key.x509_certificate.subject_public_key_info.algorithm | | keyword | +| ssh.host_key.x509_certificate.subject_public_key_info.bit_size | | long | +| ssh.server.encryption_ciphers | | keyword | +| ssh.server.host_key_algorithms | | keyword | +| ssh.server.kex_algorithms | | keyword | +| ssh.server.mac_algorithms | | keyword | +| ssh.status | | keyword | +| target_host.address | | keyword | +| target_host.domain | | keyword | +| target_host.ip | | ip | +| target_host.ipv4 | | ip | +| tls.certificate.extended_key_usage | | keyword | +| tls.certificate.issuer | | keyword | +| tls.certificate.not_after | | date | +| tls.certificate.not_before | | date | +| tls.certificate.serial_number | | keyword | +| tls.certificate.subject | | keyword | +| tls.duration_ms | | long | +| tls.insecure_cipher_count | | long | +| tls.insecure_ciphers | | keyword | +| tls.preferred_cipher | | keyword | +| tls.preferred_key_exchange | | keyword | +| tls.preferred_protocol | | keyword | +| tls.server.cipher_count | | long | +| tls.server.hash.sha1 | | keyword | +| tls.server.issuer | | keyword | +| tls.server.not_after | | date | +| tls.server.not_before | | date | +| tls.server.serial_number | | keyword | +| tls.server.subject | | keyword | +| tls.server.supported_ciphers | | keyword | +| tls.server.supported_protocols | | keyword | +| tls.supported_cipher_count | | long | +| tls.supported_ciphers | | keyword | +| tls.supported_key_exchange_count | | long | +| tls.supported_key_exchanges | | keyword | +| tls.supported_protocol_count | | long | +| tls.supported_protocols | | keyword | +| tls.total_probes | | long | +| tls.weak_cipher_count | | long | +| tls.weak_ciphers | | keyword | +| tunnel_details.auth_method | | keyword | +| tunnel_details.dh_group | | keyword | +| tunnel_details.encryption_algorithm | | keyword | +| tunnel_details.integrity_algorithm | | keyword | +| tunnel_details.mode | | keyword | +| tunnel_details.nat_traversal | | boolean | +| tunnel_details.perfect_forward_secrecy | | boolean | +| tunnel_details.protocol | | keyword | +| tychon.application.app_root | | keyword | +| tychon.application.company_name | | keyword | +| tychon.application.connected_to_count | | long | +| tychon.application.crypto_library_count | | long | +| tychon.application.file_version | | keyword | +| tychon.application.in_memory_cert_count | | long | +| tychon.application.insecure_ciphers | | keyword | +| tychon.application.keychain_identity_count | | long | +| tychon.application.keystore_count | | long | +| tychon.application.name | | keyword | +| tychon.application.path | | keyword | +| tychon.application.pid | | long | +| tychon.application.port | | long | +| tychon.application.port_count | | long | +| tychon.application.port_quantum_grade.grade | | keyword | +| tychon.application.port_quantum_grade.score | | float | +| tychon.application.preferred_cipher | | keyword | +| tychon.application.preferred_key_exchange | | keyword | +| tychon.application.preferred_protocol | | keyword | +| tychon.application.private_key_count | | long | +| tychon.application.product_name | | keyword | +| tychon.application.product_version | | keyword | +| tychon.application.protocol_detected | | keyword | +| tychon.application.quantum_grade.best_port_score | | float | +| tychon.application.quantum_grade.grade | | keyword | +| tychon.application.quantum_grade.os_deductions | | float | +| tychon.application.quantum_grade.score | | float | +| tychon.application.quantum_grade.worst_port_score | | float | +| tychon.application.quantum_ready | | boolean | +| tychon.application.service_display_name | | keyword | +| tychon.application.service_name | | keyword | +| tychon.application.software_package_names | | keyword | +| tychon.application.software_package_versions | | keyword | +| tychon.application.source | | keyword | +| tychon.application.supported_cipher_suites | | keyword | +| tychon.application.supported_key_exchanges | | keyword | +| tychon.application.supported_protocols | | keyword | +| tychon.application.weak_ciphers | | keyword | +| tychon.asset_type | | keyword | +| tychon.browser_extension.browser | | keyword | +| tychon.browser_extension.extension_id | | keyword | +| tychon.browser_extension.permissions | | keyword | +| tychon.browser_extension.profile_path | | keyword | +| tychon.browser_extension.quantum_ready | | boolean | +| tychon.certificate_leaf_details.basic_constraints.is_ca | | boolean | +| tychon.certificate_leaf_details.basic_constraints.max_path_len_zero | | boolean | +| tychon.certificate_leaf_details.extended_key_usage | | keyword | +| tychon.certificate_leaf_details.is_csr | | boolean | +| tychon.certificate_leaf_details.is_private_key | | boolean | +| tychon.certificate_leaf_details.is_self_signed | | boolean | +| tychon.certificate_leaf_details.issuer.common_name | | keyword | +| tychon.certificate_leaf_details.issuer.country | | keyword | +| tychon.certificate_leaf_details.issuer.locality | | keyword | +| tychon.certificate_leaf_details.issuer.organization | | keyword | +| tychon.certificate_leaf_details.issuer.organizational_unit | | keyword | +| tychon.certificate_leaf_details.issuer.province | | keyword | +| tychon.certificate_leaf_details.issuer.raw_string | | keyword | +| tychon.certificate_leaf_details.key_usage | | keyword | +| tychon.certificate_leaf_details.pqc_vulnerable | | boolean | +| tychon.certificate_leaf_details.raw_pem_certificate | | match_only_text | +| tychon.certificate_leaf_details.serial_number | | keyword | +| tychon.certificate_leaf_details.sha1_fingerprint | | keyword | +| tychon.certificate_leaf_details.sha256_fingerprint | | keyword | +| tychon.certificate_leaf_details.signature_algorithm | | keyword | +| tychon.certificate_leaf_details.signature_hex | | wildcard | +| tychon.certificate_leaf_details.source_id | | keyword | +| tychon.certificate_leaf_details.subject.common_name | | keyword | +| tychon.certificate_leaf_details.subject.country | | keyword | +| tychon.certificate_leaf_details.subject.locality | | keyword | +| tychon.certificate_leaf_details.subject.organization | | keyword | +| tychon.certificate_leaf_details.subject.organizational_unit | | keyword | +| tychon.certificate_leaf_details.subject.province | | keyword | +| tychon.certificate_leaf_details.subject.raw_string | | keyword | +| tychon.certificate_leaf_details.subject_key_id | | keyword | +| tychon.certificate_leaf_details.subject_public_key_info.algorithm | | keyword | +| tychon.certificate_leaf_details.subject_public_key_info.bit_size | | long | +| tychon.certificate_leaf_details.subject_public_key_info.curve | | keyword | +| tychon.certificate_leaf_details.subject_public_key_info.ecdsa_x_hex | | wildcard | +| tychon.certificate_leaf_details.subject_public_key_info.ecdsa_y_hex | | wildcard | +| tychon.certificate_leaf_details.subject_public_key_info.rsa_exponent | | long | +| tychon.certificate_leaf_details.subject_public_key_info.rsa_modulus_hex | | wildcard | +| tychon.certificate_leaf_details.validity.duration_days | | keyword | +| tychon.certificate_leaf_details.validity.not_after | | date | +| tychon.certificate_leaf_details.validity.not_before | | date | +| tychon.certificate_leaf_details.version | | long | +| tychon.cipher.config_source | | keyword | +| tychon.cipher.insecure_ciphers | | keyword | +| tychon.cipher.is_encrypted | | boolean | +| tychon.cipher.migration_priority | | keyword | +| tychon.cipher.port | | long | +| tychon.cipher.pqc_readiness | | keyword | +| tychon.cipher.pqc_vulnerable | | boolean | +| tychon.cipher.protocol | | keyword | +| tychon.cipher.quantum_risk | | keyword | +| tychon.cipher.recommended_action | | keyword | +| tychon.cipher.supported_ciphers | | keyword | +| tychon.cipher_negotiation.active | | boolean | +| tychon.cipher_negotiation.alpn_protocol | | keyword | +| tychon.cipher_negotiation.cipher_suite | | keyword | +| tychon.cipher_negotiation.compression_method | | keyword | +| tychon.cipher_negotiation.intel.vulnerabilities | | keyword | +| tychon.cipher_negotiation.is_preferred | | boolean | +| tychon.cipher_negotiation.key_length_bits | | long | +| tychon.cipher_negotiation.last_seen | | date | +| tychon.cipher_negotiation.protocol | | keyword | +| tychon.cipher_negotiation.session_id | | keyword | +| tychon.cipher_negotiation.session_ticket_lifetime_hint_seconds | | long | +| tychon.cipher_negotiation.source | | keyword | +| tychon.cipher_negotiation.source_id | | keyword | +| tychon.cipher_negotiation.universal_id | | keyword | +| tychon.cipher_quick.duration_ms | | long | +| tychon.cipher_quick.insecure_cipher_count | | long | +| tychon.cipher_quick.insecure_ciphers | | keyword | +| tychon.cipher_quick.preferred_cipher | | keyword | +| tychon.cipher_quick.preferred_key_exchange | | keyword | +| tychon.cipher_quick.preferred_protocol | | keyword | +| tychon.cipher_quick.supported_cipher_count | | long | +| tychon.cipher_quick.supported_cipher_suites | | keyword | +| tychon.cipher_quick.supported_key_exchange_count | | long | +| tychon.cipher_quick.supported_key_exchanges | | keyword | +| tychon.cipher_quick.supported_protocol_count | | long | +| tychon.cipher_quick.supported_protocols | | keyword | +| tychon.cipher_quick.total_probes | | long | +| tychon.cipher_quick.weak_cipher_count | | long | +| tychon.cipher_quick.weak_ciphers | | keyword | +| tychon.crypto.auth | | keyword | +| tychon.crypto.certificate | | keyword | +| tychon.crypto.cipher | | keyword | +| tychon.crypto.grade | | keyword | +| tychon.crypto.grade_score | | float | +| tychon.crypto.key_exchange | | keyword | +| tychon.crypto.mac | | keyword | +| tychon.crypto.pqc_readiness | | keyword | +| tychon.crypto.pqc_vulnerable | | boolean | +| tychon.crypto.protocol | | keyword | +| tychon.crypto.protocol_version | | keyword | +| tychon.crypto.quantum_risk | | keyword | +| tychon.index | | keyword | +| tychon.installed_app.crypto_libraries | | keyword | +| tychon.installed_app.crypto_library_count | | long | +| tychon.library.crypt32_pqc_status | | keyword | +| tychon.library.crypt32_version | | keyword | +| tychon.library.crypto_type | | keyword | +| tychon.library.gnutls_pqc_status | | keyword | +| tychon.library.gnutls_version | | keyword | +| tychon.library.name | | keyword | +| tychon.library.nss_pqc_status | | keyword | +| tychon.library.openssl_pqc_status | | keyword | +| tychon.library.openssl_version | | keyword | +| tychon.library.pqc_algorithms | | keyword | +| tychon.library.pqc_status | | keyword | +| tychon.library.schannel_pqc_status | | keyword | +| tychon.library.schannel_version | | keyword | +| tychon.library.uses_crypt32 | | boolean | +| tychon.library.uses_gnutls | | boolean | +| tychon.library.uses_nss | | boolean | +| tychon.library.uses_openssl | | boolean | +| tychon.library.uses_schannel | | boolean | +| tychon.library.uses_windows_cng | | boolean | +| tychon.library.windows_cng_pqc_status | | keyword | +| tychon.library.windows_cng_version | | keyword | +| tychon.migration_priority | | keyword | +| tychon.pipeline.failed | | boolean | +| tychon.pipeline.processed | | boolean | +| tychon.pqc_readiness | | keyword | +| tychon.quantum_risk | | keyword | +| tychon.routing.original.host_architecture | | keyword | +| tychon.routing.original.host_hostname | | keyword | +| tychon.routing.original.host_id | | keyword | +| tychon.routing.original.host_ip | | ip | +| tychon.routing.original.host_ipv4 | | ip | +| tychon.routing.original.host_ipv6 | | ip | +| tychon.routing.original.host_os_family | | keyword | +| tychon.routing.original.host_os_name | | keyword | +| tychon.routing.original.host_os_platform | | keyword | +| tychon.routing.original.host_os_version | | keyword | +| tychon.routing.source.hostname | | keyword | +| tychon.routing.source.observer_id | | keyword | +| tychon.routing.target.address | | keyword | +| tychon.routing.target.ip | | ip | +| tychon.scan_mode | | keyword | +| tychon.scanner_version | | keyword | +| tychon.type | | keyword | +| vpn_client.active | | boolean | +| vpn_client.config_path | | keyword | +| vpn_client.detection_confidence | | keyword | +| vpn_client.detection_method | | keyword | +| vpn_client.executable_path | | keyword | +| vpn_client.first_detected | | date | +| vpn_client.install_path | | keyword | +| vpn_client.last_seen | | date | +| vpn_client.name | | keyword | +| vpn_client.service_name | | keyword | +| vpn_client.status | | keyword | +| vpn_client.vendor | | keyword | +| vpn_client.version | | keyword | +| vpn_config.auto_reconnect | | boolean | +| vpn_config.config_encrypted | | boolean | +| vpn_config.dns_leak_protection | | boolean | +| vpn_config.ipv6_leak_protection | | boolean | +| vpn_config.kill_switch | | boolean | +| vpn_config.logging_enabled | | boolean | +| vpn_config.split_tunneling | | boolean | +| vulnerability.assessed_at | | date | +| vulnerability.cve_list | | keyword | +| vulnerability.is_vulnerable | | boolean | +| vulnerability.risk_level | | keyword | +| vulnerability.risk_reason | | wildcard | +| x509.fingerprint_sha256 | | keyword | +| x509.is_ca | | boolean | +| x509.is_self_signed | | boolean | +| x509.is_valid | | boolean | +| x509.is_weak_signature | | boolean | +| x509.issuer.common_name | | keyword | +| x509.issuer.distinguished_name | | keyword | +| x509.issuer.organization | | keyword | +| x509.issuer_cn | | keyword | +| x509.issuer_org | | keyword | +| x509.key_bits | | long | +| x509.key_type | | keyword | +| x509.key_usage | | keyword | +| x509.not_after | | date | +| x509.not_before | | date | +| x509.public_key_algorithm | | keyword | +| x509.public_key_curve | | keyword | +| x509.public_key_size | | long | +| x509.serial_number | | keyword | +| x509.sha256_fingerprint | | keyword | +| x509.sig_algorithm | | keyword | +| x509.signature_algorithm | | keyword | +| x509.subject.common_name | | keyword | +| x509.subject.distinguished_name | | keyword | +| x509.subject.organization | | keyword | +| x509.subject_cn | | keyword | +| x509.subject_org | | keyword | +| x509.validity.not_after | | date | +| x509.validity.not_before | | date | +| x509.version_number | | long | + + +**Example event** + +An example event for `tychon_pqc` looks as following: + +```json +{ + "@timestamp": "2026-06-11T12:00:00Z", + "event": { + "kind": "event", + "category": [ + "configuration" + ], + "dataset": "tychon_quantum_command.tychon_pqc" + }, + "data_stream": { + "type": "logs", + "dataset": "tychon_quantum_command.tychon_pqc", + "namespace": "default" + }, + "ecs": { + "version": "8.17.0" + }, + "host": { + "hostname": "server01" + }, + "tychon": { + "index": "applications", + "asset_type": "application", + "scan_mode": "quantum_command", + "pqc_readiness": "partial", + "quantum_risk": "medium", + "application": { + "name": "Example Service", + "port": 443, + "preferred_protocol": "TLSv1.3", + "preferred_cipher": "TLS_AES_256_GCM_SHA384", + "preferred_key_exchange": "ECDHE", + "port_quantum_grade": { + "grade": "B", + "score": 82.5 + } + } + } +} +``` + +### Data streams using ILM policies + +This package does not define a custom package-level ILM policy. Apply retention and lifecycle controls according to your deployment standards for both the raw source stream and the transform destination indices. diff --git a/packages/tychon_quantum_command/elasticsearch/transform/applications/fields/base-fields.yml b/packages/tychon_quantum_command/elasticsearch/transform/applications/fields/base-fields.yml new file mode 100644 index 00000000000..91acb663aba --- /dev/null +++ b/packages/tychon_quantum_command/elasticsearch/transform/applications/fields/base-fields.yml @@ -0,0 +1,38 @@ +- name: id + description: Tychon unique document identifier for the application record. + type: keyword +- name: tychon + type: group + fields: + - name: index + type: keyword + - name: type + type: keyword +- name: kerberos + type: group + fields: + - name: config_source + type: keyword + - name: has_aes128 + type: boolean + - name: has_aes256 + type: boolean + - name: has_des + type: boolean + - name: has_rc4 + type: boolean + - name: is_quantum_safe + type: boolean + - name: raw_bitmask + type: long + - name: supported_types + type: keyword +- name: scan + type: group + fields: + - name: target_input + type: keyword + - name: timestamp + type: date + - name: type + type: keyword diff --git a/packages/tychon_quantum_command/elasticsearch/transform/applications/fields/ecs.yml b/packages/tychon_quantum_command/elasticsearch/transform/applications/fields/ecs.yml new file mode 100644 index 00000000000..d0587c5b305 --- /dev/null +++ b/packages/tychon_quantum_command/elasticsearch/transform/applications/fields/ecs.yml @@ -0,0 +1,42 @@ +- name: '@timestamp' + type: date +- name: event.category + type: keyword +- name: event.dataset + type: keyword +- name: event.ingested + type: date +- name: host.hostname + type: keyword +- name: host.id + type: keyword +- name: observer + type: group + fields: + - name: hostname + type: keyword + - name: id + type: keyword + - name: domain + type: keyword + - name: software_version + type: keyword + - name: tychon_client_id + type: keyword + - name: windows_server_role + type: keyword + - name: os + type: group + fields: + - name: build + type: keyword + - name: family + type: keyword + - name: kernel + type: keyword + - name: name + type: keyword + - name: platform + type: keyword + - name: version + type: keyword diff --git a/packages/tychon_quantum_command/elasticsearch/transform/applications/fields/fields.yml b/packages/tychon_quantum_command/elasticsearch/transform/applications/fields/fields.yml new file mode 100644 index 00000000000..186cc0d149b --- /dev/null +++ b/packages/tychon_quantum_command/elasticsearch/transform/applications/fields/fields.yml @@ -0,0 +1,55 @@ +- name: tychon + type: group + fields: + - name: application + type: group + fields: + - name: app_root + type: keyword + - name: connected_to_count + type: long + - name: crypto_library_count + type: long + - name: in_memory_cert_count + type: long + - name: keychain_identity_count + type: long + - name: keystore_count + type: long + - name: name + type: keyword + - name: path + type: keyword + - name: pid + type: long + - name: port_count + type: long + - name: private_key_count + type: long + - name: service_display_name + type: keyword + - name: service_name + type: keyword + - name: source + type: keyword + - name: library + type: group + fields: + - name: crypt32_pqc_status + type: keyword + - name: crypt32_version + type: keyword + - name: openssl_pqc_status + type: keyword + - name: openssl_version + type: keyword + - name: uses_crypt32 + type: boolean + - name: uses_openssl + type: boolean + - name: uses_windows_cng + type: boolean + - name: windows_cng_pqc_status + type: keyword + - name: windows_cng_version + type: keyword diff --git a/packages/tychon_quantum_command/elasticsearch/transform/applications/manifest.yml b/packages/tychon_quantum_command/elasticsearch/transform/applications/manifest.yml new file mode 100644 index 00000000000..24e9e926793 --- /dev/null +++ b/packages/tychon_quantum_command/elasticsearch/transform/applications/manifest.yml @@ -0,0 +1,11 @@ +start: true +destination_index_template: + mappings: + dynamic: true + dynamic_templates: + - strings_as_keyword: + match_mapping_type: string + mapping: + ignore_above: 1024 + type: keyword + date_detection: true diff --git a/packages/tychon_quantum_command/elasticsearch/transform/applications/transform.yml b/packages/tychon_quantum_command/elasticsearch/transform/applications/transform.yml new file mode 100644 index 00000000000..c6d28f2ec91 --- /dev/null +++ b/packages/tychon_quantum_command/elasticsearch/transform/applications/transform.yml @@ -0,0 +1,21 @@ +source: + index: logs-tychon_quantum_command.tychon_pqc-* + query: + term: + "tychon.index": "applications" +dest: + index: tychon-pqc-applications +latest: + unique_key: + - observer.id + - id + sort: "@timestamp" +sync: + time: + field: "@timestamp" + delay: "60s" +frequency: "1m" +_meta: + fleet_transform_version: 1.0.4 + run_as_kibana_system: false + managed: true diff --git a/packages/tychon_quantum_command/elasticsearch/transform/archives/fields/base-fields.yml b/packages/tychon_quantum_command/elasticsearch/transform/archives/fields/base-fields.yml new file mode 100644 index 00000000000..12e14ee4c3d --- /dev/null +++ b/packages/tychon_quantum_command/elasticsearch/transform/archives/fields/base-fields.yml @@ -0,0 +1,10 @@ +- name: id + description: Tychon unique document identifier for the archive record. + type: keyword +- name: tychon + type: group + fields: + - name: index + type: keyword + - name: type + type: keyword diff --git a/packages/tychon_quantum_command/elasticsearch/transform/archives/fields/ecs.yml b/packages/tychon_quantum_command/elasticsearch/transform/archives/fields/ecs.yml new file mode 100644 index 00000000000..5f17d34b1ad --- /dev/null +++ b/packages/tychon_quantum_command/elasticsearch/transform/archives/fields/ecs.yml @@ -0,0 +1,6 @@ +- name: '@timestamp' + type: date +- name: event.dataset + type: keyword +- name: event.ingested + type: date diff --git a/packages/tychon_quantum_command/elasticsearch/transform/archives/fields/fields.yml b/packages/tychon_quantum_command/elasticsearch/transform/archives/fields/fields.yml new file mode 100644 index 00000000000..14a01825090 --- /dev/null +++ b/packages/tychon_quantum_command/elasticsearch/transform/archives/fields/fields.yml @@ -0,0 +1,17 @@ +- name: archive + type: group + fields: + - name: encryption + type: group + fields: + - name: strength + type: keyword + - name: type + type: keyword + - name: format + type: group + fields: + - name: version + type: keyword + - name: type + type: keyword diff --git a/packages/tychon_quantum_command/elasticsearch/transform/archives/manifest.yml b/packages/tychon_quantum_command/elasticsearch/transform/archives/manifest.yml new file mode 100644 index 00000000000..24e9e926793 --- /dev/null +++ b/packages/tychon_quantum_command/elasticsearch/transform/archives/manifest.yml @@ -0,0 +1,11 @@ +start: true +destination_index_template: + mappings: + dynamic: true + dynamic_templates: + - strings_as_keyword: + match_mapping_type: string + mapping: + ignore_above: 1024 + type: keyword + date_detection: true diff --git a/packages/tychon_quantum_command/elasticsearch/transform/archives/transform.yml b/packages/tychon_quantum_command/elasticsearch/transform/archives/transform.yml new file mode 100644 index 00000000000..8349209fc26 --- /dev/null +++ b/packages/tychon_quantum_command/elasticsearch/transform/archives/transform.yml @@ -0,0 +1,21 @@ +source: + index: logs-tychon_quantum_command.tychon_pqc-* + query: + term: + "tychon.index": "archives" +dest: + index: tychon-pqc-archives +latest: + unique_key: + - observer.id + - id + sort: "@timestamp" +sync: + time: + field: "@timestamp" + delay: "60s" +frequency: "1m" +_meta: + fleet_transform_version: 1.0.4 + run_as_kibana_system: false + managed: true diff --git a/packages/tychon_quantum_command/elasticsearch/transform/assets/fields/base-fields.yml b/packages/tychon_quantum_command/elasticsearch/transform/assets/fields/base-fields.yml new file mode 100644 index 00000000000..2dc32701a5b --- /dev/null +++ b/packages/tychon_quantum_command/elasticsearch/transform/assets/fields/base-fields.yml @@ -0,0 +1,38 @@ +- name: id + description: Tychon unique document identifier for the asset record. + type: keyword +- name: tychon + type: group + fields: + - name: index + type: keyword + - name: type + type: keyword +- name: kerberos + type: group + fields: + - name: config_source + type: keyword + - name: has_aes128 + type: boolean + - name: has_aes256 + type: boolean + - name: has_des + type: boolean + - name: has_rc4 + type: boolean + - name: is_quantum_safe + type: boolean + - name: raw_bitmask + type: long + - name: supported_types + type: keyword +- name: scan + type: group + fields: + - name: target_input + type: keyword + - name: timestamp + type: date + - name: type + type: keyword diff --git a/packages/tychon_quantum_command/elasticsearch/transform/assets/fields/ecs.yml b/packages/tychon_quantum_command/elasticsearch/transform/assets/fields/ecs.yml new file mode 100644 index 00000000000..d9c0dd8ee12 --- /dev/null +++ b/packages/tychon_quantum_command/elasticsearch/transform/assets/fields/ecs.yml @@ -0,0 +1,39 @@ +- name: '@timestamp' + type: date +- name: event.action + type: keyword +- name: event.category + type: keyword +- name: event.dataset + type: keyword +- name: event.ingested + type: date +- name: event.kind + type: keyword +- name: file + type: group + fields: + - name: name + type: keyword + - name: path + type: keyword +- name: observer + type: group + fields: + - name: hostname + type: keyword + - name: id + type: keyword + - name: tychon_client_id + type: keyword + - name: windows_server_role + type: keyword +- name: process + type: group + fields: + - name: name + type: keyword + - name: path + type: keyword + - name: pid + type: long diff --git a/packages/tychon_quantum_command/elasticsearch/transform/assets/fields/fields.yml b/packages/tychon_quantum_command/elasticsearch/transform/assets/fields/fields.yml new file mode 100644 index 00000000000..566cff53ef1 --- /dev/null +++ b/packages/tychon_quantum_command/elasticsearch/transform/assets/fields/fields.yml @@ -0,0 +1,11 @@ +- name: config + type: group + fields: + - name: config_file + type: keyword + - name: property_key + type: keyword + - name: ref_type + type: keyword + - name: resolved_path + type: keyword diff --git a/packages/tychon_quantum_command/elasticsearch/transform/assets/manifest.yml b/packages/tychon_quantum_command/elasticsearch/transform/assets/manifest.yml new file mode 100644 index 00000000000..24e9e926793 --- /dev/null +++ b/packages/tychon_quantum_command/elasticsearch/transform/assets/manifest.yml @@ -0,0 +1,11 @@ +start: true +destination_index_template: + mappings: + dynamic: true + dynamic_templates: + - strings_as_keyword: + match_mapping_type: string + mapping: + ignore_above: 1024 + type: keyword + date_detection: true diff --git a/packages/tychon_quantum_command/elasticsearch/transform/assets/transform.yml b/packages/tychon_quantum_command/elasticsearch/transform/assets/transform.yml new file mode 100644 index 00000000000..b5f6ac0db92 --- /dev/null +++ b/packages/tychon_quantum_command/elasticsearch/transform/assets/transform.yml @@ -0,0 +1,21 @@ +source: + index: logs-tychon_quantum_command.tychon_pqc-* + query: + term: + "tychon.index": "assets" +dest: + index: tychon-pqc-assets +latest: + unique_key: + - observer.id + - id + sort: "@timestamp" +sync: + time: + field: "@timestamp" + delay: "60s" +frequency: "1m" +_meta: + fleet_transform_version: 1.0.4 + run_as_kibana_system: false + managed: true diff --git a/packages/tychon_quantum_command/elasticsearch/transform/browser_exts/fields/base-fields.yml b/packages/tychon_quantum_command/elasticsearch/transform/browser_exts/fields/base-fields.yml new file mode 100644 index 00000000000..989a84c2c1e --- /dev/null +++ b/packages/tychon_quantum_command/elasticsearch/transform/browser_exts/fields/base-fields.yml @@ -0,0 +1,40 @@ +- name: id + description: Tychon unique document identifier for the browser extension record. + type: keyword +- name: tychon + type: group + fields: + - name: index + type: keyword + - name: type + type: keyword + - name: scan_mode + type: keyword +- name: kerberos + type: group + fields: + - name: config_source + type: keyword + - name: has_aes128 + type: boolean + - name: has_aes256 + type: boolean + - name: has_des + type: boolean + - name: has_rc4 + type: boolean + - name: is_quantum_safe + type: boolean + - name: raw_bitmask + type: long + - name: supported_types + type: keyword +- name: scan + type: group + fields: + - name: target_input + type: keyword + - name: timestamp + type: date + - name: type + type: keyword diff --git a/packages/tychon_quantum_command/elasticsearch/transform/browser_exts/fields/ecs.yml b/packages/tychon_quantum_command/elasticsearch/transform/browser_exts/fields/ecs.yml new file mode 100644 index 00000000000..dbb9f2a3188 --- /dev/null +++ b/packages/tychon_quantum_command/elasticsearch/transform/browser_exts/fields/ecs.yml @@ -0,0 +1,28 @@ +- name: '@timestamp' + type: date +- name: event.category + type: keyword +- name: event.dataset + type: keyword +- name: event.ingested + type: date +- name: observer + type: group + fields: + - name: hostname + type: keyword + - name: id + type: keyword + - name: tychon_client_id + type: keyword + - name: windows_server_role + type: keyword +- name: package + type: group + fields: + - name: description + type: keyword + - name: name + type: keyword + - name: version + type: keyword diff --git a/packages/tychon_quantum_command/elasticsearch/transform/browser_exts/fields/fields.yml b/packages/tychon_quantum_command/elasticsearch/transform/browser_exts/fields/fields.yml new file mode 100644 index 00000000000..8dc40de6962 --- /dev/null +++ b/packages/tychon_quantum_command/elasticsearch/transform/browser_exts/fields/fields.yml @@ -0,0 +1,16 @@ +- name: tychon + type: group + fields: + - name: browser_extension + type: group + fields: + - name: browser + type: keyword + - name: extension_id + type: keyword + - name: permissions + type: keyword + - name: profile_path + type: keyword + - name: quantum_ready + type: boolean diff --git a/packages/tychon_quantum_command/elasticsearch/transform/browser_exts/manifest.yml b/packages/tychon_quantum_command/elasticsearch/transform/browser_exts/manifest.yml new file mode 100644 index 00000000000..24e9e926793 --- /dev/null +++ b/packages/tychon_quantum_command/elasticsearch/transform/browser_exts/manifest.yml @@ -0,0 +1,11 @@ +start: true +destination_index_template: + mappings: + dynamic: true + dynamic_templates: + - strings_as_keyword: + match_mapping_type: string + mapping: + ignore_above: 1024 + type: keyword + date_detection: true diff --git a/packages/tychon_quantum_command/elasticsearch/transform/browser_exts/transform.yml b/packages/tychon_quantum_command/elasticsearch/transform/browser_exts/transform.yml new file mode 100644 index 00000000000..25c289a4a2f --- /dev/null +++ b/packages/tychon_quantum_command/elasticsearch/transform/browser_exts/transform.yml @@ -0,0 +1,21 @@ +source: + index: logs-tychon_quantum_command.tychon_pqc-* + query: + term: + "tychon.index": "installed-browser-extensions" +dest: + index: tychon-pqc-installed-browser-extensions +latest: + unique_key: + - observer.id + - id + sort: "@timestamp" +sync: + time: + field: "@timestamp" + delay: "60s" +frequency: "1m" +_meta: + fleet_transform_version: 1.0.4 + run_as_kibana_system: false + managed: true diff --git a/packages/tychon_quantum_command/elasticsearch/transform/certificates/fields/base-fields.yml b/packages/tychon_quantum_command/elasticsearch/transform/certificates/fields/base-fields.yml new file mode 100644 index 00000000000..26df41e519a --- /dev/null +++ b/packages/tychon_quantum_command/elasticsearch/transform/certificates/fields/base-fields.yml @@ -0,0 +1,38 @@ +- name: id + description: Tychon unique document identifier for the certificate record. + type: keyword +- name: tychon + type: group + fields: + - name: index + type: keyword + - name: type + type: keyword +- name: kerberos + type: group + fields: + - name: config_source + type: keyword + - name: has_aes128 + type: boolean + - name: has_aes256 + type: boolean + - name: has_des + type: boolean + - name: has_rc4 + type: boolean + - name: is_quantum_safe + type: boolean + - name: raw_bitmask + type: long + - name: supported_types + type: keyword +- name: scan + type: group + fields: + - name: target_input + type: keyword + - name: timestamp + type: date + - name: type + type: keyword diff --git a/packages/tychon_quantum_command/elasticsearch/transform/certificates/fields/ecs.yml b/packages/tychon_quantum_command/elasticsearch/transform/certificates/fields/ecs.yml new file mode 100644 index 00000000000..5669154af3e --- /dev/null +++ b/packages/tychon_quantum_command/elasticsearch/transform/certificates/fields/ecs.yml @@ -0,0 +1,89 @@ +- name: '@timestamp' + type: date +- name: event.action + type: keyword +- name: event.category + type: keyword +- name: event.dataset + type: keyword +- name: event.ingested + type: date +- name: event.kind + type: keyword +- name: file + type: group + fields: + - name: extension + type: keyword + - name: group + type: group + fields: + - name: name + type: keyword + - name: mtime + type: date + - name: name + type: keyword + - name: owner + type: group + fields: + - name: name + type: keyword + - name: path + type: keyword + - name: permissions + type: keyword + - name: size + type: long +- name: hash + type: group + fields: + - name: sha256_certificate + type: keyword +- name: observer + type: group + fields: + - name: hostname + type: keyword + - name: id + type: keyword + - name: tychon_client_id + type: keyword + - name: windows_server_role + type: keyword +- name: x509 + type: group + fields: + - name: is_valid + type: boolean + - name: issuer + type: group + fields: + - name: common_name + type: keyword + - name: distinguished_name + type: keyword + - name: public_key_algorithm + type: keyword + - name: public_key_size + type: long + - name: serial_number + type: keyword + - name: signature_algorithm + type: keyword + - name: subject + type: group + fields: + - name: common_name + type: keyword + - name: distinguished_name + type: keyword + - name: validity + type: group + fields: + - name: not_after + type: date + - name: not_before + type: date + - name: version_number + type: long diff --git a/packages/tychon_quantum_command/elasticsearch/transform/certificates/fields/fields.yml b/packages/tychon_quantum_command/elasticsearch/transform/certificates/fields/fields.yml new file mode 100644 index 00000000000..d4b1b15a821 --- /dev/null +++ b/packages/tychon_quantum_command/elasticsearch/transform/certificates/fields/fields.yml @@ -0,0 +1,110 @@ +- name: certificate + type: group + fields: + - name: is_csr + type: boolean + - name: is_private_key + type: boolean + - name: is_self_signed + type: boolean + - name: issuer + type: keyword + - name: issuer_common_name + type: keyword + - name: key_usage + type: keyword + - name: not_after + type: date + - name: not_before + type: date + - name: pqc_vulnerable + type: boolean + - name: raw_pem_certificate + type: match_only_text + - name: serial_number + type: keyword + - name: sha1_fingerprint + type: keyword + - name: sha256_fingerprint + type: keyword + - name: signature_algorithm + type: keyword + - name: source_file_path + type: keyword + - name: source_id + type: keyword + - name: subject + type: keyword + - name: subject_common_name + type: keyword + - name: universal_id + type: keyword + - name: validity + type: group + fields: + - name: duration_days + type: keyword + - name: version + type: long + - name: basic_constraints + type: group + fields: + - name: is_ca + type: boolean + - name: max_path_len + type: long + - name: max_path_len_zero + type: boolean + - name: file_details + type: group + fields: + - name: attributes + type: keyword + - name: extension + type: keyword + - name: group + type: keyword + - name: md5_hash + type: keyword + - name: name + type: keyword + - name: owner + type: keyword + - name: path + type: keyword + - name: sha1_hash + type: keyword + - name: sha256_hash + type: keyword + - name: size + type: long + - name: subject_public_key_info + type: group + fields: + - name: algorithm + type: keyword + - name: bit_size + type: long + - name: rsa_exponent + type: long + - name: rsa_modulus_hex + type: wildcard +- name: crypto + type: group + fields: + - name: key_algorithm + type: keyword + - name: key_size + type: long + - name: signature_algorithm + type: keyword +- name: omb + type: group + fields: + - name: sig_tier + type: keyword +- name: pqc + type: group + fields: + - name: vulnerable + type: boolean diff --git a/packages/tychon_quantum_command/elasticsearch/transform/certificates/manifest.yml b/packages/tychon_quantum_command/elasticsearch/transform/certificates/manifest.yml new file mode 100644 index 00000000000..24e9e926793 --- /dev/null +++ b/packages/tychon_quantum_command/elasticsearch/transform/certificates/manifest.yml @@ -0,0 +1,11 @@ +start: true +destination_index_template: + mappings: + dynamic: true + dynamic_templates: + - strings_as_keyword: + match_mapping_type: string + mapping: + ignore_above: 1024 + type: keyword + date_detection: true diff --git a/packages/tychon_quantum_command/elasticsearch/transform/certificates/transform.yml b/packages/tychon_quantum_command/elasticsearch/transform/certificates/transform.yml new file mode 100644 index 00000000000..8c4fac88cff --- /dev/null +++ b/packages/tychon_quantum_command/elasticsearch/transform/certificates/transform.yml @@ -0,0 +1,21 @@ +source: + index: logs-tychon_quantum_command.tychon_pqc-* + query: + term: + "tychon.index": "certificates" +dest: + index: tychon-pqc-certificates +latest: + unique_key: + - observer.id + - id + sort: "@timestamp" +sync: + time: + field: "@timestamp" + delay: "60s" +frequency: "1m" +_meta: + fleet_transform_version: 1.0.4 + run_as_kibana_system: false + managed: true diff --git a/packages/tychon_quantum_command/elasticsearch/transform/ciphers/fields/base-fields.yml b/packages/tychon_quantum_command/elasticsearch/transform/ciphers/fields/base-fields.yml new file mode 100644 index 00000000000..d0946e7ec63 --- /dev/null +++ b/packages/tychon_quantum_command/elasticsearch/transform/ciphers/fields/base-fields.yml @@ -0,0 +1,38 @@ +- name: id + description: Tychon unique document identifier for the cipher record. + type: keyword +- name: tychon + type: group + fields: + - name: index + type: keyword + - name: type + type: keyword +- name: kerberos + type: group + fields: + - name: config_source + type: keyword + - name: has_aes128 + type: boolean + - name: has_aes256 + type: boolean + - name: has_des + type: boolean + - name: has_rc4 + type: boolean + - name: is_quantum_safe + type: boolean + - name: raw_bitmask + type: long + - name: supported_types + type: keyword +- name: scan + type: group + fields: + - name: target_input + type: keyword + - name: timestamp + type: date + - name: type + type: keyword diff --git a/packages/tychon_quantum_command/elasticsearch/transform/ciphers/fields/ecs.yml b/packages/tychon_quantum_command/elasticsearch/transform/ciphers/fields/ecs.yml new file mode 100644 index 00000000000..e531319ec17 --- /dev/null +++ b/packages/tychon_quantum_command/elasticsearch/transform/ciphers/fields/ecs.yml @@ -0,0 +1,95 @@ +- name: '@timestamp' + type: date +- name: error.message + type: match_only_text +- name: event.action + type: keyword +- name: event.category + type: keyword +- name: event.dataset + type: keyword +- name: event.ingested + type: date +- name: hash + type: group + fields: + - name: sha1_certificate + type: keyword + - name: sha256_certificate + type: keyword +- name: observer + type: group + fields: + - name: hostname + type: keyword + - name: id + type: keyword + - name: tychon_client_id + type: keyword + - name: windows_server_role + type: keyword +- name: port + type: group + fields: + - name: number + type: long + - name: protocol_detected + type: keyword + - name: status_overall + type: keyword +- name: process + type: group + fields: + - name: command_line + type: wildcard + - name: executable + type: keyword + - name: executable_directory + type: keyword + - name: name + type: keyword + - name: pid + type: long + - name: username + type: keyword +- name: server + type: group + fields: + - name: address + type: keyword + - name: ip + type: ip + - name: port + type: long +- name: service + type: group + fields: + - name: name + type: keyword + - name: state + type: keyword +- name: x509 + type: group + fields: + - name: issuer + type: group + fields: + - name: common_name + type: keyword + - name: distinguished_name + type: keyword + - name: public_key_algorithm + type: keyword + - name: public_key_size + type: long + - name: serial_number + type: keyword + - name: signature_algorithm + type: keyword + - name: subject + type: group + fields: + - name: common_name + type: keyword + - name: distinguished_name + type: keyword diff --git a/packages/tychon_quantum_command/elasticsearch/transform/ciphers/fields/fields.yml b/packages/tychon_quantum_command/elasticsearch/transform/ciphers/fields/fields.yml new file mode 100644 index 00000000000..871df8aa72d --- /dev/null +++ b/packages/tychon_quantum_command/elasticsearch/transform/ciphers/fields/fields.yml @@ -0,0 +1,105 @@ +- name: omb + type: group + fields: + - name: additional_notes + type: wildcard + - name: block_cipher_key_lengths + type: keyword + - name: block_cipher_modes + type: keyword + - name: block_ciphers + type: keyword + - name: certifications + type: keyword + - name: crqc_vulnerable_algos + type: keyword + - name: dsa_algorithms + type: keyword + - name: hash_algorithms + type: keyword + - name: kem_algorithms + type: keyword + - name: kex_ciphersuites + type: keyword + - name: kex_protocols + type: keyword + - name: mac_algorithms + type: keyword + - name: module_name + type: keyword + - name: operating_system + type: keyword + - name: other_crypto_details + type: keyword + - name: other_protocols + type: keyword + - name: pqc_algos + type: keyword + - name: software_package_name + type: keyword + - name: software_package_version + type: keyword + - name: symmetric_algos + type: keyword + - name: vulnerability_status + type: keyword +- name: quantum_ready + type: boolean +- name: quantum_ready_cert + type: boolean +- name: quantum_ready_cipher + type: boolean +- name: quantum_ready_kx + type: boolean +- name: target_host + type: group + fields: + - name: address + type: keyword + - name: domain + type: keyword + - name: ip + type: ip + - name: ipv4 + type: ip +- name: tychon + type: group + fields: + - name: cipher + type: group + fields: + - name: config_source + type: keyword + - name: insecure_ciphers + type: keyword + - name: is_encrypted + type: boolean + - name: migration_priority + type: keyword + - name: port + type: long + - name: pqc_readiness + type: keyword + - name: pqc_vulnerable + type: boolean + - name: protocol + type: keyword + - name: quantum_risk + type: keyword + - name: recommended_action + type: keyword + - name: supported_ciphers + type: keyword + - name: crypto + type: group + fields: + - name: cipher + type: keyword + - name: pqc_readiness + type: keyword + - name: pqc_vulnerable + type: boolean + - name: protocol + type: keyword + - name: quantum_risk + type: keyword diff --git a/packages/tychon_quantum_command/elasticsearch/transform/ciphers/manifest.yml b/packages/tychon_quantum_command/elasticsearch/transform/ciphers/manifest.yml new file mode 100644 index 00000000000..24e9e926793 --- /dev/null +++ b/packages/tychon_quantum_command/elasticsearch/transform/ciphers/manifest.yml @@ -0,0 +1,11 @@ +start: true +destination_index_template: + mappings: + dynamic: true + dynamic_templates: + - strings_as_keyword: + match_mapping_type: string + mapping: + ignore_above: 1024 + type: keyword + date_detection: true diff --git a/packages/tychon_quantum_command/elasticsearch/transform/ciphers/transform.yml b/packages/tychon_quantum_command/elasticsearch/transform/ciphers/transform.yml new file mode 100644 index 00000000000..3c1c7e83246 --- /dev/null +++ b/packages/tychon_quantum_command/elasticsearch/transform/ciphers/transform.yml @@ -0,0 +1,21 @@ +source: + index: logs-tychon_quantum_command.tychon_pqc-* + query: + term: + "tychon.index": "ciphers" +dest: + index: tychon-pqc-ciphers +latest: + unique_key: + - observer.id + - id + sort: "@timestamp" +sync: + time: + field: "@timestamp" + delay: "60s" +frequency: "1m" +_meta: + fleet_transform_version: 1.0.4 + run_as_kibana_system: false + managed: true diff --git a/packages/tychon_quantum_command/elasticsearch/transform/crypto_libs/fields/base-fields.yml b/packages/tychon_quantum_command/elasticsearch/transform/crypto_libs/fields/base-fields.yml new file mode 100644 index 00000000000..28973532a0f --- /dev/null +++ b/packages/tychon_quantum_command/elasticsearch/transform/crypto_libs/fields/base-fields.yml @@ -0,0 +1,38 @@ +- name: id + description: Tychon unique document identifier for the crypto library record. + type: keyword +- name: tychon + type: group + fields: + - name: index + type: keyword + - name: type + type: keyword +- name: kerberos + type: group + fields: + - name: config_source + type: keyword + - name: has_aes128 + type: boolean + - name: has_aes256 + type: boolean + - name: has_des + type: boolean + - name: has_rc4 + type: boolean + - name: is_quantum_safe + type: boolean + - name: raw_bitmask + type: long + - name: supported_types + type: keyword +- name: scan + type: group + fields: + - name: target_input + type: keyword + - name: timestamp + type: date + - name: type + type: keyword diff --git a/packages/tychon_quantum_command/elasticsearch/transform/crypto_libs/fields/ecs.yml b/packages/tychon_quantum_command/elasticsearch/transform/crypto_libs/fields/ecs.yml new file mode 100644 index 00000000000..52fe0461a89 --- /dev/null +++ b/packages/tychon_quantum_command/elasticsearch/transform/crypto_libs/fields/ecs.yml @@ -0,0 +1,34 @@ +- name: '@timestamp' + type: date +- name: event.action + type: keyword +- name: event.category + type: keyword +- name: event.dataset + type: keyword +- name: event.ingested + type: date +- name: event.kind + type: keyword +- name: observer + type: group + fields: + - name: hostname + type: keyword + - name: id + type: keyword + - name: tychon_client_id + type: keyword + - name: windows_server_role + type: keyword +- name: process + type: group + fields: + - name: executable + type: keyword + - name: executable_directory + type: keyword + - name: name + type: keyword + - name: pid + type: long diff --git a/packages/tychon_quantum_command/elasticsearch/transform/crypto_libs/fields/fields.yml b/packages/tychon_quantum_command/elasticsearch/transform/crypto_libs/fields/fields.yml new file mode 100644 index 00000000000..22c97638bc4 --- /dev/null +++ b/packages/tychon_quantum_command/elasticsearch/transform/crypto_libs/fields/fields.yml @@ -0,0 +1,31 @@ +- name: tychon + type: group + fields: + - name: library + type: group + fields: + - name: crypto_type + type: keyword + - name: name + type: keyword + - name: openssl_version + type: keyword + - name: pqc_status + type: keyword + - name: uses_openssl + type: boolean + - name: uses_windows_cng + type: boolean + - name: windows_cng_version + type: keyword +- name: vulnerability + type: group + fields: + - name: assessed_at + type: date + - name: is_vulnerable + type: boolean + - name: risk_level + type: keyword + - name: risk_reason + type: keyword diff --git a/packages/tychon_quantum_command/elasticsearch/transform/crypto_libs/manifest.yml b/packages/tychon_quantum_command/elasticsearch/transform/crypto_libs/manifest.yml new file mode 100644 index 00000000000..24e9e926793 --- /dev/null +++ b/packages/tychon_quantum_command/elasticsearch/transform/crypto_libs/manifest.yml @@ -0,0 +1,11 @@ +start: true +destination_index_template: + mappings: + dynamic: true + dynamic_templates: + - strings_as_keyword: + match_mapping_type: string + mapping: + ignore_above: 1024 + type: keyword + date_detection: true diff --git a/packages/tychon_quantum_command/elasticsearch/transform/crypto_libs/transform.yml b/packages/tychon_quantum_command/elasticsearch/transform/crypto_libs/transform.yml new file mode 100644 index 00000000000..8d8cacd2f40 --- /dev/null +++ b/packages/tychon_quantum_command/elasticsearch/transform/crypto_libs/transform.yml @@ -0,0 +1,21 @@ +source: + index: logs-tychon_quantum_command.tychon_pqc-* + query: + term: + "tychon.index": "crypto-libraries" +dest: + index: tychon-pqc-crypto-libraries +latest: + unique_key: + - observer.id + - id + sort: "@timestamp" +sync: + time: + field: "@timestamp" + delay: "60s" +frequency: "1m" +_meta: + fleet_transform_version: 1.0.4 + run_as_kibana_system: false + managed: true diff --git a/packages/tychon_quantum_command/elasticsearch/transform/inst_apps/fields/base-fields.yml b/packages/tychon_quantum_command/elasticsearch/transform/inst_apps/fields/base-fields.yml new file mode 100644 index 00000000000..c5ceb0e43b0 --- /dev/null +++ b/packages/tychon_quantum_command/elasticsearch/transform/inst_apps/fields/base-fields.yml @@ -0,0 +1,40 @@ +- name: id + description: Tychon unique document identifier for the installed application record. + type: keyword +- name: tychon + type: group + fields: + - name: index + type: keyword + - name: type + type: keyword + - name: scan_mode + type: keyword +- name: kerberos + type: group + fields: + - name: config_source + type: keyword + - name: has_aes128 + type: boolean + - name: has_aes256 + type: boolean + - name: has_des + type: boolean + - name: has_rc4 + type: boolean + - name: is_quantum_safe + type: boolean + - name: raw_bitmask + type: long + - name: supported_types + type: keyword +- name: scan + type: group + fields: + - name: target_input + type: keyword + - name: timestamp + type: date + - name: type + type: keyword diff --git a/packages/tychon_quantum_command/elasticsearch/transform/inst_apps/fields/ecs.yml b/packages/tychon_quantum_command/elasticsearch/transform/inst_apps/fields/ecs.yml new file mode 100644 index 00000000000..2ed65cb8663 --- /dev/null +++ b/packages/tychon_quantum_command/elasticsearch/transform/inst_apps/fields/ecs.yml @@ -0,0 +1,32 @@ +- name: '@timestamp' + type: date +- name: event.category + type: keyword +- name: event.dataset + type: keyword +- name: event.ingested + type: date +- name: observer + type: group + fields: + - name: hostname + type: keyword + - name: id + type: keyword + - name: tychon_client_id + type: keyword + - name: windows_server_role + type: keyword +- name: package + type: group + fields: + - name: description + type: keyword + - name: install_directory + type: keyword + - name: name + type: keyword + - name: path + type: keyword + - name: version + type: keyword diff --git a/packages/tychon_quantum_command/elasticsearch/transform/inst_apps/fields/fields.yml b/packages/tychon_quantum_command/elasticsearch/transform/inst_apps/fields/fields.yml new file mode 100644 index 00000000000..2c9e49de0d0 --- /dev/null +++ b/packages/tychon_quantum_command/elasticsearch/transform/inst_apps/fields/fields.yml @@ -0,0 +1,8 @@ +- name: tychon + type: group + fields: + - name: installed_app + type: group + fields: + - name: crypto_library_count + type: long diff --git a/packages/tychon_quantum_command/elasticsearch/transform/inst_apps/manifest.yml b/packages/tychon_quantum_command/elasticsearch/transform/inst_apps/manifest.yml new file mode 100644 index 00000000000..24e9e926793 --- /dev/null +++ b/packages/tychon_quantum_command/elasticsearch/transform/inst_apps/manifest.yml @@ -0,0 +1,11 @@ +start: true +destination_index_template: + mappings: + dynamic: true + dynamic_templates: + - strings_as_keyword: + match_mapping_type: string + mapping: + ignore_above: 1024 + type: keyword + date_detection: true diff --git a/packages/tychon_quantum_command/elasticsearch/transform/inst_apps/transform.yml b/packages/tychon_quantum_command/elasticsearch/transform/inst_apps/transform.yml new file mode 100644 index 00000000000..8763591b07b --- /dev/null +++ b/packages/tychon_quantum_command/elasticsearch/transform/inst_apps/transform.yml @@ -0,0 +1,21 @@ +source: + index: logs-tychon_quantum_command.tychon_pqc-* + query: + term: + "tychon.index": "installed-apps" +dest: + index: tychon-pqc-installed-apps +latest: + unique_key: + - observer.id + - id + sort: "@timestamp" +sync: + time: + field: "@timestamp" + delay: "60s" +frequency: "1m" +_meta: + fleet_transform_version: 1.0.4 + run_as_kibana_system: false + managed: true diff --git a/packages/tychon_quantum_command/elasticsearch/transform/inventory/fields/base-fields.yml b/packages/tychon_quantum_command/elasticsearch/transform/inventory/fields/base-fields.yml new file mode 100644 index 00000000000..7913a50e156 --- /dev/null +++ b/packages/tychon_quantum_command/elasticsearch/transform/inventory/fields/base-fields.yml @@ -0,0 +1,40 @@ +- name: id + description: Tychon unique document identifier for the inventory record. + type: keyword +- name: scan_type + type: keyword +- name: tychon + type: group + fields: + - name: index + type: keyword + - name: type + type: keyword +- name: kerberos + type: group + fields: + - name: config_source + type: keyword + - name: has_aes128 + type: boolean + - name: has_aes256 + type: boolean + - name: has_des + type: boolean + - name: has_rc4 + type: boolean + - name: is_quantum_safe + type: boolean + - name: raw_bitmask + type: long + - name: supported_types + type: keyword +- name: scan + type: group + fields: + - name: target_input + type: keyword + - name: timestamp + type: date + - name: type + type: keyword diff --git a/packages/tychon_quantum_command/elasticsearch/transform/inventory/fields/ecs.yml b/packages/tychon_quantum_command/elasticsearch/transform/inventory/fields/ecs.yml new file mode 100644 index 00000000000..e2bf28970ff --- /dev/null +++ b/packages/tychon_quantum_command/elasticsearch/transform/inventory/fields/ecs.yml @@ -0,0 +1,81 @@ +- name: '@timestamp' + type: date +- name: destination + type: group + fields: + - name: domain + type: keyword + - name: ip + type: ip + - name: port + type: long +- name: event.action + type: keyword +- name: event.category + type: keyword +- name: event.dataset + type: keyword +- name: event.ingested + type: date +- name: event.kind + type: keyword +- name: host + type: group + fields: + - name: architecture + type: keyword + - name: hostname + type: keyword + - name: id + type: keyword + - name: ip + type: keyword + - name: os_category + type: keyword + - name: os_pqc_tier + type: keyword +- name: observer + type: group + fields: + - name: hostname + type: keyword + - name: id + type: keyword + - name: database_schema_version + type: keyword + - name: output_schema_version + type: keyword + - name: type + type: keyword + - name: vendor + type: keyword + - name: version + type: keyword + - name: tychon_client_id + type: keyword + - name: windows_server_role + type: keyword +- name: process + type: group + fields: + - name: command_line + type: wildcard + - name: executable + type: keyword + - name: executable_directory + type: keyword + - name: name + type: keyword + - name: pid + type: long + - name: start + type: date + - name: user_name + type: keyword +- name: server + type: group + fields: + - name: port + type: long + - name: protocol + type: keyword diff --git a/packages/tychon_quantum_command/elasticsearch/transform/inventory/fields/fields.yml b/packages/tychon_quantum_command/elasticsearch/transform/inventory/fields/fields.yml new file mode 100644 index 00000000000..ff4a43947a5 --- /dev/null +++ b/packages/tychon_quantum_command/elasticsearch/transform/inventory/fields/fields.yml @@ -0,0 +1,71 @@ +- name: omb + type: group + fields: + - name: kex_primary + type: keyword + - name: kex_primary_quantum_safe + type: boolean + - name: kex_secondary + type: keyword + - name: kex_tier + type: keyword + - name: protocol_tier + type: keyword + - name: sig_tier + type: keyword +- name: quantum_ready + type: boolean +- name: quantum_ready_cert + type: boolean +- name: quantum_ready_cipher + type: boolean +- name: quantum_ready_kx + type: boolean +- name: tls + type: group + fields: + - name: duration_ms + type: long + - name: insecure_cipher_count + type: long + - name: insecure_ciphers + type: keyword + - name: preferred_cipher + type: keyword + - name: preferred_key_exchange + type: keyword + - name: preferred_protocol + type: keyword + - name: supported_key_exchange_count + type: long + - name: supported_key_exchanges + type: keyword + - name: supported_protocol_count + type: long + - name: supported_protocols + type: keyword + - name: total_probes + type: long +- name: x509 + type: group + fields: + - name: issuer_cn + type: keyword + - name: key_bits + type: long + - name: key_type + type: keyword + - name: key_usage + type: keyword + - name: not_after + type: date + - name: not_before + type: date + - name: serial_number + type: keyword + - name: sha256_fingerprint + type: keyword + - name: sig_algorithm + type: keyword + - name: subject_cn + type: keyword diff --git a/packages/tychon_quantum_command/elasticsearch/transform/inventory/manifest.yml b/packages/tychon_quantum_command/elasticsearch/transform/inventory/manifest.yml new file mode 100644 index 00000000000..24e9e926793 --- /dev/null +++ b/packages/tychon_quantum_command/elasticsearch/transform/inventory/manifest.yml @@ -0,0 +1,11 @@ +start: true +destination_index_template: + mappings: + dynamic: true + dynamic_templates: + - strings_as_keyword: + match_mapping_type: string + mapping: + ignore_above: 1024 + type: keyword + date_detection: true diff --git a/packages/tychon_quantum_command/elasticsearch/transform/inventory/transform.yml b/packages/tychon_quantum_command/elasticsearch/transform/inventory/transform.yml new file mode 100644 index 00000000000..3711f3d08d6 --- /dev/null +++ b/packages/tychon_quantum_command/elasticsearch/transform/inventory/transform.yml @@ -0,0 +1,21 @@ +source: + index: logs-tychon_quantum_command.tychon_pqc-* + query: + term: + "tychon.index": "inventory" +dest: + index: tychon-pqc-inventory +latest: + unique_key: + - observer.id + - id + sort: "@timestamp" +sync: + time: + field: "@timestamp" + delay: "60s" +frequency: "1m" +_meta: + fleet_transform_version: 1.0.4 + run_as_kibana_system: false + managed: true diff --git a/packages/tychon_quantum_command/elasticsearch/transform/ipsec_tnls/fields/base-fields.yml b/packages/tychon_quantum_command/elasticsearch/transform/ipsec_tnls/fields/base-fields.yml new file mode 100644 index 00000000000..fb9752836c4 --- /dev/null +++ b/packages/tychon_quantum_command/elasticsearch/transform/ipsec_tnls/fields/base-fields.yml @@ -0,0 +1,38 @@ +- name: id + description: Tychon unique document identifier for the IPSec tunnel record. + type: keyword +- name: tychon + type: group + fields: + - name: index + type: keyword + - name: type + type: keyword +- name: kerberos + type: group + fields: + - name: config_source + type: keyword + - name: has_aes128 + type: boolean + - name: has_aes256 + type: boolean + - name: has_des + type: boolean + - name: has_rc4 + type: boolean + - name: is_quantum_safe + type: boolean + - name: raw_bitmask + type: long + - name: supported_types + type: keyword +- name: scan + type: group + fields: + - name: target_input + type: keyword + - name: timestamp + type: date + - name: type + type: keyword diff --git a/packages/tychon_quantum_command/elasticsearch/transform/ipsec_tnls/fields/ecs.yml b/packages/tychon_quantum_command/elasticsearch/transform/ipsec_tnls/fields/ecs.yml new file mode 100644 index 00000000000..463d8ed4806 --- /dev/null +++ b/packages/tychon_quantum_command/elasticsearch/transform/ipsec_tnls/fields/ecs.yml @@ -0,0 +1,23 @@ +- name: '@timestamp' + type: date +- name: event.action + type: keyword +- name: event.category + type: keyword +- name: event.dataset + type: keyword +- name: event.ingested + type: date +- name: event.kind + type: keyword +- name: observer + type: group + fields: + - name: hostname + type: keyword + - name: id + type: keyword + - name: tychon_client_id + type: keyword + - name: windows_server_role + type: keyword diff --git a/packages/tychon_quantum_command/elasticsearch/transform/ipsec_tnls/fields/fields.yml b/packages/tychon_quantum_command/elasticsearch/transform/ipsec_tnls/fields/fields.yml new file mode 100644 index 00000000000..48ac78c8070 --- /dev/null +++ b/packages/tychon_quantum_command/elasticsearch/transform/ipsec_tnls/fields/fields.yml @@ -0,0 +1,76 @@ +- name: ipsec_tunnel + type: group + fields: + - name: active + type: boolean + - name: config_path + type: keyword + - name: detection_confidence + type: keyword + - name: detection_method + type: keyword + - name: first_detected + type: date + - name: implementation + type: keyword + - name: last_seen + type: date + - name: name + type: keyword + - name: source_id + type: keyword + - name: status + type: keyword + - name: version + type: keyword +- name: pqc + type: group + fields: + - name: is_pqc_ready + type: boolean + - name: pqc_migration_status + type: keyword + - name: quantum_resistance + type: keyword +- name: security + type: group + fields: + - name: known_vulnerabilities + type: keyword + - name: perfect_forward_secrecy + type: boolean + - name: pqc_support + type: boolean + - name: pqc_vulnerable + type: boolean + - name: risk_level + type: keyword + - name: score + type: long + - name: security_score + type: long + - name: vulnerable + type: boolean + - name: weak_crypto + type: boolean + - name: weak_dh_group + type: boolean +- name: tunnel_details + type: group + fields: + - name: auth_method + type: keyword + - name: dh_group + type: keyword + - name: encryption_algorithm + type: keyword + - name: integrity_algorithm + type: keyword + - name: mode + type: keyword + - name: nat_traversal + type: boolean + - name: perfect_forward_secrecy + type: boolean + - name: protocol + type: keyword diff --git a/packages/tychon_quantum_command/elasticsearch/transform/ipsec_tnls/manifest.yml b/packages/tychon_quantum_command/elasticsearch/transform/ipsec_tnls/manifest.yml new file mode 100644 index 00000000000..24e9e926793 --- /dev/null +++ b/packages/tychon_quantum_command/elasticsearch/transform/ipsec_tnls/manifest.yml @@ -0,0 +1,11 @@ +start: true +destination_index_template: + mappings: + dynamic: true + dynamic_templates: + - strings_as_keyword: + match_mapping_type: string + mapping: + ignore_above: 1024 + type: keyword + date_detection: true diff --git a/packages/tychon_quantum_command/elasticsearch/transform/ipsec_tnls/transform.yml b/packages/tychon_quantum_command/elasticsearch/transform/ipsec_tnls/transform.yml new file mode 100644 index 00000000000..98058b690c0 --- /dev/null +++ b/packages/tychon_quantum_command/elasticsearch/transform/ipsec_tnls/transform.yml @@ -0,0 +1,21 @@ +source: + index: logs-tychon_quantum_command.tychon_pqc-* + query: + term: + "tychon.index": "ipsec-tunnels" +dest: + index: tychon-pqc-ipsec-tunnels +latest: + unique_key: + - observer.id + - id + sort: "@timestamp" +sync: + time: + field: "@timestamp" + delay: "60s" +frequency: "1m" +_meta: + fleet_transform_version: 1.0.4 + run_as_kibana_system: false + managed: true diff --git a/packages/tychon_quantum_command/elasticsearch/transform/keystores/fields/base-fields.yml b/packages/tychon_quantum_command/elasticsearch/transform/keystores/fields/base-fields.yml new file mode 100644 index 00000000000..ce6d815c7a0 --- /dev/null +++ b/packages/tychon_quantum_command/elasticsearch/transform/keystores/fields/base-fields.yml @@ -0,0 +1,38 @@ +- name: id + description: Tychon unique document identifier for the keystore record. + type: keyword +- name: tychon + type: group + fields: + - name: index + type: keyword + - name: type + type: keyword +- name: kerberos + type: group + fields: + - name: config_source + type: keyword + - name: has_aes128 + type: boolean + - name: has_aes256 + type: boolean + - name: has_des + type: boolean + - name: has_rc4 + type: boolean + - name: is_quantum_safe + type: boolean + - name: raw_bitmask + type: long + - name: supported_types + type: keyword +- name: scan + type: group + fields: + - name: target_input + type: keyword + - name: timestamp + type: date + - name: type + type: keyword diff --git a/packages/tychon_quantum_command/elasticsearch/transform/keystores/fields/ecs.yml b/packages/tychon_quantum_command/elasticsearch/transform/keystores/fields/ecs.yml new file mode 100644 index 00000000000..84eae2c5697 --- /dev/null +++ b/packages/tychon_quantum_command/elasticsearch/transform/keystores/fields/ecs.yml @@ -0,0 +1,30 @@ +- name: '@timestamp' + type: date +- name: event.action + type: keyword +- name: event.category + type: keyword +- name: event.dataset + type: keyword +- name: event.ingested + type: date +- name: event.kind + type: keyword +- name: file + type: group + fields: + - name: name + type: keyword + - name: path + type: keyword +- name: observer + type: group + fields: + - name: hostname + type: keyword + - name: id + type: keyword + - name: tychon_client_id + type: keyword + - name: windows_server_role + type: keyword diff --git a/packages/tychon_quantum_command/elasticsearch/transform/keystores/fields/fields.yml b/packages/tychon_quantum_command/elasticsearch/transform/keystores/fields/fields.yml new file mode 100644 index 00000000000..a5ddc72b2de --- /dev/null +++ b/packages/tychon_quantum_command/elasticsearch/transform/keystores/fields/fields.yml @@ -0,0 +1,34 @@ +- name: keystore + type: group + fields: + - name: accessible + type: boolean + - name: cert_count + type: long + - name: path + type: keyword + - name: requires_auth + type: boolean + - name: type + type: keyword + - name: stats + type: group + fields: + - name: expired_certificates + type: long + - name: pqc_vulnerable_certificates + type: long + - name: vulnerable_certificates + type: long + - name: certificate_types + type: group + fields: + - name: ca + type: long + - name: key_algorithms + type: group + fields: + - name: ECDSA + type: long + - name: RSA + type: long diff --git a/packages/tychon_quantum_command/elasticsearch/transform/keystores/manifest.yml b/packages/tychon_quantum_command/elasticsearch/transform/keystores/manifest.yml new file mode 100644 index 00000000000..24e9e926793 --- /dev/null +++ b/packages/tychon_quantum_command/elasticsearch/transform/keystores/manifest.yml @@ -0,0 +1,11 @@ +start: true +destination_index_template: + mappings: + dynamic: true + dynamic_templates: + - strings_as_keyword: + match_mapping_type: string + mapping: + ignore_above: 1024 + type: keyword + date_detection: true diff --git a/packages/tychon_quantum_command/elasticsearch/transform/keystores/transform.yml b/packages/tychon_quantum_command/elasticsearch/transform/keystores/transform.yml new file mode 100644 index 00000000000..4ce57e1481d --- /dev/null +++ b/packages/tychon_quantum_command/elasticsearch/transform/keystores/transform.yml @@ -0,0 +1,21 @@ +source: + index: logs-tychon_quantum_command.tychon_pqc-* + query: + term: + "tychon.index": "keystores" +dest: + index: tychon-pqc-keystores +latest: + unique_key: + - observer.id + - id + sort: "@timestamp" +sync: + time: + field: "@timestamp" + delay: "60s" +frequency: "1m" +_meta: + fleet_transform_version: 1.0.4 + run_as_kibana_system: false + managed: true diff --git a/packages/tychon_quantum_command/elasticsearch/transform/macsec/fields/base-fields.yml b/packages/tychon_quantum_command/elasticsearch/transform/macsec/fields/base-fields.yml new file mode 100644 index 00000000000..31034afabd0 --- /dev/null +++ b/packages/tychon_quantum_command/elasticsearch/transform/macsec/fields/base-fields.yml @@ -0,0 +1,10 @@ +- name: id + description: Tychon unique document identifier for the MACsec record. + type: keyword +- name: tychon + type: group + fields: + - name: index + type: keyword + - name: type + type: keyword diff --git a/packages/tychon_quantum_command/elasticsearch/transform/macsec/fields/ecs.yml b/packages/tychon_quantum_command/elasticsearch/transform/macsec/fields/ecs.yml new file mode 100644 index 00000000000..5f17d34b1ad --- /dev/null +++ b/packages/tychon_quantum_command/elasticsearch/transform/macsec/fields/ecs.yml @@ -0,0 +1,6 @@ +- name: '@timestamp' + type: date +- name: event.dataset + type: keyword +- name: event.ingested + type: date diff --git a/packages/tychon_quantum_command/elasticsearch/transform/macsec/fields/fields.yml b/packages/tychon_quantum_command/elasticsearch/transform/macsec/fields/fields.yml new file mode 100644 index 00000000000..91bde41fcff --- /dev/null +++ b/packages/tychon_quantum_command/elasticsearch/transform/macsec/fields/fields.yml @@ -0,0 +1,25 @@ +- name: macsec + type: group + fields: + - name: cipher_suite + type: keyword + - name: detection_confidence + type: keyword + - name: detection_method + type: keyword + - name: implementation + type: keyword + - name: interface_name + type: keyword + - name: key_agreement_method + type: keyword + - name: parent_interface + type: keyword + - name: risk_level + type: keyword + - name: sci + type: keyword + - name: status + type: keyword + - name: validation_mode + type: keyword diff --git a/packages/tychon_quantum_command/elasticsearch/transform/macsec/manifest.yml b/packages/tychon_quantum_command/elasticsearch/transform/macsec/manifest.yml new file mode 100644 index 00000000000..24e9e926793 --- /dev/null +++ b/packages/tychon_quantum_command/elasticsearch/transform/macsec/manifest.yml @@ -0,0 +1,11 @@ +start: true +destination_index_template: + mappings: + dynamic: true + dynamic_templates: + - strings_as_keyword: + match_mapping_type: string + mapping: + ignore_above: 1024 + type: keyword + date_detection: true diff --git a/packages/tychon_quantum_command/elasticsearch/transform/macsec/transform.yml b/packages/tychon_quantum_command/elasticsearch/transform/macsec/transform.yml new file mode 100644 index 00000000000..edf09dc935e --- /dev/null +++ b/packages/tychon_quantum_command/elasticsearch/transform/macsec/transform.yml @@ -0,0 +1,21 @@ +source: + index: logs-tychon_quantum_command.tychon_pqc-* + query: + term: + "tychon.index": "macsec" +dest: + index: tychon-pqc-macsec +latest: + unique_key: + - observer.id + - id + sort: "@timestamp" +sync: + time: + field: "@timestamp" + delay: "60s" +frequency: "1m" +_meta: + fleet_transform_version: 1.0.4 + run_as_kibana_system: false + managed: true diff --git a/packages/tychon_quantum_command/elasticsearch/transform/readiness/fields/base-fields.yml b/packages/tychon_quantum_command/elasticsearch/transform/readiness/fields/base-fields.yml new file mode 100644 index 00000000000..c9dcef040fb --- /dev/null +++ b/packages/tychon_quantum_command/elasticsearch/transform/readiness/fields/base-fields.yml @@ -0,0 +1,54 @@ +- name: id + description: Tychon unique document identifier for the system readiness record. + type: keyword +- name: tychon + type: group + fields: + - name: index + description: Tychon dataset discriminator used by the source event. + type: keyword + - name: type + description: Tychon record type. + type: keyword +- name: kerberos + type: group + fields: + - name: config_source + description: Source of Kerberos encryption configuration. + type: keyword + - name: has_aes128 + description: Indicates whether AES128 Kerberos support is enabled. + type: boolean + - name: has_aes256 + description: Indicates whether AES256 Kerberos support is enabled. + type: boolean + - name: has_des + description: Indicates whether DES Kerberos support is enabled. + type: boolean + - name: has_rc4 + description: Indicates whether RC4 Kerberos support is enabled. + type: boolean + - name: is_explicitly_configured + description: Indicates whether Kerberos encryption settings are explicitly configured. + type: boolean + - name: is_quantum_safe + description: Indicates whether the Kerberos configuration is considered post-quantum safe. + type: boolean + - name: raw_bitmask + description: Windows Kerberos encryption type bitmask, when available. + type: long + - name: supported_types + description: Supported Kerberos encryption types as reported by the host. + type: keyword +- name: scan + type: group + fields: + - name: target_input + description: Original scan target input supplied to TQC. + type: keyword + - name: timestamp + description: Timestamp emitted by the scanner for this record. + type: date + - name: type + description: Scan mode used to collect the readiness record. + type: keyword diff --git a/packages/tychon_quantum_command/elasticsearch/transform/readiness/fields/ecs.yml b/packages/tychon_quantum_command/elasticsearch/transform/readiness/fields/ecs.yml new file mode 100644 index 00000000000..e73e0f53ca9 --- /dev/null +++ b/packages/tychon_quantum_command/elasticsearch/transform/readiness/fields/ecs.yml @@ -0,0 +1,144 @@ +- name: '@timestamp' + description: Timestamp when the readiness event occurred. + type: date +- name: data_stream.dataset + description: Data stream dataset of the source event. + type: constant_keyword +- name: data_stream.namespace + description: Data stream namespace of the source event. + type: constant_keyword +- name: data_stream.type + description: Data stream type of the source event. + type: constant_keyword +- name: ecs.version + description: ECS version of the transformed event. + type: keyword +- name: event.action + description: Action captured for the readiness event. + type: keyword +- name: event.category + description: Event category for the readiness event. + type: keyword +- name: event.dataset + description: Event dataset of the source readiness record. + type: keyword +- name: event.ingested + description: Timestamp when the event was ingested into Elasticsearch. + type: date +- name: event.kind + description: Event kind for the readiness record. + type: keyword +- name: error.message + description: Error message captured during readiness collection or processing. + type: match_only_text +- name: observer + type: group + fields: + - name: bigfix_client_installed + description: Indicates whether a BigFix client is installed on the observer host. + type: boolean + - name: bios_serial_number + description: BIOS serial number reported by the observer host. + type: keyword + - name: cpu_cores + description: Number of physical CPU cores reported by the observer host. + type: long + - name: cpu_logical_cores + description: Number of logical CPU cores reported by the observer host. + type: long + - name: cpu_model_name + description: CPU model name reported by the observer host. + type: keyword + - name: cpu_vendor_id + description: CPU vendor identifier reported by the observer host. + type: keyword + - name: current_user + description: Current user context used by the observer when scanning. + type: keyword + - name: domain + description: Domain associated with the observer host. + type: keyword + - name: fips_mode_enabled + description: Indicates whether FIPS mode is enabled on the observer host. + type: boolean + - name: hostname + description: Hostname of the observer host. + type: keyword + - name: id + description: Unique observer identifier. + type: keyword + - name: ip_addresses + description: IP addresses reported by the observer host. + type: keyword + - name: is_vdi_environment + description: Indicates whether the observer is running in a VDI environment. + type: boolean + - name: kernel_arch + description: Kernel architecture reported by the observer host. + type: keyword + - name: kernel_version + description: Kernel version reported by the observer host. + type: keyword + - name: machine_serial_number + description: Machine serial number reported by the observer host. + type: keyword + - name: organization + description: Organization associated with the observer host. + type: keyword + - name: platform_version + description: Platform-specific version string reported by the observer host. + type: keyword + - name: ram_used_percent + description: Percent of RAM in use on the observer host. + type: float + - name: software_version + description: Tychon software version on the observer host. + type: keyword + - name: system_uptime_seconds + description: System uptime in seconds on the observer host. + type: long + - name: total_ram_bytes + description: Total RAM bytes on the observer host. + type: long + - name: tychon_client_id + description: Tychon client identifier reported on Windows endpoints. + type: keyword + - name: user_gid + description: Current user group identifier on the observer host. + type: keyword + - name: user_home_dir + description: Home directory of the current user on the observer host. + type: keyword + - name: user_uid + description: Current user identifier on the observer host. + type: keyword + - name: vdi_identity_source + description: Source used to determine VDI identity. + type: keyword + - name: windows_server_role + description: Windows server role or workstation role of the observer host. + type: keyword + - name: os + type: group + fields: + - name: build + description: Observer operating system build identifier. + type: keyword + - name: family + description: Observer operating system family. + type: keyword + - name: kernel + description: Observer operating system kernel string. + type: keyword + - name: name + description: Observer operating system name. + type: keyword + - name: platform + description: Observer operating system platform. + type: keyword + - name: version + description: Observer operating system version. + type: keyword +- name: tags + description: Tags preserved on the transformed readiness document. + type: keyword diff --git a/packages/tychon_quantum_command/elasticsearch/transform/readiness/fields/fields.yml b/packages/tychon_quantum_command/elasticsearch/transform/readiness/fields/fields.yml new file mode 100644 index 00000000000..89935d5aaae --- /dev/null +++ b/packages/tychon_quantum_command/elasticsearch/transform/readiness/fields/fields.yml @@ -0,0 +1,351 @@ +- name: quantum_readiness + type: group + fields: + - name: assessment_duration_ms + description: Duration of the readiness assessment in milliseconds. + type: long + - name: assessment_id + description: Unique assessment identifier emitted by TQC. + type: keyword + - name: assessment_type + description: Type of readiness assessment performed. + type: keyword + - name: detailed_report + description: Markdown-formatted detailed readiness report. + type: match_only_text + - name: max_possible_score + description: Maximum possible score for the readiness assessment. + type: long + - name: overall_score + description: Overall readiness score. + type: long + - name: readiness_status + description: High-level readiness status returned by the assessment. + type: keyword + - name: ready_timeline + description: Estimated timeline to reach readiness. + type: keyword + - name: recommendations + description: Readiness recommendations summarized by TQC. + type: keyword + - name: status_color + description: UI-oriented status color assigned by TQC. + type: keyword + - name: timestamp + description: Native readiness timestamp emitted by TQC. + type: date + - name: compliance + type: group + fields: + - name: common_criteria + description: Indicates whether Common Criteria readiness is met. + type: boolean + - name: compliance_notes + description: Compliance notes reported by the readiness assessment. + type: wildcard + - name: fips_ready + description: Indicates whether FIPS readiness requirements are met. + type: boolean + - name: nist_ready + description: Indicates whether NIST readiness requirements are met. + type: boolean + - name: cost_analysis + type: group + fields: + - name: app_family + description: Application family reported by app-group readiness cost analysis records. + type: keyword + - name: hardware_cost_usd + description: Hardware remediation cost for an app-group readiness record. + type: float + - name: instance_count + description: Number of application instances represented by an app-group readiness record. + type: long + - name: labor_rate_used + description: Labor rate used for cost analysis. + type: float + - name: labor_cost_usd + description: Labor remediation cost for an app-group readiness record. + type: float + - name: license_cost_usd + description: License remediation cost for an app-group readiness record. + type: float + - name: os_category + description: Operating system category used in cost analysis. + type: keyword + - name: os_hardware_cost_usd + description: Hardware cost for the operating system upgrade path. + type: float + - name: os_labor_cost_usd + description: Labor cost for the operating system upgrade path. + type: float + - name: os_labor_hours + description: Labor hours for the operating system upgrade path. + type: float + - name: os_license_cost_usd + description: License cost for the operating system upgrade path. + type: float + - name: os_tier + description: Operating system tier classification for cost analysis. + type: keyword + - name: os_total_cost_usd + description: Total operating system remediation cost. + type: float + - name: os_upgrade_target + description: Target operating system identified for remediation. + type: keyword + - name: tier + description: App-group remediation tier used by cost analysis dashboards. + type: keyword + - name: total_cost_usd + description: Total estimated remediation cost. + type: float + - name: total_hardware_cost_usd + description: Total estimated hardware cost. + type: float + - name: total_labor_cost_usd + description: Total estimated labor cost. + type: float + - name: total_labor_hours + description: Total estimated labor hours. + type: float + - name: total_license_cost_usd + description: Total estimated license cost. + type: float + - name: crypto_libraries + type: group + fields: + - name: fips_mode + description: Indicates whether FIPS mode is enabled for system crypto libraries. + type: boolean + - name: legacy_libraries_present + description: Indicates whether legacy crypto libraries were detected. + type: boolean + - name: max_score + description: Maximum score available for crypto libraries. + type: long + - name: openssl_max_score + description: Maximum score assigned to OpenSSL readiness. + type: long + - name: openssl_score + description: OpenSSL readiness score. + type: long + - name: openssl_version + description: OpenSSL version detected on the system. + type: keyword + - name: oqs_provider + description: Indicates whether an OQS provider was detected. + type: boolean + - name: pqc_support + description: Indicates whether post-quantum crypto support was detected. + type: boolean + - name: system_crypto_max_score + description: Maximum score available for the system crypto stack. + type: long + - name: system_crypto_score + description: Score assigned to the system crypto stack. + type: long + - name: system_libraries + description: System crypto libraries detected during the assessment. + type: keyword + - name: total_score + description: Total crypto library readiness score. + type: long + - name: uses_openssl + description: Indicates whether OpenSSL was detected in the system crypto stack. + type: boolean + - name: hardware + type: group + fields: + - name: architecture + description: Hardware architecture evaluated by the readiness assessment. + type: keyword + - name: available_ram_gb + description: Available RAM in gigabytes. + type: float + - name: base_frequency_ghz + description: Base CPU frequency in gigahertz. + type: float + - name: cores + description: Number of CPU cores evaluated. + type: long + - name: cpu_max_score + description: Maximum possible CPU score. + type: long + - name: cpu_score + description: CPU score assigned by the assessment. + type: long + - name: has_aes_ni + description: Indicates whether AES-NI instructions are available. + type: boolean + - name: has_avx2 + description: Indicates whether AVX2 instructions are available. + type: boolean + - name: has_hsm + description: Indicates whether a hardware security module is available. + type: boolean + - name: has_neon + description: Indicates whether NEON instructions are available. + type: boolean + - name: has_secure_boot + description: Indicates whether secure boot support is available. + type: boolean + - name: has_tpm + description: Indicates whether TPM support is available. + type: boolean + - name: instruction_sets + description: Instruction sets detected on the host. + type: keyword + - name: logical_cores + description: Number of logical CPU cores evaluated. + type: long + - name: max_score + description: Maximum hardware score. + type: long + - name: memory_max_score + description: Maximum memory score. + type: long + - name: memory_score + description: Memory score assigned by the assessment. + type: long + - name: security_hw_max_score + description: Maximum security hardware score. + type: long + - name: security_hw_score + description: Security hardware score assigned by the assessment. + type: long + - name: total_ram_gb + description: Total RAM in gigabytes. + type: float + - name: total_score + description: Total hardware readiness score. + type: long + - name: tpm_version + description: TPM version detected on the host. + type: keyword + - name: network + type: group + fields: + - name: bandwidth_max_score + description: Maximum bandwidth score. + type: long + - name: bandwidth_score + description: Bandwidth score assigned by the assessment. + type: long + - name: estimated_bandwidth_mbps + description: Estimated network bandwidth in megabits per second. + type: long + - name: ipv6_support + description: Indicates whether IPv6 support is available. + type: boolean + - name: latency_ms + description: Estimated network latency in milliseconds. + type: long + - name: max_score + description: Maximum network score. + type: long + - name: modern_cipher_support + description: Indicates whether modern network ciphers are supported. + type: boolean + - name: mtu + description: Network MTU detected during assessment. + type: long + - name: protocol_max_score + description: Maximum network protocol score. + type: long + - name: protocol_score + description: Network protocol score assigned by the assessment. + type: long + - name: tls13_capable + description: Indicates whether TLS 1.3 capability is present. + type: boolean + - name: total_score + description: Total network readiness score. + type: long + - name: operating_system + type: group + fields: + - name: build + description: Operating system build reported by the assessment. + type: keyword + - name: crypto_api_max_score + description: Maximum operating system crypto API score. + type: long + - name: crypto_api_score + description: Operating system crypto API score assigned by the assessment. + type: long + - name: crypto_framework + description: Native crypto framework detected on the operating system. + type: keyword + - name: family + description: Operating system family evaluated by the assessment. + type: keyword + - name: fips_mode_enabled + description: Indicates whether operating system FIPS mode is enabled. + type: boolean + - name: kernel_version + description: Kernel version evaluated by the assessment. + type: keyword + - name: max_score + description: Maximum operating system score. + type: long + - name: modern_crypto_api + description: Indicates whether a modern crypto API is available. + type: boolean + - name: native_pqc_support + description: Indicates whether native post-quantum support is available. + type: boolean + - name: os_version_max_score + description: Maximum operating system version score. + type: long + - name: os_version_score + description: Operating system version score assigned by the assessment. + type: long + - name: pqc_framework + description: Post-quantum framework detected on the operating system. + type: keyword + - name: symcrypt_present + description: Indicates whether SymCrypt is present. + type: boolean + - name: total_score + description: Total operating system readiness score. + type: long + - name: version + description: Operating system version evaluated by the assessment. + type: keyword + - name: system_classification + type: group + fields: + - name: criticality_level + description: System criticality level assigned by TQC. + type: keyword + - name: detection_reason + description: Reason used to classify the system role and type. + type: keyword + - name: role + description: System role assigned by the readiness assessment. + type: keyword + - name: type + description: System type assigned by the readiness assessment. + type: keyword + - name: upgrade_pathway + type: group + fields: + - name: action + description: Recommended remediation action. + type: keyword + - name: component + description: Component targeted by the remediation action. + type: keyword + - name: description + description: Description of the recommended remediation step. + type: keyword + - name: estimated_time_weeks + description: Estimated time in weeks for the remediation step. + type: long + - name: order + description: Ordered step number in the upgrade pathway. + type: long + - name: priority + description: Priority assigned to the remediation step. + type: keyword diff --git a/packages/tychon_quantum_command/elasticsearch/transform/readiness/manifest.yml b/packages/tychon_quantum_command/elasticsearch/transform/readiness/manifest.yml new file mode 100644 index 00000000000..24e9e926793 --- /dev/null +++ b/packages/tychon_quantum_command/elasticsearch/transform/readiness/manifest.yml @@ -0,0 +1,11 @@ +start: true +destination_index_template: + mappings: + dynamic: true + dynamic_templates: + - strings_as_keyword: + match_mapping_type: string + mapping: + ignore_above: 1024 + type: keyword + date_detection: true diff --git a/packages/tychon_quantum_command/elasticsearch/transform/readiness/transform.yml b/packages/tychon_quantum_command/elasticsearch/transform/readiness/transform.yml new file mode 100644 index 00000000000..593ed0236e2 --- /dev/null +++ b/packages/tychon_quantum_command/elasticsearch/transform/readiness/transform.yml @@ -0,0 +1,21 @@ +source: + index: logs-tychon_quantum_command.tychon_pqc-* + query: + term: + "tychon.index": "system-readiness" +dest: + index: tychon-pqc-system-readiness +latest: + unique_key: + - observer.id + - id + sort: "@timestamp" +sync: + time: + field: "@timestamp" + delay: "60s" +frequency: "1m" +_meta: + fleet_transform_version: 1.0.4 + run_as_kibana_system: false + managed: true diff --git a/packages/tychon_quantum_command/elasticsearch/transform/vpn_clients/fields/base-fields.yml b/packages/tychon_quantum_command/elasticsearch/transform/vpn_clients/fields/base-fields.yml new file mode 100644 index 00000000000..1fdbf93ef3a --- /dev/null +++ b/packages/tychon_quantum_command/elasticsearch/transform/vpn_clients/fields/base-fields.yml @@ -0,0 +1,38 @@ +- name: id + description: Tychon unique document identifier for the VPN client record. + type: keyword +- name: tychon + type: group + fields: + - name: index + type: keyword + - name: type + type: keyword +- name: kerberos + type: group + fields: + - name: config_source + type: keyword + - name: has_aes128 + type: boolean + - name: has_aes256 + type: boolean + - name: has_des + type: boolean + - name: has_rc4 + type: boolean + - name: is_quantum_safe + type: boolean + - name: raw_bitmask + type: long + - name: supported_types + type: keyword +- name: scan + type: group + fields: + - name: target_input + type: keyword + - name: timestamp + type: date + - name: type + type: keyword diff --git a/packages/tychon_quantum_command/elasticsearch/transform/vpn_clients/fields/ecs.yml b/packages/tychon_quantum_command/elasticsearch/transform/vpn_clients/fields/ecs.yml new file mode 100644 index 00000000000..d0e48a2b191 --- /dev/null +++ b/packages/tychon_quantum_command/elasticsearch/transform/vpn_clients/fields/ecs.yml @@ -0,0 +1,32 @@ +- name: '@timestamp' + type: date +- name: event.action + type: keyword +- name: event.category + type: keyword +- name: event.dataset + type: keyword +- name: event.ingested + type: date +- name: event.kind + type: keyword +- name: file.path + type: keyword +- name: observer + type: group + fields: + - name: hostname + type: keyword + - name: id + type: keyword + - name: tychon_client_id + type: keyword + - name: windows_server_role + type: keyword +- name: service + type: group + fields: + - name: name + type: keyword + - name: state + type: keyword diff --git a/packages/tychon_quantum_command/elasticsearch/transform/vpn_clients/fields/fields.yml b/packages/tychon_quantum_command/elasticsearch/transform/vpn_clients/fields/fields.yml new file mode 100644 index 00000000000..0b70e22ea2e --- /dev/null +++ b/packages/tychon_quantum_command/elasticsearch/transform/vpn_clients/fields/fields.yml @@ -0,0 +1,63 @@ +- name: security + type: group + fields: + - name: pqc_support + type: boolean + - name: pqc_vulnerable + type: boolean + - name: risk_level + type: keyword + - name: score + type: long + - name: security_score + type: long + - name: vulnerable + type: boolean + - name: weak_crypto + type: boolean +- name: vpn_client + type: group + fields: + - name: active + type: boolean + - name: config_path + type: keyword + - name: detection_confidence + type: keyword + - name: detection_method + type: keyword + - name: executable_path + type: keyword + - name: first_detected + type: date + - name: install_path + type: keyword + - name: last_seen + type: date + - name: name + type: keyword + - name: service_name + type: keyword + - name: status + type: keyword + - name: vendor + type: keyword + - name: version + type: keyword +- name: vpn_config + type: group + fields: + - name: auto_reconnect + type: boolean + - name: config_encrypted + type: boolean + - name: dns_leak_protection + type: boolean + - name: ipv6_leak_protection + type: boolean + - name: kill_switch + type: boolean + - name: logging_enabled + type: boolean + - name: split_tunneling + type: boolean diff --git a/packages/tychon_quantum_command/elasticsearch/transform/vpn_clients/manifest.yml b/packages/tychon_quantum_command/elasticsearch/transform/vpn_clients/manifest.yml new file mode 100644 index 00000000000..24e9e926793 --- /dev/null +++ b/packages/tychon_quantum_command/elasticsearch/transform/vpn_clients/manifest.yml @@ -0,0 +1,11 @@ +start: true +destination_index_template: + mappings: + dynamic: true + dynamic_templates: + - strings_as_keyword: + match_mapping_type: string + mapping: + ignore_above: 1024 + type: keyword + date_detection: true diff --git a/packages/tychon_quantum_command/elasticsearch/transform/vpn_clients/transform.yml b/packages/tychon_quantum_command/elasticsearch/transform/vpn_clients/transform.yml new file mode 100644 index 00000000000..58f20ec99fe --- /dev/null +++ b/packages/tychon_quantum_command/elasticsearch/transform/vpn_clients/transform.yml @@ -0,0 +1,21 @@ +source: + index: logs-tychon_quantum_command.tychon_pqc-* + query: + term: + "tychon.index": "vpn-clients" +dest: + index: tychon-pqc-vpn-clients +latest: + unique_key: + - observer.id + - id + sort: "@timestamp" +sync: + time: + field: "@timestamp" + delay: "60s" +frequency: "1m" +_meta: + fleet_transform_version: 1.0.4 + run_as_kibana_system: false + managed: true diff --git a/packages/tychon_quantum_command/img/TQC_Application_Connections_Topology.png b/packages/tychon_quantum_command/img/TQC_Application_Connections_Topology.png new file mode 100644 index 00000000000..0c88a580534 Binary files /dev/null and b/packages/tychon_quantum_command/img/TQC_Application_Connections_Topology.png differ diff --git a/packages/tychon_quantum_command/img/TQC_Application_Detail.png b/packages/tychon_quantum_command/img/TQC_Application_Detail.png new file mode 100644 index 00000000000..e59ba1ba5e3 Binary files /dev/null and b/packages/tychon_quantum_command/img/TQC_Application_Detail.png differ diff --git a/packages/tychon_quantum_command/img/TQC_Application_Report.png b/packages/tychon_quantum_command/img/TQC_Application_Report.png new file mode 100644 index 00000000000..2185b6e5330 Binary files /dev/null and b/packages/tychon_quantum_command/img/TQC_Application_Report.png differ diff --git a/packages/tychon_quantum_command/img/TQC_Certificate_Report.png b/packages/tychon_quantum_command/img/TQC_Certificate_Report.png new file mode 100644 index 00000000000..d17abba8901 Binary files /dev/null and b/packages/tychon_quantum_command/img/TQC_Certificate_Report.png differ diff --git a/packages/tychon_quantum_command/img/TQC_Cost_Analysis.png b/packages/tychon_quantum_command/img/TQC_Cost_Analysis.png new file mode 100644 index 00000000000..a9226c4ae2c Binary files /dev/null and b/packages/tychon_quantum_command/img/TQC_Cost_Analysis.png differ diff --git a/packages/tychon_quantum_command/img/TQC_Inventory.png b/packages/tychon_quantum_command/img/TQC_Inventory.png new file mode 100644 index 00000000000..058052945ca Binary files /dev/null and b/packages/tychon_quantum_command/img/TQC_Inventory.png differ diff --git a/packages/tychon_quantum_command/img/TychonLogo.svg b/packages/tychon_quantum_command/img/TychonLogo.svg new file mode 100644 index 00000000000..47b482d3444 --- /dev/null +++ b/packages/tychon_quantum_command/img/TychonLogo.svg @@ -0,0 +1,59 @@ + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/packages/tychon_quantum_command/img/tychon-color.png b/packages/tychon_quantum_command/img/tychon-color.png new file mode 100644 index 00000000000..0e2c6d9f1d5 Binary files /dev/null and b/packages/tychon_quantum_command/img/tychon-color.png differ diff --git a/packages/tychon_quantum_command/kibana/dashboard/tychon_quantum_command-02366033-dee4-4ea4-8458-7c8a8b58987e-cost-analysis.json b/packages/tychon_quantum_command/kibana/dashboard/tychon_quantum_command-02366033-dee4-4ea4-8458-7c8a8b58987e-cost-analysis.json new file mode 100644 index 00000000000..8cae8b4290a --- /dev/null +++ b/packages/tychon_quantum_command/kibana/dashboard/tychon_quantum_command-02366033-dee4-4ea4-8458-7c8a8b58987e-cost-analysis.json @@ -0,0 +1,399 @@ +{ + "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": { + "ignoreFilters": false, + "ignoreQuery": false, + "ignoreTimerange": false, + "ignoreValidations": false + }, + "panelsJSON": {}, + "showApplySelections": false + }, + "description": "Aligns to schema 2.0.3", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "useMargins": false + }, + "panelsJSON": [ + { + "embeddableConfig": { + "enhancements": {}, + "hidePanelTitles": true, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "id": "", + "params": { + "fontSize": 12, + "markdown": "[Inventory](/app/dashboards#/view/tychon_quantum_command-32c01eb5-0d80-4a28-9de7-55b2046f7c45-inventory) | [Application Report](/app/dashboards#/view/tychon_quantum_command-443e5928-b1c4-4e07-b0b9-c675dd057e2f-application-report) | [Application Detail](/app/dashboards#/view/tychon_quantum_command-6dfff015-3cc9-48b6-9410-7d8c01ff0d9a-application-detail) | [Certificate Report](/app/dashboards#/view/tychon_quantum_command-d0159137-9139-4a93-85bb-2ac9ddab3982-certificate-operations-dashboard) | [Application Connections Topology](/app/dashboards#/view/tychon_quantum_command-6f3d60d5-b5fb-45a5-9298-acf3ceb3ea1b-application-connections-topology) | Cost Analysis", + "openLinksInNewTab": false + }, + "title": "", + "type": "markdown", + "uiState": {} + } + }, + "gridData": { + "h": 3, + "i": "tychon-quantum-command-nav", + "w": 48, + "x": 0, + "y": 0 + }, + "panelIndex": "tychon-quantum-command-nav", + "title": "", + "type": "visualization" + }, + { + "embeddableConfig": { + "enhancements": { + "dynamicActions": { + "events": [ + { + "action": { + "config": { + "openInNewTab": false, + "useCurrentDateRange": true, + "useCurrentFilters": true + }, + "factoryId": "DASHBOARD_TO_DASHBOARD_DRILLDOWN", + "name": "Open Inventory" + }, + "eventId": "39e70128-521d-50c8-913c-d745903e2b64", + "triggers": [ + "FILTER_TRIGGER" + ] + } + ] + } + }, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "id": "", + "params": { + "spec": "{\"$schema\": \"https://vega.github.io/schema/vega/v5.json\", \"description\": \"PQC Upgrade Cost Analysis \\u2014 Responsive KPI header: unified top card with accent stripe, three cost-breakdown tiles, and proportional composition bar. Reads pre-computed fields from tychon-pqc-system-readiness*. No cost arithmetic in Vega.\", \"autosize\": {\"type\": \"fit\", \"contains\": \"padding\"}, \"padding\": {\"left\": 16, \"right\": 16, \"top\": 16, \"bottom\": 16}, \"data\": [{\"name\": \"cost_totals\", \"url\": {\"%context%\": true, \"%timefield%\": \"@timestamp\", \"index\": \"tychon-pqc-system-readiness*\", \"body\": {\"size\": 0, \"aggs\": {\"agg_labor_hours\": {\"sum\": {\"field\": \"quantum_readiness.cost_analysis.total_labor_hours\"}}, \"agg_total_cost\": {\"sum\": {\"field\": \"quantum_readiness.cost_analysis.total_cost_usd\"}}, \"agg_labor_cost\": {\"sum\": {\"field\": \"quantum_readiness.cost_analysis.total_labor_cost_usd\"}}, \"agg_hw_cost\": {\"sum\": {\"field\": \"quantum_readiness.cost_analysis.total_hardware_cost_usd\"}}, \"agg_lic_cost\": {\"sum\": {\"field\": \"quantum_readiness.cost_analysis.total_license_cost_usd\"}}, \"agg_asset_count\": {\"value_count\": {\"field\": \"quantum_readiness.cost_analysis.total_cost_usd\"}}}}}, \"format\": {\"property\": \"aggregations\"}, \"transform\": [{\"type\": \"formula\", \"as\": \"labor_hours\", \"expr\": \"isValid(datum.agg_labor_hours) ? datum.agg_labor_hours.value : 0\"}, {\"type\": \"formula\", \"as\": \"total_cost\", \"expr\": \"isValid(datum.agg_total_cost) ? datum.agg_total_cost.value : 0\"}, {\"type\": \"formula\", \"as\": \"labor_cost\", \"expr\": \"isValid(datum.agg_labor_cost) ? datum.agg_labor_cost.value : 0\"}, {\"type\": \"formula\", \"as\": \"hw_cost\", \"expr\": \"isValid(datum.agg_hw_cost) ? datum.agg_hw_cost.value : 0\"}, {\"type\": \"formula\", \"as\": \"lic_cost\", \"expr\": \"isValid(datum.agg_lic_cost) ? datum.agg_lic_cost.value : 0\"}, {\"type\": \"formula\", \"as\": \"asset_count\", \"expr\": \"isValid(datum.agg_asset_count) ? datum.agg_asset_count.value : 0\"}]}], \"signals\": [{\"name\": \"gap\", \"value\": 12}, {\"name\": \"topH\", \"value\": 124}, {\"name\": \"midH\", \"value\": 88}, {\"name\": \"midY\", \"update\": \"topH + gap\"}, {\"name\": \"cw\", \"update\": \"(width - gap * 2) / 3\"}, {\"name\": \"c2x\", \"update\": \"cw + gap\"}, {\"name\": \"c3x\", \"update\": \"(cw + gap) * 2\"}, {\"name\": \"div1x\", \"update\": \"width / 3\"}, {\"name\": \"div2x\", \"update\": \"width * 2 / 3\"}, {\"name\": \"r\", \"update\": \"length(data('cost_totals')) > 0 ? data('cost_totals')[0] : {total_cost:0,labor_hours:0,labor_cost:0,hw_cost:0,lic_cost:0,asset_count:0}\"}], \"marks\": [{\"type\": \"rect\", \"encode\": {\"enter\": {\"x\": {\"value\": 0}, \"y\": {\"value\": 0}, \"width\": {\"signal\": \"width\"}, \"height\": {\"signal\": \"topH\"}, \"fill\": {\"value\": \"#f8faff\"}, \"stroke\": {\"value\": \"#dbeafe\"}, \"strokeWidth\": {\"value\": 1.5}, \"cornerRadius\": {\"value\": 10}}}}, {\"type\": \"rect\", \"encode\": {\"enter\": {\"x\": {\"value\": 0}, \"y\": {\"value\": 0}, \"width\": {\"signal\": \"width\"}, \"height\": {\"value\": 4}, \"fill\": {\"value\": \"#3b82f6\"}, \"cornerRadiusTopLeft\": {\"value\": 10}, \"cornerRadiusTopRight\": {\"value\": 10}}}}, {\"type\": \"rule\", \"encode\": {\"enter\": {\"x\": {\"signal\": \"div1x\"}, \"y\": {\"value\": 18}, \"x2\": {\"signal\": \"div1x\"}, \"y2\": {\"signal\": \"topH - 18\"}, \"stroke\": {\"value\": \"#e2e8f0\"}, \"strokeWidth\": {\"value\": 1}}}}, {\"type\": \"rule\", \"encode\": {\"enter\": {\"x\": {\"signal\": \"div2x\"}, \"y\": {\"value\": 18}, \"x2\": {\"signal\": \"div2x\"}, \"y2\": {\"signal\": \"topH - 18\"}, \"stroke\": {\"value\": \"#e2e8f0\"}, \"strokeWidth\": {\"value\": 1}}}}, {\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"signal\": \"div1x / 2\"}, \"y\": {\"signal\": \"topH * 0.40\"}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"fontSize\": {\"value\": 38}, \"fontWeight\": {\"value\": \"bold\"}, \"fill\": {\"value\": \"#1d4ed8\"}, \"text\": {\"signal\": \"'$' + format(r.total_cost, ',.0f')\"}}}}, {\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"signal\": \"div1x / 2\"}, \"y\": {\"signal\": \"topH * 0.65\"}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"fontSize\": {\"value\": 12}, \"fill\": {\"value\": \"#64748b\"}, \"text\": {\"value\": \"Total Upgrade Cost\"}}}}, {\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"signal\": \"div1x / 2\"}, \"y\": {\"signal\": \"topH * 0.85\"}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"fontSize\": {\"value\": 10}, \"fill\": {\"value\": \"#94a3b8\"}, \"text\": {\"signal\": \"r.asset_count > 0 ? '$' + format(r.total_cost / r.asset_count, ',.0f') + ' per asset' : ''\"}}}}, {\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"signal\": \"div1x + (div2x - div1x) / 2\"}, \"y\": {\"signal\": \"topH * 0.40\"}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"fontSize\": {\"value\": 34}, \"fontWeight\": {\"value\": \"bold\"}, \"fill\": {\"value\": \"#047857\"}, \"text\": {\"signal\": \"format(r.labor_hours, ',.1f') + ' h'\"}}}}, {\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"signal\": \"div1x + (div2x - div1x) / 2\"}, \"y\": {\"signal\": \"topH * 0.65\"}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"fontSize\": {\"value\": 12}, \"fill\": {\"value\": \"#64748b\"}, \"text\": {\"value\": \"Total Labor Hours\"}}}}, {\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"signal\": \"div1x + (div2x - div1x) / 2\"}, \"y\": {\"signal\": \"topH * 0.85\"}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"fontSize\": {\"value\": 10}, \"fill\": {\"value\": \"#94a3b8\"}, \"text\": {\"signal\": \"r.asset_count > 0 ? format(r.labor_hours / r.asset_count, '.1f') + ' h per asset' : ''\"}}}}, {\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"signal\": \"div2x + (width - div2x) / 2\"}, \"y\": {\"signal\": \"topH * 0.40\"}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"fontSize\": {\"value\": 34}, \"fontWeight\": {\"value\": \"bold\"}, \"fill\": {\"value\": \"#7e22ce\"}, \"text\": {\"signal\": \"format(r.asset_count, ',')\"}}}}, {\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"signal\": \"div2x + (width - div2x) / 2\"}, \"y\": {\"signal\": \"topH * 0.65\"}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"fontSize\": {\"value\": 12}, \"fill\": {\"value\": \"#64748b\"}, \"text\": {\"value\": \"Assets Requiring Upgrade\"}}}}, {\"type\": \"rect\", \"encode\": {\"enter\": {\"x\": {\"value\": 0}, \"y\": {\"signal\": \"midY\"}, \"width\": {\"signal\": \"cw\"}, \"height\": {\"signal\": \"midH\"}, \"fill\": {\"value\": \"#eff6ff\"}, \"stroke\": {\"value\": \"#bfdbfe\"}, \"strokeWidth\": {\"value\": 1}, \"cornerRadius\": {\"value\": 8}}}}, {\"type\": \"rect\", \"encode\": {\"enter\": {\"x\": {\"value\": 0}, \"y\": {\"signal\": \"midY\"}, \"width\": {\"value\": 5}, \"height\": {\"signal\": \"midH\"}, \"fill\": {\"value\": \"#3b82f6\"}, \"cornerRadiusTopLeft\": {\"value\": 8}, \"cornerRadiusBottomLeft\": {\"value\": 8}}}}, {\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"signal\": \"cw / 2\"}, \"y\": {\"signal\": \"midY + midH * 0.34\"}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"fontSize\": {\"value\": 26}, \"fontWeight\": {\"value\": \"bold\"}, \"fill\": {\"value\": \"#1d4ed8\"}, \"text\": {\"signal\": \"'$' + format(r.labor_cost, ',.0f')\"}}}}, {\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"signal\": \"cw / 2\"}, \"y\": {\"signal\": \"midY + midH * 0.58\"}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"fontSize\": {\"value\": 11}, \"fill\": {\"value\": \"#374151\"}, \"text\": {\"value\": \"Labor Cost\"}}}}, {\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"signal\": \"cw / 2\"}, \"y\": {\"signal\": \"midY + midH * 0.78\"}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"fontSize\": {\"value\": 10}, \"fill\": {\"value\": \"#9ca3af\"}, \"text\": {\"signal\": \"r.total_cost > 0 ? format(r.labor_cost / r.total_cost * 100, '.0f') + '% of total' : ''\"}}}}, {\"type\": \"rect\", \"encode\": {\"enter\": {\"x\": {\"signal\": \"c2x\"}, \"y\": {\"signal\": \"midY\"}, \"width\": {\"signal\": \"cw\"}, \"height\": {\"signal\": \"midH\"}, \"fill\": {\"value\": \"#fff1f2\"}, \"stroke\": {\"value\": \"#fca5a5\"}, \"strokeWidth\": {\"value\": 1}, \"cornerRadius\": {\"value\": 8}}}}, {\"type\": \"rect\", \"encode\": {\"enter\": {\"x\": {\"signal\": \"c2x\"}, \"y\": {\"signal\": \"midY\"}, \"width\": {\"value\": 5}, \"height\": {\"signal\": \"midH\"}, \"fill\": {\"value\": \"#ef4444\"}, \"cornerRadiusTopLeft\": {\"value\": 8}, \"cornerRadiusBottomLeft\": {\"value\": 8}}}}, {\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"signal\": \"c2x + cw / 2\"}, \"y\": {\"signal\": \"midY + midH * 0.34\"}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"fontSize\": {\"value\": 26}, \"fontWeight\": {\"value\": \"bold\"}, \"fill\": {\"value\": \"#b91c1c\"}, \"text\": {\"signal\": \"'$' + format(r.hw_cost, ',.0f')\"}}}}, {\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"signal\": \"c2x + cw / 2\"}, \"y\": {\"signal\": \"midY + midH * 0.58\"}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"fontSize\": {\"value\": 11}, \"fill\": {\"value\": \"#374151\"}, \"text\": {\"value\": \"Hardware Cost\"}}}}, {\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"signal\": \"c2x + cw / 2\"}, \"y\": {\"signal\": \"midY + midH * 0.78\"}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"fontSize\": {\"value\": 10}, \"fill\": {\"value\": \"#9ca3af\"}, \"text\": {\"signal\": \"r.total_cost > 0 ? format(r.hw_cost / r.total_cost * 100, '.0f') + '% of total' : ''\"}}}}, {\"type\": \"rect\", \"encode\": {\"enter\": {\"x\": {\"signal\": \"c3x\"}, \"y\": {\"signal\": \"midY\"}, \"width\": {\"signal\": \"cw\"}, \"height\": {\"signal\": \"midH\"}, \"fill\": {\"value\": \"#fffbeb\"}, \"stroke\": {\"value\": \"#fcd34d\"}, \"strokeWidth\": {\"value\": 1}, \"cornerRadius\": {\"value\": 8}}}}, {\"type\": \"rect\", \"encode\": {\"enter\": {\"x\": {\"signal\": \"c3x\"}, \"y\": {\"signal\": \"midY\"}, \"width\": {\"value\": 5}, \"height\": {\"signal\": \"midH\"}, \"fill\": {\"value\": \"#f59e0b\"}, \"cornerRadiusTopLeft\": {\"value\": 8}, \"cornerRadiusBottomLeft\": {\"value\": 8}}}}, {\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"signal\": \"c3x + cw / 2\"}, \"y\": {\"signal\": \"midY + midH * 0.34\"}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"fontSize\": {\"value\": 26}, \"fontWeight\": {\"value\": \"bold\"}, \"fill\": {\"value\": \"#b45309\"}, \"text\": {\"signal\": \"'$' + format(r.lic_cost, ',.0f')\"}}}}, {\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"signal\": \"c3x + cw / 2\"}, \"y\": {\"signal\": \"midY + midH * 0.58\"}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"fontSize\": {\"value\": 11}, \"fill\": {\"value\": \"#374151\"}, \"text\": {\"value\": \"License / Software Cost\"}}}}, {\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"signal\": \"c3x + cw / 2\"}, \"y\": {\"signal\": \"midY + midH * 0.78\"}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"fontSize\": {\"value\": 10}, \"fill\": {\"value\": \"#9ca3af\"}, \"text\": {\"signal\": \"r.total_cost > 0 ? format(r.lic_cost / r.total_cost * 100, '.0f') + '% of total' : ''\"}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width / 2\"}, \"y\": {\"signal\": \"height / 2 - 8\"}, \"text\": {\"signal\": \"length(data('cost_totals')) === 0 ? 'NO DATA FOR CURRENT FILTERS / TIME RANGE' : ''\"}, \"fill\": {\"value\": \"#666666\"}, \"font\": {\"value\": \"monospace\"}, \"fontSize\": {\"value\": 11}, \"fontWeight\": {\"value\": \"bold\"}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"zindex\": {\"value\": 100}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width / 2\"}, \"y\": {\"signal\": \"height / 2 + 12\"}, \"text\": {\"signal\": \"length(data('cost_totals')) === 0 ? 'Adjust dashboard filters or expand the selected time range.' : ''\"}, \"fill\": {\"value\": \"#444444\"}, \"font\": {\"value\": \"monospace\"}, \"fontSize\": {\"value\": 9}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"zindex\": {\"value\": 100}}}}]}" + }, + "title": "", + "type": "vega", + "uiState": {} + } + }, + "gridData": { + "h": 13, + "i": "e96a3b6f-c862-4732-94f6-635d6e64c5d7", + "w": 48, + "x": 0, + "y": 2 + }, + "panelIndex": "e96a3b6f-c862-4732-94f6-635d6e64c5d7", + "type": "visualization" + }, + { + "embeddableConfig": { + "enhancements": { + "dynamicActions": { + "events": [ + { + "action": { + "config": { + "openInNewTab": false, + "useCurrentDateRange": true, + "useCurrentFilters": true + }, + "factoryId": "DASHBOARD_TO_DASHBOARD_DRILLDOWN", + "name": "Open Certificate Operations" + }, + "eventId": "939918a5-e238-5f2d-88ff-e2f67ab75598", + "triggers": [ + "FILTER_TRIGGER" + ] + } + ] + } + }, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "id": "", + "params": { + "spec": "{\"$schema\": \"https://vega.github.io/schema/vega/v5.json\", \"description\": \"PQC Upgrade Cost \\u2014 OS Category cost estimates ranked list. Reads pre-computed total_cost_usd per OS category from tychon-pqc-system-readiness*. Styled to match the main OS breakdown panel. No cost arithmetic in Vega.\", \"padding\": {\"top\": 0, \"bottom\": 0, \"left\": 0, \"right\": 0}, \"background\": \"#111111\", \"signals\": [{\"name\": \"sel\", \"value\": null, \"on\": [{\"events\": {\"type\": \"click\", \"markname\": \"bg\"}, \"update\": \"datum.os_category === sel ? null : datum.os_category\", \"force\": true}]}, {\"name\": \"_kf\", \"value\": null, \"on\": [{\"events\": {\"type\": \"click\", \"markname\": \"bg\"}, \"update\": \"datum.os_category === sel ? kibanaRemoveFilter({'match_phrase': {'quantum_readiness.cost_analysis.os_category': datum.os_category}}) : kibanaAddFilter({'match_phrase': {'quantum_readiness.cost_analysis.os_category': datum.os_category}})\", \"force\": true}]}], \"data\": [{\"name\": \"os_costs\", \"url\": {\"%context%\": true, \"%timefield%\": \"@timestamp\", \"index\": \"tychon-pqc-system-readiness*\", \"body\": {\"size\": 0, \"aggs\": {\"qa_only\": {\"filter\": {\"term\": {\"event.dataset\": \"quantum_assessment\"}}, \"aggs\": {\"categories\": {\"terms\": {\"field\": \"quantum_readiness.cost_analysis.os_category\", \"size\": 30, \"order\": {\"cost_sum\": \"desc\"}}, \"aggs\": {\"cost_sum\": {\"sum\": {\"field\": \"quantum_readiness.cost_analysis.os_total_cost_usd\"}}, \"hours_sum\": {\"sum\": {\"field\": \"quantum_readiness.cost_analysis.os_labor_hours\"}}, \"license_sum\": {\"sum\": {\"field\": \"quantum_readiness.cost_analysis.os_license_cost_usd\"}}, \"hw_sum\": {\"sum\": {\"field\": \"quantum_readiness.cost_analysis.os_hardware_cost_usd\"}}, \"tier_terms\": {\"terms\": {\"field\": \"quantum_readiness.cost_analysis.os_tier\", \"size\": 1}}}}}}}}}, \"format\": {\"property\": \"aggregations\"}, \"transform\": [{\"type\": \"formula\", \"as\": \"buckets\", \"expr\": \"isValid(datum.qa_only) && isValid(datum.qa_only.categories) ? datum.qa_only.categories.buckets : []\"}, {\"type\": \"flatten\", \"fields\": [\"buckets\"], \"as\": [\"item\"]}, {\"type\": \"filter\", \"expr\": \"isValid(datum.item) && isValid(datum.item.key)\"}, {\"type\": \"formula\", \"as\": \"os_category\", \"expr\": \"datum.item.key\"}, {\"type\": \"formula\", \"as\": \"total_cost\", \"expr\": \"isValid(datum.item.cost_sum) ? datum.item.cost_sum.value : 0\"}, {\"type\": \"formula\", \"as\": \"labor_hours\", \"expr\": \"isValid(datum.item.hours_sum) ? datum.item.hours_sum.value : 0\"}, {\"type\": \"formula\", \"as\": \"license_cost\", \"expr\": \"isValid(datum.item.license_sum) ? datum.item.license_sum.value : 0\"}, {\"type\": \"formula\", \"as\": \"hw_cost\", \"expr\": \"isValid(datum.item.hw_sum) ? datum.item.hw_sum.value : 0\"}, {\"type\": \"formula\", \"as\": \"tier\", \"expr\": \"isValid(datum.item.tier_terms) && datum.item.tier_terms.buckets.length > 0 ? datum.item.tier_terms.buckets[0].key : 'CLASSICAL'\"}, {\"type\": \"formula\", \"as\": \"clr\", \"expr\": \"datum.total_cost === 0 ? '#66bb6a' : datum.tier === 'LEGACY' ? '#ef5350' : datum.tier === 'CLASSICAL' ? '#ffa726' : '#448aff'\"}, {\"type\": \"formula\", \"as\": \"bgclr\", \"expr\": \"datum.total_cost === 0 ? '#66bb6a18' : datum.tier === 'LEGACY' ? '#ef535018' : datum.tier === 'CLASSICAL' ? '#ffa72618' : '#448aff18'\"}]}, {\"name\": \"mx\", \"source\": \"os_costs\", \"transform\": [{\"type\": \"aggregate\", \"ops\": [\"max\"], \"fields\": [\"total_cost\"], \"as\": [\"v\"]}]}], \"scales\": [{\"name\": \"yscale\", \"type\": \"band\", \"domain\": {\"data\": \"os_costs\", \"field\": \"os_category\", \"sort\": false}, \"range\": {\"step\": 72}, \"paddingInner\": 0, \"paddingOuter\": 0}], \"marks\": [{\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"value\": 16}, \"y\": {\"value\": 18}, \"text\": {\"value\": \"OS UPGRADE COST ESTIMATE\"}, \"fill\": {\"value\": \"#cccccc\"}, \"fontSize\": {\"value\": 10}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"letterSpacing\": {\"value\": 1.5}}}}, {\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"value\": 16}, \"y\": {\"value\": 38}, \"text\": {\"value\": \"TOTAL COST BY OS CATEGORY \\u2014 sorted by cost desc\"}, \"fill\": {\"value\": \"#555555\"}, \"fontSize\": {\"value\": 9}, \"font\": {\"value\": \"monospace\"}, \"letterSpacing\": {\"value\": 1}}}}, {\"type\": \"rule\", \"encode\": {\"enter\": {\"x\": {\"value\": 0}, \"x2\": {\"signal\": \"width\"}, \"y\": {\"value\": 48}, \"stroke\": {\"value\": \"#252525\"}, \"strokeWidth\": {\"value\": 1}}}}, {\"type\": \"rect\", \"name\": \"bg\", \"from\": {\"data\": \"os_costs\"}, \"encode\": {\"update\": {\"x\": {\"value\": 0}, \"y\": {\"scale\": \"yscale\", \"field\": \"os_category\", \"offset\": 48}, \"width\": {\"signal\": \"width\"}, \"height\": {\"value\": 66}, \"fill\": {\"signal\": \"datum.os_category === sel ? '#1c1c2e' : datum.total_cost === 0 ? '#121a12' : '#161622'\"}, \"cursor\": {\"value\": \"pointer\"}}}}, {\"type\": \"rect\", \"from\": {\"data\": \"os_costs\"}, \"encode\": {\"update\": {\"x\": {\"value\": 0}, \"y\": {\"scale\": \"yscale\", \"field\": \"os_category\", \"offset\": 48}, \"width\": {\"value\": 4}, \"height\": {\"value\": 66}, \"fill\": {\"field\": \"clr\"}}}}, {\"type\": \"rect\", \"from\": {\"data\": \"os_costs\"}, \"encode\": {\"update\": {\"x\": {\"value\": 4}, \"y\": {\"scale\": \"yscale\", \"field\": \"os_category\", \"offset\": 110}, \"width\": {\"signal\": \"length(data('mx')) > 0 && data('mx')[0].v > 0 ? max((datum.total_cost / data('mx')[0].v) * (width - 4), 0) : 0\"}, \"height\": {\"value\": 4}, \"fill\": {\"field\": \"clr\"}, \"opacity\": {\"value\": 0.35}}}}, {\"type\": \"rule\", \"from\": {\"data\": \"os_costs\"}, \"encode\": {\"update\": {\"x\": {\"value\": 0}, \"x2\": {\"signal\": \"width\"}, \"y\": {\"scale\": \"yscale\", \"field\": \"os_category\", \"offset\": 113}, \"stroke\": {\"value\": \"#222222\"}}}}, {\"type\": \"text\", \"from\": {\"data\": \"os_costs\"}, \"encode\": {\"update\": {\"x\": {\"value\": 18}, \"y\": {\"scale\": \"yscale\", \"field\": \"os_category\", \"offset\": 72}, \"text\": {\"field\": \"os_category\"}, \"limit\": {\"signal\": \"width * 0.58 - 18\"}, \"fill\": {\"value\": \"#e8e8e8\"}, \"fontSize\": {\"value\": 13}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}}}}, {\"type\": \"text\", \"from\": {\"data\": \"os_costs\"}, \"encode\": {\"update\": {\"x\": {\"value\": 18}, \"y\": {\"scale\": \"yscale\", \"field\": \"os_category\", \"offset\": 92}, \"text\": {\"signal\": \"format(datum.labor_hours, ',.1f') + ' labor hrs | $' + format(datum.license_cost, ',.0f') + ' license | $' + format(datum.hw_cost, ',.0f') + ' hardware'\"}, \"limit\": {\"signal\": \"width * 0.58 - 18\"}, \"fill\": {\"value\": \"#555555\"}, \"fontSize\": {\"value\": 10}, \"font\": {\"value\": \"monospace\"}}}}, {\"type\": \"rect\", \"from\": {\"data\": \"os_costs\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width * 0.62\"}, \"y\": {\"scale\": \"yscale\", \"field\": \"os_category\", \"offset\": 56}, \"width\": {\"value\": 82}, \"height\": {\"value\": 17}, \"cornerRadius\": {\"value\": 2}, \"fill\": {\"field\": \"bgclr\"}, \"stroke\": {\"field\": \"clr\"}, \"strokeWidth\": {\"value\": 1}}}}, {\"type\": \"text\", \"from\": {\"data\": \"os_costs\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width * 0.62 + 41\"}, \"y\": {\"scale\": \"yscale\", \"field\": \"os_category\", \"offset\": 68}, \"text\": {\"field\": \"tier\"}, \"fill\": {\"field\": \"clr\"}, \"fontSize\": {\"value\": 9}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"center\"}, \"letterSpacing\": {\"value\": 1}}}}, {\"type\": \"rect\", \"from\": {\"data\": \"os_costs\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width * 0.62\"}, \"y\": {\"scale\": \"yscale\", \"field\": \"os_category\", \"offset\": 79}, \"width\": {\"value\": 82}, \"height\": {\"value\": 17}, \"cornerRadius\": {\"value\": 2}, \"fill\": {\"value\": \"#1a1a1a\"}, \"stroke\": {\"value\": \"#333333\"}, \"strokeWidth\": {\"value\": 1}}}}, {\"type\": \"text\", \"from\": {\"data\": \"os_costs\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width * 0.62 + 41\"}, \"y\": {\"scale\": \"yscale\", \"field\": \"os_category\", \"offset\": 91}, \"text\": {\"signal\": \"datum.os_category === sel ? 'SELECTED' : ''\"}, \"fill\": {\"signal\": \"datum.os_category === sel ? datum.clr : '#448aff'\"}, \"fontSize\": {\"value\": 9}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"center\"}, \"letterSpacing\": {\"value\": 1}}}}, {\"type\": \"text\", \"from\": {\"data\": \"os_costs\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width - 10\"}, \"y\": {\"scale\": \"yscale\", \"field\": \"os_category\", \"offset\": 84}, \"text\": {\"signal\": \"datum.total_cost >= 1e6 ? '$' + format(datum.total_cost / 1e6, ',.2~f') + 'M' : datum.total_cost >= 1e3 ? '$' + format(datum.total_cost / 1e3, ',.1~f') + 'k' : '$' + format(datum.total_cost, ',')\"}, \"fill\": {\"signal\": \"datum.os_category === sel ? datum.clr : datum.total_cost > 0 ? '#dddddd' : '#66bb6a'\"}, \"fontSize\": {\"value\": 20}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"right\"}}}}, {\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"signal\": \"width / 2\"}, \"y\": {\"signal\": \"height - 8\"}, \"text\": {\"value\": \"\\u2191 highest cost at top\"}, \"fill\": {\"value\": \"#2a2a2a\"}, \"fontSize\": {\"value\": 9}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"center\"}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width / 2\"}, \"y\": {\"value\": 100}, \"text\": {\"signal\": \"length(data('os_costs')) === 0 ? 'NO OS UPGRADE COSTS IN SELECTED TIME RANGE' : ''\"}, \"fill\": {\"value\": \"#333333\"}, \"fontSize\": {\"value\": 11}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"center\"}, \"fontWeight\": {\"value\": \"bold\"}, \"letterSpacing\": {\"value\": 1.5}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width / 2\"}, \"y\": {\"value\": 122}, \"text\": {\"signal\": \"length(data('os_costs')) === 0 ? 'OS costs appear when scanned hosts run RHEL 7/8/9, CentOS, Windows 10/Server, Ubuntu, Debian,' : ''\"}, \"fill\": {\"value\": \"#2a2a2a\"}, \"fontSize\": {\"value\": 9}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"center\"}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width / 2\"}, \"y\": {\"value\": 136}, \"text\": {\"signal\": \"length(data('os_costs')) === 0 ? 'or any macOS below version 26 (Tahoe). Windows 11 and macOS 26 Tahoe are PQC targets.' : ''\"}, \"fill\": {\"value\": \"#2a2a2a\"}, \"fontSize\": {\"value\": 9}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"center\"}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width / 2\"}, \"y\": {\"signal\": \"height / 2 - 8\"}, \"text\": {\"signal\": \"length(data('os_costs')) === 0 ? 'NO DATA FOR CURRENT FILTERS / TIME RANGE' : ''\"}, \"fill\": {\"value\": \"#666666\"}, \"font\": {\"value\": \"monospace\"}, \"fontSize\": {\"value\": 11}, \"fontWeight\": {\"value\": \"bold\"}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"zindex\": {\"value\": 100}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width / 2\"}, \"y\": {\"signal\": \"height / 2 + 12\"}, \"text\": {\"signal\": \"length(data('os_costs')) === 0 ? 'Adjust dashboard filters or expand the selected time range.' : ''\"}, \"fill\": {\"value\": \"#444444\"}, \"font\": {\"value\": \"monospace\"}, \"fontSize\": {\"value\": 9}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"zindex\": {\"value\": 100}}}}]}" + }, + "title": "", + "type": "vega", + "uiState": {} + } + }, + "gridData": { + "h": 43, + "i": "499d6919-5d84-47bf-8bff-653bbd5d0ecd", + "w": 17, + "x": 0, + "y": 15 + }, + "panelIndex": "499d6919-5d84-47bf-8bff-653bbd5d0ecd", + "type": "visualization" + }, + { + "embeddableConfig": { + "enhancements": { + "dynamicActions": { + "events": [ + { + "action": { + "config": { + "openInNewTab": false, + "useCurrentDateRange": true, + "useCurrentFilters": true + }, + "factoryId": "DASHBOARD_TO_DASHBOARD_DRILLDOWN", + "name": "Open Application Report" + }, + "eventId": "3a5225f5-247d-560e-b33f-876471396e3f", + "triggers": [ + "FILTER_TRIGGER" + ] + } + ] + } + }, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "id": "", + "params": { + "spec": "{\"$schema\": \"https://vega.github.io/schema/vega/v5.json\", \"description\": \"PQC Upgrade Cost \\u2014 Effort vs. Risk Bubble Chart. X=total_cost_usd, Y=tier, bubble size=count. Reads pre-computed values from tychon-pqc-system-readiness* using new row schema.\", \"autosize\": {\"type\": \"fit\", \"contains\": \"padding\"}, \"padding\": {\"left\": 90, \"right\": 40, \"top\": 40, \"bottom\": 60}, \"data\": [{\"name\": \"os_raw\", \"url\": {\"%context%\": true, \"%timefield%\": \"@timestamp\", \"index\": \"tychon-pqc-system-readiness*\", \"body\": {\"size\": 0, \"aggs\": {\"qa_only\": {\"filter\": {\"term\": {\"event.dataset\": \"quantum_assessment\"}}, \"aggs\": {\"categories\": {\"terms\": {\"field\": \"quantum_readiness.cost_analysis.os_category\", \"size\": 30}, \"aggs\": {\"cost_sum\": {\"sum\": {\"field\": \"quantum_readiness.cost_analysis.os_total_cost_usd\"}}, \"tier_terms\": {\"terms\": {\"field\": \"quantum_readiness.cost_analysis.os_tier\", \"size\": 1}}}}}}}}}, \"format\": {\"property\": \"aggregations\"}, \"transform\": [{\"type\": \"formula\", \"as\": \"buckets\", \"expr\": \"isValid(datum.qa_only) && isValid(datum.qa_only.categories) ? datum.qa_only.categories.buckets : []\"}, {\"type\": \"flatten\", \"fields\": [\"buckets\"], \"as\": [\"item\"]}, {\"type\": \"filter\", \"expr\": \"isValid(datum.item) && isValid(datum.item.key)\"}, {\"type\": \"formula\", \"as\": \"label\", \"expr\": \"datum.item.key\"}, {\"type\": \"formula\", \"as\": \"cost\", \"expr\": \"isValid(datum.item.cost_sum) ? datum.item.cost_sum.value : 0\"}, {\"type\": \"formula\", \"as\": \"count\", \"expr\": \"datum.item.doc_count > 0 ? datum.item.doc_count : 1\"}, {\"type\": \"formula\", \"as\": \"tier\", \"expr\": \"isValid(datum.item.tier_terms) && datum.item.tier_terms.buckets.length > 0 ? datum.item.tier_terms.buckets[0].key : 'CLASSICAL'\"}, {\"type\": \"formula\", \"as\": \"source\", \"expr\": \"'OS Upgrade'\"}]}, {\"name\": \"app_raw\", \"url\": {\"%context%\": true, \"%timefield%\": \"@timestamp\", \"index\": \"tychon-pqc-system-readiness*\", \"body\": {\"size\": 0, \"aggs\": {\"app_only\": {\"filter\": {\"term\": {\"event.dataset\": \"quantum_assessment.app_group\"}}, \"aggs\": {\"families\": {\"terms\": {\"field\": \"quantum_readiness.cost_analysis.app_family\", \"size\": 20}, \"aggs\": {\"cost_sum\": {\"sum\": {\"field\": \"quantum_readiness.cost_analysis.total_cost_usd\"}}, \"instances_sum\": {\"sum\": {\"field\": \"quantum_readiness.cost_analysis.instance_count\"}}, \"tier_terms\": {\"terms\": {\"field\": \"quantum_readiness.cost_analysis.tier\", \"size\": 1}}}}}}}}}, \"format\": {\"property\": \"aggregations\"}, \"transform\": [{\"type\": \"formula\", \"as\": \"buckets\", \"expr\": \"isValid(datum.app_only) && isValid(datum.app_only.families) ? datum.app_only.families.buckets : []\"}, {\"type\": \"flatten\", \"fields\": [\"buckets\"], \"as\": [\"item\"]}, {\"type\": \"filter\", \"expr\": \"isValid(datum.item) && isValid(datum.item.key)\"}, {\"type\": \"formula\", \"as\": \"label\", \"expr\": \"datum.item.key\"}, {\"type\": \"formula\", \"as\": \"cost\", \"expr\": \"isValid(datum.item.cost_sum) ? datum.item.cost_sum.value : 0\"}, {\"type\": \"formula\", \"as\": \"count\", \"expr\": \"isValid(datum.item.instances_sum) && datum.item.instances_sum.value > 0 ? datum.item.instances_sum.value : 1\"}, {\"type\": \"formula\", \"as\": \"tier\", \"expr\": \"isValid(datum.item.tier_terms) && datum.item.tier_terms.buckets.length > 0 ? datum.item.tier_terms.buckets[0].key : 'CLASSICAL'\"}, {\"type\": \"formula\", \"as\": \"source\", \"expr\": \"'App Upgrade'\"}]}, {\"name\": \"all_items\", \"source\": [\"os_raw\", \"app_raw\"], \"transform\": [{\"type\": \"filter\", \"expr\": \"isFinite(datum.cost) && datum.cost > 0\"}]}], \"scales\": [{\"name\": \"xscale\", \"type\": \"linear\", \"domain\": {\"data\": \"all_items\", \"field\": \"cost\"}, \"range\": \"width\", \"nice\": true, \"zero\": true}, {\"name\": \"yscale\", \"type\": \"point\", \"domain\": [\"LEGACY\", \"CLASSICAL\"], \"range\": [80, 260], \"padding\": 0.5}, {\"name\": \"sizescale\", \"type\": \"sqrt\", \"domain\": {\"data\": \"all_items\", \"field\": \"count\"}, \"range\": [200, 3000], \"zero\": true}, {\"name\": \"colorscale\", \"type\": \"ordinal\", \"domain\": [\"OS Upgrade\", \"App Upgrade\"], \"range\": [\"#ef5350\", \"#3b82f6\"]}], \"axes\": [{\"orient\": \"bottom\", \"scale\": \"xscale\", \"format\": \"$,.0f\", \"title\": \"Total Upgrade Cost (USD)\", \"titleFontSize\": 12, \"labelAngle\": -30}, {\"orient\": \"left\", \"scale\": \"yscale\", \"title\": \"Risk Tier\", \"titleFontSize\": 12}], \"legends\": [{\"fill\": \"colorscale\", \"title\": \"Category\", \"symbolType\": \"circle\", \"orient\": \"top-right\"}], \"marks\": [{\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"value\": 60}, \"y\": {\"scale\": \"yscale\", \"value\": \"CLASSICAL\", \"offset\": 40}, \"text\": {\"value\": \"Quick Wins\"}, \"fontSize\": {\"value\": 11}, \"fill\": {\"value\": \"#d1d5db\"}, \"fontStyle\": {\"value\": \"italic\"}}}}, {\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"signal\": \"width - 100\"}, \"y\": {\"scale\": \"yscale\", \"value\": \"LEGACY\", \"offset\": -20}, \"text\": {\"value\": \"Plan Carefully\"}, \"fontSize\": {\"value\": 11}, \"fill\": {\"value\": \"#d1d5db\"}, \"fontStyle\": {\"value\": \"italic\"}}}}, {\"type\": \"symbol\", \"from\": {\"data\": \"all_items\"}, \"encode\": {\"enter\": {\"x\": {\"scale\": \"xscale\", \"field\": \"cost\"}, \"y\": {\"scale\": \"yscale\", \"field\": \"tier\"}, \"size\": {\"scale\": \"sizescale\", \"field\": \"count\"}, \"fill\": {\"scale\": \"colorscale\", \"field\": \"source\"}, \"fillOpacity\": {\"value\": 0.65}, \"stroke\": {\"scale\": \"colorscale\", \"field\": \"source\"}, \"strokeWidth\": {\"value\": 1.5}, \"tooltip\": {\"signal\": \"{'Label': datum.label, 'Tier': datum.tier, 'Category': datum.source, 'Total Cost': '$' + format(datum.cost, ',.0f'), 'Count': datum.count}\"}}}}, {\"type\": \"text\", \"from\": {\"data\": \"all_items\"}, \"encode\": {\"enter\": {\"x\": {\"scale\": \"xscale\", \"field\": \"cost\"}, \"y\": {\"scale\": \"yscale\", \"field\": \"tier\", \"offset\": -16}, \"align\": {\"value\": \"center\"}, \"fontSize\": {\"value\": 10}, \"fill\": {\"value\": \"#374151\"}, \"text\": {\"field\": \"label\"}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width / 2\"}, \"y\": {\"signal\": \"height / 2 - 8\"}, \"text\": {\"signal\": \"length(data('os_raw')) === 0 ? 'NO DATA FOR CURRENT FILTERS / TIME RANGE' : ''\"}, \"fill\": {\"value\": \"#666666\"}, \"font\": {\"value\": \"monospace\"}, \"fontSize\": {\"value\": 11}, \"fontWeight\": {\"value\": \"bold\"}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"zindex\": {\"value\": 100}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width / 2\"}, \"y\": {\"signal\": \"height / 2 + 12\"}, \"text\": {\"signal\": \"length(data('os_raw')) === 0 ? 'Adjust dashboard filters or expand the selected time range.' : ''\"}, \"fill\": {\"value\": \"#444444\"}, \"font\": {\"value\": \"monospace\"}, \"fontSize\": {\"value\": 9}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"zindex\": {\"value\": 100}}}}]}" + }, + "title": "", + "type": "vega", + "uiState": {} + } + }, + "gridData": { + "h": 23, + "i": "53bd2970-764a-498b-9632-f3e37a82d528", + "w": 31, + "x": 17, + "y": 15 + }, + "panelIndex": "53bd2970-764a-498b-9632-f3e37a82d528", + "type": "visualization" + }, + { + "embeddableConfig": { + "enhancements": { + "dynamicActions": { + "events": [ + { + "action": { + "config": { + "openInNewTab": false, + "useCurrentDateRange": true, + "useCurrentFilters": true + }, + "factoryId": "DASHBOARD_TO_DASHBOARD_DRILLDOWN", + "name": "Open Application Connections Topology" + }, + "eventId": "702a251d-4e87-5dbc-8cf6-25f5098c4de7", + "triggers": [ + "FILTER_TRIGGER" + ] + } + ] + } + }, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "id": "", + "params": { + "spec": "{\"$schema\": \"https://vega.github.io/schema/vega/v5.json\", \"description\": \"PQC Cost Composition by App Family (compact). Stacked bars: labor + license + hardware.\", \"autosize\": {\"type\": \"fit\", \"contains\": \"padding\"}, \"padding\": {\"left\": 110, \"right\": 18, \"top\": 34, \"bottom\": 38}, \"background\": \"#111111\", \"signals\": [{\"name\": \"chartTitle\", \"value\": \"PQC COST COMPOSITION BY APP FAMILY\"}, {\"name\": \"topN\", \"value\": 10}], \"data\": [{\"name\": \"raw_all\", \"url\": {\"%context%\": true, \"%timefield%\": \"@timestamp\", \"index\": \"tychon-pqc-system-readiness*\", \"body\": {\"size\": 0, \"aggs\": {\"app_only\": {\"filter\": {\"term\": {\"event.dataset\": \"quantum_assessment.app_group\"}}, \"aggs\": {\"families\": {\"terms\": {\"field\": \"quantum_readiness.cost_analysis.app_family\", \"size\": 30, \"order\": {\"total_cost\": \"desc\"}}, \"aggs\": {\"labor_cost\": {\"sum\": {\"field\": \"quantum_readiness.cost_analysis.labor_cost_usd\"}}, \"license_cost\": {\"sum\": {\"field\": \"quantum_readiness.cost_analysis.license_cost_usd\"}}, \"hardware_cost\": {\"sum\": {\"field\": \"quantum_readiness.cost_analysis.hardware_cost_usd\"}}, \"total_cost\": {\"sum\": {\"field\": \"quantum_readiness.cost_analysis.total_cost_usd\"}}, \"instances\": {\"sum\": {\"field\": \"quantum_readiness.cost_analysis.instance_count\"}}, \"tier_terms\": {\"terms\": {\"field\": \"quantum_readiness.cost_analysis.tier\", \"size\": 1}}}}}}}}}, \"format\": {\"property\": \"aggregations.app_only.families.buckets\"}, \"transform\": [{\"type\": \"filter\", \"expr\": \"datum && datum.key\"}, {\"type\": \"formula\", \"as\": \"app_family\", \"expr\": \"datum.key\"}, {\"type\": \"formula\", \"as\": \"app_family_short\", \"expr\": \"length(datum.key) > 14 ? substring(datum.key,0,11) + '...' : datum.key\"}, {\"type\": \"formula\", \"as\": \"labor\", \"expr\": \"isValid(datum.labor_cost) ? datum.labor_cost.value : 0\"}, {\"type\": \"formula\", \"as\": \"license\", \"expr\": \"isValid(datum.license_cost) ? datum.license_cost.value : 0\"}, {\"type\": \"formula\", \"as\": \"hardware\", \"expr\": \"isValid(datum.hardware_cost) ? datum.hardware_cost.value : 0\"}, {\"type\": \"formula\", \"as\": \"total\", \"expr\": \"isValid(datum.total_cost) ? datum.total_cost.value : 0\"}, {\"type\": \"formula\", \"as\": \"instances\", \"expr\": \"isValid(datum.instances) ? datum.instances.value : 0\"}, {\"type\": \"formula\", \"as\": \"tier\", \"expr\": \"isValid(datum.tier_terms) && datum.tier_terms.buckets.length > 0 ? datum.tier_terms.buckets[0].key : 'CLASSICAL'\"}, {\"type\": \"filter\", \"expr\": \"isFinite(datum.total) && datum.total > 0\"}, {\"type\": \"collect\", \"sort\": {\"field\": \"total\", \"order\": \"descending\"}}, {\"type\": \"window\", \"ops\": [\"row_number\"], \"as\": [\"rank\"]}, {\"type\": \"filter\", \"expr\": \"datum.rank <= topN\"}]}, {\"name\": \"components\", \"source\": \"raw_all\", \"transform\": [{\"type\": \"fold\", \"fields\": [\"labor\", \"license\", \"hardware\"], \"as\": [\"component\", \"value\"]}, {\"type\": \"stack\", \"groupby\": [\"app_family_short\"], \"sort\": {\"field\": \"component\"}, \"field\": \"value\", \"as\": [\"x0\", \"x1\"]}]}], \"scales\": [{\"name\": \"yscale\", \"type\": \"band\", \"domain\": {\"data\": \"raw_all\", \"field\": \"app_family_short\"}, \"range\": \"height\", \"paddingInner\": 0.18, \"paddingOuter\": 0.06}, {\"name\": \"xscale\", \"type\": \"linear\", \"domain\": {\"data\": \"raw_all\", \"field\": \"total\"}, \"nice\": true, \"zero\": true, \"range\": \"width\"}, {\"name\": \"cscale\", \"type\": \"ordinal\", \"domain\": [\"labor\", \"license\", \"hardware\"], \"range\": [\"#f59e0b\", \"#3b82f6\", \"#ef4444\"]}], \"axes\": [{\"orient\": \"left\", \"scale\": \"yscale\", \"labelLimit\": 96, \"labelColor\": \"#d1d5db\", \"tickColor\": \"#333333\", \"domainColor\": \"#333333\", \"title\": \"\", \"zindex\": 1}, {\"orient\": \"bottom\", \"scale\": \"xscale\", \"format\": \"$,.2s\", \"title\": \"Total Cost (USD)\", \"titleColor\": \"#9ca3af\", \"labelColor\": \"#9ca3af\", \"tickColor\": \"#333333\", \"domainColor\": \"#333333\"}], \"legends\": [{\"fill\": \"cscale\", \"title\": \"Cost Component\", \"orient\": \"top-right\", \"titleColor\": \"#d1d5db\", \"labelColor\": \"#9ca3af\"}], \"marks\": [{\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"value\": 0}, \"y\": {\"value\": -10}, \"text\": {\"signal\": \"chartTitle + ' (TOP ' + topN + ')'\"}, \"fill\": {\"value\": \"#d1d5db\"}, \"font\": {\"value\": \"monospace\"}, \"fontSize\": {\"value\": 10}, \"fontWeight\": {\"value\": \"bold\"}, \"letterSpacing\": {\"value\": 0.8}}}}, {\"type\": \"rect\", \"from\": {\"data\": \"components\"}, \"encode\": {\"enter\": {\"y\": {\"scale\": \"yscale\", \"field\": \"app_family_short\"}, \"height\": {\"scale\": \"yscale\", \"band\": 1}, \"x\": {\"scale\": \"xscale\", \"field\": \"x0\"}, \"x2\": {\"scale\": \"xscale\", \"field\": \"x1\"}, \"fill\": {\"scale\": \"cscale\", \"field\": \"component\"}, \"stroke\": {\"value\": \"#0f0f0f\"}, \"strokeWidth\": {\"value\": 0.6}, \"tooltip\": {\"signal\": \"{'App Family': datum.app_family, 'Tier': datum.tier, 'Component': datum.component, 'Component Cost': '$' + format(datum.value, ',.0f'), 'Total Cost': '$' + format(datum.total, ',.0f'), 'Instances': datum.instances}\"}}}}, {\"type\": \"text\", \"from\": {\"data\": \"raw_all\"}, \"encode\": {\"enter\": {\"x\": {\"scale\": \"xscale\", \"field\": \"total\", \"offset\": 4}, \"y\": {\"scale\": \"yscale\", \"field\": \"app_family_short\", \"band\": 0.5}, \"text\": {\"signal\": \"'$' + format(datum.total, ',.2s')\"}, \"fill\": {\"value\": \"#e5e7eb\"}, \"fontSize\": {\"value\": 9}, \"align\": {\"value\": \"left\"}, \"baseline\": {\"value\": \"middle\"}}}}, {\"type\": \"text\", \"from\": {\"data\": \"raw_all\"}, \"encode\": {\"enter\": {\"x\": {\"value\": -4}, \"y\": {\"scale\": \"yscale\", \"field\": \"app_family_short\", \"band\": 0.5}, \"text\": {\"signal\": \"datum.instances > 0 ? '(' + format(datum.instances, ',.0f') + ')' : ''\"}, \"fill\": {\"value\": \"#6b7280\"}, \"fontSize\": {\"value\": 8}, \"align\": {\"value\": \"right\"}, \"baseline\": {\"value\": \"middle\"}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width / 2\"}, \"y\": {\"signal\": \"height / 2 - 8\"}, \"text\": {\"signal\": \"length(data('raw_all')) === 0 ? 'NO DATA FOR CURRENT FILTERS / TIME RANGE' : ''\"}, \"fill\": {\"value\": \"#666666\"}, \"font\": {\"value\": \"monospace\"}, \"fontSize\": {\"value\": 11}, \"fontWeight\": {\"value\": \"bold\"}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"zindex\": {\"value\": 100}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width / 2\"}, \"y\": {\"signal\": \"height / 2 + 12\"}, \"text\": {\"signal\": \"length(data('raw_all')) === 0 ? 'Adjust dashboard filters or expand the selected time range.' : ''\"}, \"fill\": {\"value\": \"#444444\"}, \"font\": {\"value\": \"monospace\"}, \"fontSize\": {\"value\": 9}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"zindex\": {\"value\": 100}}}}]}" + }, + "title": "", + "type": "vega", + "uiState": {} + } + }, + "gridData": { + "h": 20, + "i": "3b9211b0-164b-495c-b3b6-479193fe6c1e", + "w": 15, + "x": 17, + "y": 38 + }, + "panelIndex": "3b9211b0-164b-495c-b3b6-479193fe6c1e", + "type": "visualization" + }, + { + "embeddableConfig": { + "enhancements": { + "dynamicActions": { + "events": [ + { + "action": { + "config": { + "openInNewTab": false, + "useCurrentDateRange": true, + "useCurrentFilters": true + }, + "factoryId": "DASHBOARD_TO_DASHBOARD_DRILLDOWN", + "name": "Open Inventory" + }, + "eventId": "26ab7837-9182-5ae8-9186-6a46abbd5428", + "triggers": [ + "FILTER_TRIGGER" + ] + } + ] + } + }, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "id": "", + "params": { + "spec": "{\"$schema\": \"https://vega.github.io/schema/vega/v5.json\", \"description\": \"PQC Priority Matrix \\u2014 Tier x App Family heatmap. Responsive, compact layout.\", \"autosize\": {\"type\": \"fit\", \"contains\": \"padding\"}, \"padding\": {\"left\": 92, \"right\": 16, \"top\": 34, \"bottom\": 46}, \"background\": \"#111111\", \"signals\": [{\"name\": \"topN\", \"value\": 10}, {\"name\": \"showCellText\", \"update\": \"bandwidth('yscale') >= 18 && bandwidth('xscale') >= 64\"}], \"data\": [{\"name\": \"matrix_raw\", \"url\": {\"%context%\": true, \"%timefield%\": \"@timestamp\", \"index\": \"tychon-pqc-system-readiness*\", \"body\": {\"size\": 0, \"aggs\": {\"app_only\": {\"filter\": {\"term\": {\"event.dataset\": \"quantum_assessment.app_group\"}}, \"aggs\": {\"families\": {\"terms\": {\"field\": \"quantum_readiness.cost_analysis.app_family\", \"size\": 40}, \"aggs\": {\"tiers\": {\"terms\": {\"field\": \"quantum_readiness.cost_analysis.tier\", \"size\": 5}, \"aggs\": {\"cost_sum\": {\"sum\": {\"field\": \"quantum_readiness.cost_analysis.total_cost_usd\"}}, \"instances_sum\": {\"sum\": {\"field\": \"quantum_readiness.cost_analysis.instance_count\"}}}}}}}}}}}, \"format\": {\"property\": \"aggregations.app_only.families.buckets\"}, \"transform\": [{\"type\": \"filter\", \"expr\": \"datum && datum.key && datum.tiers && datum.tiers.buckets\"}, {\"type\": \"formula\", \"as\": \"app_family\", \"expr\": \"datum.key\"}, {\"type\": \"flatten\", \"fields\": [\"tiers.buckets\"], \"as\": [\"tier_bucket\"]}, {\"type\": \"filter\", \"expr\": \"datum.tier_bucket && datum.tier_bucket.key\"}, {\"type\": \"formula\", \"as\": \"tier\", \"expr\": \"datum.tier_bucket.key\"}, {\"type\": \"formula\", \"as\": \"cost\", \"expr\": \"isValid(datum.tier_bucket.cost_sum) ? datum.tier_bucket.cost_sum.value : 0\"}, {\"type\": \"formula\", \"as\": \"instances\", \"expr\": \"isValid(datum.tier_bucket.instances_sum) ? datum.tier_bucket.instances_sum.value : 0\"}, {\"type\": \"filter\", \"expr\": \"isFinite(datum.cost) && datum.cost >= 0\"}]}, {\"name\": \"family_order\", \"source\": \"matrix_raw\", \"transform\": [{\"type\": \"aggregate\", \"groupby\": [\"app_family\"], \"ops\": [\"sum\"], \"fields\": [\"cost\"], \"as\": [\"family_total_cost\"]}, {\"type\": \"collect\", \"sort\": {\"field\": \"family_total_cost\", \"order\": \"descending\"}}, {\"type\": \"window\", \"ops\": [\"row_number\"], \"as\": [\"rank\"]}, {\"type\": \"filter\", \"expr\": \"datum.rank <= topN\"}, {\"type\": \"formula\", \"as\": \"app_family_short\", \"expr\": \"length(datum.app_family) > 14 ? substring(datum.app_family,0,11) + '...' : datum.app_family\"}]}, {\"name\": \"matrix\", \"source\": \"matrix_raw\", \"transform\": [{\"type\": \"lookup\", \"from\": \"family_order\", \"key\": \"app_family\", \"fields\": [\"app_family\"], \"values\": [\"rank\", \"app_family_short\", \"family_total_cost\"], \"as\": [\"rank\", \"app_family_short\", \"family_total_cost\"]}, {\"type\": \"filter\", \"expr\": \"isValid(datum.rank)\"}]}], \"scales\": [{\"name\": \"xscale\", \"type\": \"band\", \"domain\": [\"LEGACY\", \"CLASSICAL\"], \"range\": \"width\", \"paddingInner\": 0.08, \"paddingOuter\": 0.03}, {\"name\": \"yscale\", \"type\": \"band\", \"domain\": {\"data\": \"family_order\", \"field\": \"app_family_short\"}, \"range\": \"height\", \"paddingInner\": 0.08, \"paddingOuter\": 0.03}, {\"name\": \"cscale\", \"type\": \"linear\", \"domain\": {\"data\": \"matrix\", \"field\": \"cost\"}, \"range\": [\"#1f2937\", \"#2563eb\", \"#7c3aed\", \"#dc2626\"], \"nice\": true, \"zero\": true}], \"axes\": [{\"orient\": \"bottom\", \"scale\": \"xscale\", \"title\": \"Tier\", \"titleColor\": \"#d1d5db\", \"labelColor\": \"#d1d5db\", \"tickColor\": \"#333333\", \"domainColor\": \"#333333\"}, {\"orient\": \"left\", \"scale\": \"yscale\", \"title\": \"\", \"labelColor\": \"#d1d5db\", \"labelLimit\": 86, \"tickColor\": \"#333333\", \"domainColor\": \"#333333\"}], \"legends\": [{\"fill\": \"cscale\", \"title\": \"Cost\", \"orient\": \"right\", \"titleColor\": \"#d1d5db\", \"labelColor\": \"#9ca3af\", \"format\": \"$,.2s\"}], \"marks\": [{\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"value\": 0}, \"y\": {\"value\": -12}, \"text\": {\"value\": \"PRIORITY MATRIX (TOP APP FAMILIES)\"}, \"fill\": {\"value\": \"#d1d5db\"}, \"font\": {\"value\": \"monospace\"}, \"fontSize\": {\"value\": 10}, \"fontWeight\": {\"value\": \"bold\"}, \"letterSpacing\": {\"value\": 0.8}}}}, {\"type\": \"rect\", \"from\": {\"data\": \"matrix\"}, \"encode\": {\"enter\": {\"x\": {\"scale\": \"xscale\", \"field\": \"tier\"}, \"y\": {\"scale\": \"yscale\", \"field\": \"app_family_short\"}, \"width\": {\"scale\": \"xscale\", \"band\": 1}, \"height\": {\"scale\": \"yscale\", \"band\": 1}, \"fill\": {\"scale\": \"cscale\", \"field\": \"cost\"}, \"stroke\": {\"value\": \"#1a1a1a\"}, \"strokeWidth\": {\"value\": 1}, \"tooltip\": {\"signal\": \"{'App Family': datum.app_family, 'Tier': datum.tier, 'Total Cost': '$' + format(datum.cost, ',.0f'), 'Instances': format(datum.instances, ',.0f')}\"}}}}, {\"type\": \"text\", \"from\": {\"data\": \"matrix\"}, \"encode\": {\"enter\": {\"x\": {\"scale\": \"xscale\", \"field\": \"tier\", \"band\": 0.5}, \"y\": {\"scale\": \"yscale\", \"field\": \"app_family_short\", \"band\": 0.5}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"fontSize\": {\"value\": 9}, \"fontWeight\": {\"value\": \"bold\"}, \"fill\": {\"value\": \"#f9fafb\"}, \"text\": {\"signal\": \"showCellText && datum.instances > 0 ? format(datum.instances, ',.0f') : ''\"}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width / 2\"}, \"y\": {\"signal\": \"height / 2 - 8\"}, \"text\": {\"signal\": \"length(data('matrix_raw')) === 0 ? 'NO DATA FOR CURRENT FILTERS / TIME RANGE' : ''\"}, \"fill\": {\"value\": \"#666666\"}, \"font\": {\"value\": \"monospace\"}, \"fontSize\": {\"value\": 11}, \"fontWeight\": {\"value\": \"bold\"}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"zindex\": {\"value\": 100}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width / 2\"}, \"y\": {\"signal\": \"height / 2 + 12\"}, \"text\": {\"signal\": \"length(data('matrix_raw')) === 0 ? 'Adjust dashboard filters or expand the selected time range.' : ''\"}, \"fill\": {\"value\": \"#444444\"}, \"font\": {\"value\": \"monospace\"}, \"fontSize\": {\"value\": 9}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"zindex\": {\"value\": 100}}}}]}" + }, + "title": "", + "type": "vega", + "uiState": {} + } + }, + "gridData": { + "h": 20, + "i": "279b7812-2cf0-43a2-8c2f-410ab21ba53d", + "w": 16, + "x": 32, + "y": 38 + }, + "panelIndex": "279b7812-2cf0-43a2-8c2f-410ab21ba53d", + "type": "visualization" + } + ], + "refreshInterval": { + "pause": true, + "value": 60000 + }, + "timeFrom": "now-24h/h", + "timeRestore": true, + "timeTo": "now", + "title": "[TYCHON Quantum Command] Cost Analysis", + "version": 3 + }, + "coreMigrationVersion": "8.8.0", + "created_at": "2026-07-20T16:55:14.701Z", + "id": "tychon_quantum_command-02366033-dee4-4ea4-8458-7c8a8b58987e-cost-analysis", + "references": [ + { + "id": "tychon_quantum_command-32c01eb5-0d80-4a28-9de7-55b2046f7c45-inventory", + "name": "279b7812-2cf0-43a2-8c2f-410ab21ba53d:drilldown:DASHBOARD_TO_DASHBOARD_DRILLDOWN:26ab7837-9182-5ae8-9186-6a46abbd5428:dashboardId", + "type": "dashboard" + }, + { + "id": "tychon_quantum_command-6f3d60d5-b5fb-45a5-9298-acf3ceb3ea1b-application-connections-topology", + "name": "3b9211b0-164b-495c-b3b6-479193fe6c1e:drilldown:DASHBOARD_TO_DASHBOARD_DRILLDOWN:702a251d-4e87-5dbc-8cf6-25f5098c4de7:dashboardId", + "type": "dashboard" + }, + { + "id": "tychon_quantum_command-d0159137-9139-4a93-85bb-2ac9ddab3982-certificate-operations-dashboard", + "name": "499d6919-5d84-47bf-8bff-653bbd5d0ecd:drilldown:DASHBOARD_TO_DASHBOARD_DRILLDOWN:939918a5-e238-5f2d-88ff-e2f67ab75598:dashboardId", + "type": "dashboard" + }, + { + "id": "tychon_quantum_command-443e5928-b1c4-4e07-b0b9-c675dd057e2f-application-report", + "name": "53bd2970-764a-498b-9632-f3e37a82d528:drilldown:DASHBOARD_TO_DASHBOARD_DRILLDOWN:3a5225f5-247d-560e-b33f-876471396e3f:dashboardId", + "type": "dashboard" + }, + { + "id": "tychon_quantum_command-32c01eb5-0d80-4a28-9de7-55b2046f7c45-inventory", + "name": "e96a3b6f-c862-4732-94f6-635d6e64c5d7:drilldown:DASHBOARD_TO_DASHBOARD_DRILLDOWN:39e70128-521d-50c8-913c-d745903e2b64:dashboardId", + "type": "dashboard" + }, + { + "id": "tychon_quantum_command-e9b715ba-5f19-4f99-b837-2c1a24143212", + "name": "tag-ref-tychon_quantum_command-e9b715ba-5f19-4f99-b837-2c1a24143212", + "type": "tag" + }, + { + "id": "tychon_quantum_command-07b6a21f-5bba-413b-8d49-e8c246dde2ba", + "name": "tag-ref-tychon_quantum_command-07b6a21f-5bba-413b-8d49-e8c246dde2ba", + "type": "tag" + }, + { + "id": "tychon_quantum_command-dacb217e-57b4-4296-8545-cbf6b5739344", + "name": "tag-ref-tychon_quantum_command-dacb217e-57b4-4296-8545-cbf6b5739344", + "type": "tag" + } + ], + "type": "dashboard", + "typeMigrationVersion": "10.3.0" +} diff --git a/packages/tychon_quantum_command/kibana/dashboard/tychon_quantum_command-32c01eb5-0d80-4a28-9de7-55b2046f7c45-inventory.json b/packages/tychon_quantum_command/kibana/dashboard/tychon_quantum_command-32c01eb5-0d80-4a28-9de7-55b2046f7c45-inventory.json new file mode 100644 index 00000000000..14bda842ce2 --- /dev/null +++ b/packages/tychon_quantum_command/kibana/dashboard/tychon_quantum_command-32c01eb5-0d80-4a28-9de7-55b2046f7c45-inventory.json @@ -0,0 +1,579 @@ +{ + "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": { + "ignoreFilters": false, + "ignoreQuery": false, + "ignoreTimerange": false, + "ignoreValidations": false + }, + "panelsJSON": {}, + "showApplySelections": false + }, + "description": "Aligns to schema version 2.0.3", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "optionsJSON": { + "hidePanelTitles": true, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "useMargins": false + }, + "panelsJSON": [ + { + "embeddableConfig": { + "enhancements": {}, + "hidePanelTitles": true, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "id": "", + "params": { + "fontSize": 12, + "markdown": "Inventory | [Application Report](/app/dashboards#/view/tychon_quantum_command-443e5928-b1c4-4e07-b0b9-c675dd057e2f-application-report) | [Application Detail](/app/dashboards#/view/tychon_quantum_command-6dfff015-3cc9-48b6-9410-7d8c01ff0d9a-application-detail) | [Certificate Report](/app/dashboards#/view/tychon_quantum_command-d0159137-9139-4a93-85bb-2ac9ddab3982-certificate-operations-dashboard) | [Application Connections Topology](/app/dashboards#/view/tychon_quantum_command-6f3d60d5-b5fb-45a5-9298-acf3ceb3ea1b-application-connections-topology) | [Cost Analysis](/app/dashboards#/view/tychon_quantum_command-02366033-dee4-4ea4-8458-7c8a8b58987e-cost-analysis)", + "openLinksInNewTab": false + }, + "title": "", + "type": "markdown", + "uiState": {} + } + }, + "gridData": { + "h": 3, + "i": "tychon-quantum-command-nav", + "w": 48, + "x": 0, + "y": 0 + }, + "panelIndex": "tychon-quantum-command-nav", + "title": "", + "type": "visualization" + }, + { + "embeddableConfig": { + "enhancements": { + "dynamicActions": { + "events": [ + { + "action": { + "config": { + "openInNewTab": false, + "useCurrentDateRange": true, + "useCurrentFilters": true + }, + "factoryId": "DASHBOARD_TO_DASHBOARD_DRILLDOWN", + "name": "Open Cost Analysis" + }, + "eventId": "57dde807-dddf-51b2-832a-36d295102863", + "triggers": [ + "FILTER_TRIGGER" + ] + } + ] + } + }, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "id": "", + "params": { + "spec": "{\"$schema\": \"https://vega.github.io/schema/vega/v5.json\", \"padding\": {\"top\": 0, \"bottom\": 0, \"left\": 0, \"right\": 0}, \"background\": \"#111111\", \"signals\": [{\"name\": \"totalHosts\", \"update\": \"length(data('hosts_total'))>0 ? data('hosts_total')[0].n : 0\"}, {\"name\": \"osReady\", \"update\": \"length(data('os_pqc'))>0 ? data('os_pqc')[0].n : 0\"}, {\"name\": \"osPct\", \"update\": \"totalHosts > 0 ? round(osReady / totalHosts * 100) : 0\"}, {\"name\": \"osClr\", \"update\": \"osPct>=90 ? '#00c853' : osPct>=60 ? '#448aff' : osPct>=30 ? '#ffa726' : '#ef5350'\"}, {\"name\": \"kexReady\", \"update\": \"length(data('kex_pqc'))>0 ? data('kex_pqc')[0].n : 0\"}, {\"name\": \"kexPct\", \"update\": \"totalHosts > 0 ? round(kexReady / totalHosts * 100) : 0\"}, {\"name\": \"kexClr\", \"update\": \"kexPct>=90 ? '#00c853' : kexPct>=60 ? '#448aff' : kexPct>=30 ? '#ffa726' : '#ef5350'\"}, {\"name\": \"barW\", \"update\": \"width * 0.62 - 18\"}], \"data\": [{\"name\": \"hosts_raw\", \"url\": {\"%context%\": true, \"%timefield%\": \"@timestamp\", \"index\": \"tychon-pqc-inventory*\", \"body\": {\"size\": 0, \"aggs\": {\"v\": {\"cardinality\": {\"field\": \"host.id\"}}}}}, \"format\": {\"property\": \"aggregations.v\"}, \"transform\": [{\"type\": \"formula\", \"as\": \"n\", \"expr\": \"datum.value\"}]}, {\"name\": \"hosts_total\", \"source\": \"hosts_raw\"}, {\"name\": \"os_pqc_raw\", \"url\": {\"%context%\": true, \"%timefield%\": \"@timestamp\", \"index\": \"tychon-pqc-inventory*\", \"body\": {\"size\": 0, \"aggs\": {\"f\": {\"filter\": {\"term\": {\"host.os_pqc_tier\": \"PQC READY\"}}, \"aggs\": {\"u\": {\"cardinality\": {\"field\": \"host.id\"}}}}}}}, \"format\": {\"property\": \"aggregations.f.u\"}, \"transform\": [{\"type\": \"formula\", \"as\": \"n\", \"expr\": \"datum.value\"}]}, {\"name\": \"os_pqc\", \"source\": \"os_pqc_raw\"}, {\"name\": \"kex_pqc_raw\", \"url\": {\"%context%\": true, \"%timefield%\": \"@timestamp\", \"index\": \"tychon-pqc-inventory*\", \"body\": {\"size\": 0, \"aggs\": {\"f\": {\"filter\": {\"term\": {\"omb.kex_tier\": \"PQC READY\"}}, \"aggs\": {\"u\": {\"cardinality\": {\"field\": \"host.id\"}}}}}}}, \"format\": {\"property\": \"aggregations.f.u\"}, \"transform\": [{\"type\": \"formula\", \"as\": \"n\", \"expr\": \"datum.value\"}]}, {\"name\": \"kex_pqc\", \"source\": \"kex_pqc_raw\"}], \"marks\": [{\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"value\": 16}, \"y\": {\"value\": 22}, \"text\": {\"value\": \"QUANTUM READINESS REPORT\"}, \"fill\": {\"value\": \"#cccccc\"}, \"fontSize\": {\"value\": 11}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"letterSpacing\": {\"value\": 1.5}}}}, {\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"value\": 16}, \"y\": {\"value\": 40}, \"text\": {\"value\": \"PQC COMPLIANCE PROGRESS \\u2014 unique hosts at PQC READY tier\"}, \"fill\": {\"value\": \"#555555\"}, \"fontSize\": {\"value\": 9}, \"font\": {\"value\": \"monospace\"}, \"letterSpacing\": {\"value\": 1}}}}, {\"type\": \"rule\", \"encode\": {\"enter\": {\"x\": {\"value\": 0}, \"x2\": {\"signal\": \"width\"}, \"y\": {\"value\": 48}, \"stroke\": {\"value\": \"#252525\"}, \"strokeWidth\": {\"value\": 1}}}}, {\"type\": \"rect\", \"encode\": {\"update\": {\"x\": {\"value\": 0}, \"y\": {\"value\": 60}, \"width\": {\"signal\": \"width\"}, \"height\": {\"value\": 78}, \"fill\": {\"value\": \"#161616\"}}}}, {\"type\": \"rect\", \"encode\": {\"update\": {\"x\": {\"value\": 0}, \"y\": {\"value\": 60}, \"width\": {\"value\": 4}, \"height\": {\"value\": 78}, \"fill\": {\"signal\": \"osClr\"}}}}, {\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"value\": 18}, \"y\": {\"value\": 78}, \"text\": {\"value\": \"OS READINESS\"}, \"fill\": {\"value\": \"#888888\"}, \"fontSize\": {\"value\": 9}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"letterSpacing\": {\"value\": 1}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"value\": 18}, \"y\": {\"value\": 93}, \"text\": {\"signal\": \"(osReady>=1000?format(osReady,'.3~s'):format(osReady,',')) + ' of ' + (totalHosts>=1000?format(totalHosts,'.3~s'):format(totalHosts,',')) + ' hosts'\"}, \"fill\": {\"value\": \"#444444\"}, \"fontSize\": {\"value\": 9}, \"font\": {\"value\": \"monospace\"}}}}, {\"type\": \"rect\", \"encode\": {\"update\": {\"x\": {\"value\": 18}, \"y\": {\"value\": 106}, \"width\": {\"signal\": \"barW\"}, \"height\": {\"value\": 8}, \"cornerRadius\": {\"value\": 4}, \"fill\": {\"value\": \"#1e1e1e\"}, \"stroke\": {\"value\": \"#2a2a2a\"}, \"strokeWidth\": {\"value\": 1}}}}, {\"type\": \"rect\", \"encode\": {\"update\": {\"x\": {\"value\": 18}, \"y\": {\"value\": 106}, \"width\": {\"signal\": \"max(0, barW * osPct / 100)\"}, \"height\": {\"value\": 8}, \"cornerRadius\": {\"value\": 4}, \"fill\": {\"signal\": \"osClr\"}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width - 10\"}, \"y\": {\"value\": 122}, \"text\": {\"signal\": \"osPct + '%'\"}, \"fill\": {\"signal\": \"osClr\"}, \"fontSize\": {\"value\": 24}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"right\"}}}}, {\"type\": \"rule\", \"encode\": {\"enter\": {\"x\": {\"value\": 0}, \"x2\": {\"signal\": \"width\"}, \"y\": {\"value\": 138}, \"stroke\": {\"value\": \"#222222\"}, \"strokeWidth\": {\"value\": 1}}}}, {\"type\": \"rect\", \"encode\": {\"update\": {\"x\": {\"value\": 0}, \"y\": {\"value\": 140}, \"width\": {\"signal\": \"width\"}, \"height\": {\"value\": 78}, \"fill\": {\"value\": \"#161616\"}}}}, {\"type\": \"rect\", \"encode\": {\"update\": {\"x\": {\"value\": 0}, \"y\": {\"value\": 140}, \"width\": {\"value\": 4}, \"height\": {\"value\": 78}, \"fill\": {\"signal\": \"kexClr\"}}}}, {\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"value\": 18}, \"y\": {\"value\": 158}, \"text\": {\"value\": \"KEY EXCHANGE\"}, \"fill\": {\"value\": \"#888888\"}, \"fontSize\": {\"value\": 9}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"letterSpacing\": {\"value\": 1}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"value\": 18}, \"y\": {\"value\": 173}, \"text\": {\"signal\": \"(kexReady>=1000?format(kexReady,'.3~s'):format(kexReady,',')) + ' of ' + (totalHosts>=1000?format(totalHosts,'.3~s'):format(totalHosts,',')) + ' hosts'\"}, \"fill\": {\"value\": \"#444444\"}, \"fontSize\": {\"value\": 9}, \"font\": {\"value\": \"monospace\"}}}}, {\"type\": \"rect\", \"encode\": {\"update\": {\"x\": {\"value\": 18}, \"y\": {\"value\": 186}, \"width\": {\"signal\": \"barW\"}, \"height\": {\"value\": 8}, \"cornerRadius\": {\"value\": 4}, \"fill\": {\"value\": \"#1e1e1e\"}, \"stroke\": {\"value\": \"#2a2a2a\"}, \"strokeWidth\": {\"value\": 1}}}}, {\"type\": \"rect\", \"encode\": {\"update\": {\"x\": {\"value\": 18}, \"y\": {\"value\": 186}, \"width\": {\"signal\": \"max(0, barW * kexPct / 100)\"}, \"height\": {\"value\": 8}, \"cornerRadius\": {\"value\": 4}, \"fill\": {\"signal\": \"kexClr\"}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width - 10\"}, \"y\": {\"value\": 202}, \"text\": {\"signal\": \"kexPct + '%'\"}, \"fill\": {\"signal\": \"kexClr\"}, \"fontSize\": {\"value\": 24}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"right\"}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width / 2\"}, \"y\": {\"signal\": \"height / 2 - 8\"}, \"text\": {\"signal\": \"length(data('hosts_raw')) === 0 ? 'NO DATA FOR CURRENT FILTERS / TIME RANGE' : ''\"}, \"fill\": {\"value\": \"#666666\"}, \"font\": {\"value\": \"monospace\"}, \"fontSize\": {\"value\": 11}, \"fontWeight\": {\"value\": \"bold\"}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"zindex\": {\"value\": 100}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width / 2\"}, \"y\": {\"signal\": \"height / 2 + 12\"}, \"text\": {\"signal\": \"length(data('hosts_raw')) === 0 ? 'Adjust dashboard filters or expand the selected time range.' : ''\"}, \"fill\": {\"value\": \"#444444\"}, \"font\": {\"value\": \"monospace\"}, \"fontSize\": {\"value\": 9}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"zindex\": {\"value\": 100}}}}]}" + }, + "title": "", + "type": "vega", + "uiState": {} + } + }, + "gridData": { + "h": 14, + "i": "0ccceeab-cd4b-4170-99a4-8e45770e048b", + "w": 31, + "x": 0, + "y": 2 + }, + "panelIndex": "0ccceeab-cd4b-4170-99a4-8e45770e048b", + "type": "visualization" + }, + { + "embeddableConfig": { + "enhancements": { + "dynamicActions": { + "events": [ + { + "action": { + "config": { + "openInNewTab": false, + "useCurrentDateRange": true, + "useCurrentFilters": true + }, + "factoryId": "DASHBOARD_TO_DASHBOARD_DRILLDOWN", + "name": "Open Certificate Operations" + }, + "eventId": "30c0b8ba-7a54-5cab-ac59-232baa7bb8b8", + "triggers": [ + "FILTER_TRIGGER" + ] + } + ] + } + }, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "id": "", + "params": { + "spec": "{\"$schema\": \"https://vega.github.io/schema/vega/v5.json\", \"padding\": {\"top\": 0, \"bottom\": 0, \"left\": 0, \"right\": 0}, \"background\": \"#111111\", \"signals\": [{\"name\": \"headerH\", \"value\": 48}, {\"name\": \"maxR\", \"update\": \"min(width * 0.36, (height - headerH) / 2 - 10)\"}, {\"name\": \"cx\", \"update\": \"width * 0.40\"}, {\"name\": \"cy\", \"update\": \"headerH + (height - headerH) / 2\"}, {\"name\": \"startA\", \"value\": -1.5707963}, {\"name\": \"pi2\", \"value\": 6.2831853}, {\"name\": \"lx\", \"update\": \"cx + maxR + 18\"}, {\"name\": \"hostsTotal\", \"update\": \"length(data('hosts_total'))>0 ? data('hosts_total')[0].n : 0\"}, {\"name\": \"appsTotal\", \"update\": \"length(data('apps_total'))>0 ? data('apps_total')[0].n : 0\"}, {\"name\": \"osReady\", \"update\": \"length(data('os_pqc'))>0 ? data('os_pqc')[0].n : 0\"}, {\"name\": \"kexReady\", \"update\": \"length(data('kex_pqc'))>0 ? data('kex_pqc')[0].n : 0\"}, {\"name\": \"sigReady\", \"update\": \"length(data('sig_pqc'))>0 ? data('sig_pqc')[0].n : 0\"}, {\"name\": \"tlsReady\", \"update\": \"length(data('tls_pqc'))>0 ? data('tls_pqc')[0].n : 0\"}, {\"name\": \"osPct\", \"update\": \"hostsTotal > 0 ? round(osReady / hostsTotal * 100) : 0\"}, {\"name\": \"kexPct\", \"update\": \"appsTotal > 0 ? round(kexReady / appsTotal * 100) : 0\"}, {\"name\": \"sigPct\", \"update\": \"appsTotal > 0 ? round(sigReady / appsTotal * 100) : 0\"}, {\"name\": \"tlsPct\", \"update\": \"appsTotal > 0 ? round(tlsReady / appsTotal * 100) : 0\"}, {\"name\": \"overallPct\", \"update\": \"round((osPct + kexPct + sigPct + tlsPct) / 4)\"}, {\"name\": \"osClr\", \"update\": \"osPct>=90?'#00c853':osPct>=60?'#448aff':osPct>=30?'#ffa726':'#ef5350'\"}, {\"name\": \"kexClr\", \"update\": \"kexPct>=90?'#00c853':kexPct>=60?'#448aff':kexPct>=30?'#ffa726':'#ef5350'\"}, {\"name\": \"sigClr\", \"update\": \"sigPct>=90?'#00c853':sigPct>=60?'#448aff':sigPct>=30?'#ffa726':'#ef5350'\"}, {\"name\": \"tlsClr\", \"update\": \"tlsPct>=90?'#00c853':tlsPct>=60?'#448aff':tlsPct>=30?'#ffa726':'#ef5350'\"}, {\"name\": \"overallClr\", \"update\": \"overallPct>=90?'#00c853':overallPct>=60?'#448aff':overallPct>=30?'#ffa726':'#ef5350'\"}, {\"name\": \"overallLbl\", \"update\": \"overallPct>=90?'PQC READY':overallPct>=60?'MODERN':overallPct>=30?'CLASSICAL':'LEGACY'\"}, {\"name\": \"lg\", \"update\": \"(height - headerH) / 5\"}, {\"name\": \"ly0\", \"update\": \"headerH + lg * 0.8\"}, {\"name\": \"ly1\", \"update\": \"headerH + lg * 1.8\"}, {\"name\": \"ly2\", \"update\": \"headerH + lg * 2.8\"}, {\"name\": \"ly3\", \"update\": \"headerH + lg * 3.8\"}], \"data\": [{\"name\": \"hosts_raw\", \"url\": {\"%context%\": true, \"%timefield%\": \"@timestamp\", \"index\": \"tychon-pqc-inventory*\", \"body\": {\"size\": 0, \"aggs\": {\"v\": {\"cardinality\": {\"field\": \"host.id\"}}}}}, \"format\": {\"property\": \"aggregations.v\"}, \"transform\": [{\"type\": \"formula\", \"as\": \"n\", \"expr\": \"datum.value\"}]}, {\"name\": \"hosts_total\", \"source\": \"hosts_raw\"}, {\"name\": \"apps_raw\", \"url\": {\"%context%\": true, \"%timefield%\": \"@timestamp\", \"index\": \"tychon-pqc-inventory*\", \"body\": {\"size\": 0, \"aggs\": {\"v\": {\"cardinality\": {\"field\": \"process.executable\"}}}}}, \"format\": {\"property\": \"aggregations.v\"}, \"transform\": [{\"type\": \"formula\", \"as\": \"n\", \"expr\": \"datum.value\"}]}, {\"name\": \"apps_total\", \"source\": \"apps_raw\"}, {\"name\": \"os_pqc_raw\", \"url\": {\"%context%\": true, \"%timefield%\": \"@timestamp\", \"index\": \"tychon-pqc-inventory*\", \"body\": {\"size\": 0, \"aggs\": {\"f\": {\"filter\": {\"term\": {\"host.os_pqc_tier\": \"PQC READY\"}}, \"aggs\": {\"u\": {\"cardinality\": {\"field\": \"host.id\"}}}}}}}, \"format\": {\"property\": \"aggregations.f.u\"}, \"transform\": [{\"type\": \"formula\", \"as\": \"n\", \"expr\": \"datum.value\"}]}, {\"name\": \"os_pqc\", \"source\": \"os_pqc_raw\"}, {\"name\": \"kex_pqc_raw\", \"url\": {\"%context%\": true, \"%timefield%\": \"@timestamp\", \"index\": \"tychon-pqc-inventory*\", \"body\": {\"size\": 0, \"aggs\": {\"f\": {\"filter\": {\"term\": {\"omb.kex_tier\": \"PQC READY\"}}, \"aggs\": {\"u\": {\"cardinality\": {\"field\": \"process.executable\"}}}}}}}, \"format\": {\"property\": \"aggregations.f.u\"}, \"transform\": [{\"type\": \"formula\", \"as\": \"n\", \"expr\": \"datum.value\"}]}, {\"name\": \"kex_pqc\", \"source\": \"kex_pqc_raw\"}, {\"name\": \"sig_pqc_raw\", \"url\": {\"%context%\": true, \"%timefield%\": \"@timestamp\", \"index\": \"tychon-pqc-inventory*\", \"body\": {\"size\": 0, \"aggs\": {\"f\": {\"filter\": {\"term\": {\"omb.sig_tier\": \"PQC READY\"}}, \"aggs\": {\"u\": {\"cardinality\": {\"field\": \"process.executable\"}}}}}}}, \"format\": {\"property\": \"aggregations.f.u\"}, \"transform\": [{\"type\": \"formula\", \"as\": \"n\", \"expr\": \"datum.value\"}]}, {\"name\": \"sig_pqc\", \"source\": \"sig_pqc_raw\"}, {\"name\": \"tls_pqc_raw\", \"url\": {\"%context%\": true, \"%timefield%\": \"@timestamp\", \"index\": \"tychon-pqc-inventory*\", \"body\": {\"size\": 0, \"aggs\": {\"f\": {\"filter\": {\"term\": {\"omb.protocol_tier\": \"TLS 1.3\"}}, \"aggs\": {\"u\": {\"cardinality\": {\"field\": \"process.executable\"}}}}}}}, \"format\": {\"property\": \"aggregations.f.u\"}, \"transform\": [{\"type\": \"formula\", \"as\": \"n\", \"expr\": \"datum.value\"}]}, {\"name\": \"tls_pqc\", \"source\": \"tls_pqc_raw\"}], \"marks\": [{\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"value\": 16}, \"y\": {\"value\": 20}, \"text\": {\"value\": \"CRYPTO POSTURE\"}, \"fill\": {\"value\": \"#cccccc\"}, \"fontSize\": {\"value\": 10}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"letterSpacing\": {\"value\": 1.5}}}}, {\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"value\": 16}, \"y\": {\"value\": 38}, \"text\": {\"value\": \"4-DIMENSION PQC READINESS SCORE\"}, \"fill\": {\"value\": \"#555555\"}, \"fontSize\": {\"value\": 9}, \"font\": {\"value\": \"monospace\"}, \"letterSpacing\": {\"value\": 1}}}}, {\"type\": \"rule\", \"encode\": {\"enter\": {\"x\": {\"value\": 0}, \"x2\": {\"signal\": \"width\"}, \"y\": {\"value\": 46}, \"stroke\": {\"value\": \"#252525\"}, \"strokeWidth\": {\"value\": 1}}}}, {\"type\": \"arc\", \"encode\": {\"update\": {\"x\": {\"signal\": \"cx\"}, \"y\": {\"signal\": \"cy\"}, \"innerRadius\": {\"signal\": \"maxR * 0.875\"}, \"outerRadius\": {\"signal\": \"maxR\"}, \"startAngle\": {\"value\": -1.5707963}, \"endAngle\": {\"value\": 4.712389}, \"fill\": {\"value\": \"#1a1a1a\"}, \"stroke\": {\"value\": \"#222222\"}, \"strokeWidth\": {\"value\": 0.5}}}}, {\"type\": \"arc\", \"encode\": {\"update\": {\"x\": {\"signal\": \"cx\"}, \"y\": {\"signal\": \"cy\"}, \"innerRadius\": {\"signal\": \"maxR * 0.875\"}, \"outerRadius\": {\"signal\": \"maxR\"}, \"startAngle\": {\"signal\": \"startA\"}, \"endAngle\": {\"signal\": \"osPct > 0 ? startA + osPct/100 * pi2 : startA\"}, \"fill\": {\"signal\": \"osClr\"}, \"cornerRadius\": {\"value\": 3}}}}, {\"type\": \"arc\", \"encode\": {\"update\": {\"x\": {\"signal\": \"cx\"}, \"y\": {\"signal\": \"cy\"}, \"innerRadius\": {\"signal\": \"maxR * 0.655\"}, \"outerRadius\": {\"signal\": \"maxR * 0.8\"}, \"startAngle\": {\"value\": -1.5707963}, \"endAngle\": {\"value\": 4.712389}, \"fill\": {\"value\": \"#1a1a1a\"}, \"stroke\": {\"value\": \"#222222\"}, \"strokeWidth\": {\"value\": 0.5}}}}, {\"type\": \"arc\", \"encode\": {\"update\": {\"x\": {\"signal\": \"cx\"}, \"y\": {\"signal\": \"cy\"}, \"innerRadius\": {\"signal\": \"maxR * 0.655\"}, \"outerRadius\": {\"signal\": \"maxR * 0.8\"}, \"startAngle\": {\"signal\": \"startA\"}, \"endAngle\": {\"signal\": \"kexPct > 0 ? startA + kexPct/100 * pi2 : startA\"}, \"fill\": {\"signal\": \"kexClr\"}, \"cornerRadius\": {\"value\": 3}}}}, {\"type\": \"arc\", \"encode\": {\"update\": {\"x\": {\"signal\": \"cx\"}, \"y\": {\"signal\": \"cy\"}, \"innerRadius\": {\"signal\": \"maxR * 0.435\"}, \"outerRadius\": {\"signal\": \"maxR * 0.58\"}, \"startAngle\": {\"value\": -1.5707963}, \"endAngle\": {\"value\": 4.712389}, \"fill\": {\"value\": \"#1a1a1a\"}, \"stroke\": {\"value\": \"#222222\"}, \"strokeWidth\": {\"value\": 0.5}}}}, {\"type\": \"arc\", \"encode\": {\"update\": {\"x\": {\"signal\": \"cx\"}, \"y\": {\"signal\": \"cy\"}, \"innerRadius\": {\"signal\": \"maxR * 0.435\"}, \"outerRadius\": {\"signal\": \"maxR * 0.58\"}, \"startAngle\": {\"signal\": \"startA\"}, \"endAngle\": {\"signal\": \"sigPct > 0 ? startA + sigPct/100 * pi2 : startA\"}, \"fill\": {\"signal\": \"sigClr\"}, \"cornerRadius\": {\"value\": 3}}}}, {\"type\": \"arc\", \"encode\": {\"update\": {\"x\": {\"signal\": \"cx\"}, \"y\": {\"signal\": \"cy\"}, \"innerRadius\": {\"signal\": \"maxR * 0.215\"}, \"outerRadius\": {\"signal\": \"maxR * 0.36\"}, \"startAngle\": {\"value\": -1.5707963}, \"endAngle\": {\"value\": 4.712389}, \"fill\": {\"value\": \"#1a1a1a\"}, \"stroke\": {\"value\": \"#222222\"}, \"strokeWidth\": {\"value\": 0.5}}}}, {\"type\": \"arc\", \"encode\": {\"update\": {\"x\": {\"signal\": \"cx\"}, \"y\": {\"signal\": \"cy\"}, \"innerRadius\": {\"signal\": \"maxR * 0.215\"}, \"outerRadius\": {\"signal\": \"maxR * 0.36\"}, \"startAngle\": {\"signal\": \"startA\"}, \"endAngle\": {\"signal\": \"tlsPct > 0 ? startA + tlsPct/100 * pi2 : startA\"}, \"fill\": {\"signal\": \"tlsClr\"}, \"cornerRadius\": {\"value\": 3}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"cx\"}, \"y\": {\"signal\": \"cy + maxR * 0.06\"}, \"text\": {\"signal\": \"overallPct + '%'\"}, \"fill\": {\"signal\": \"overallClr\"}, \"fontSize\": {\"signal\": \"max(14, maxR * 0.21)\"}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"cx\"}, \"y\": {\"signal\": \"cy + maxR * 0.24\"}, \"text\": {\"value\": \"OVERALL\"}, \"fill\": {\"value\": \"#2e2e2e\"}, \"fontSize\": {\"value\": 8}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"center\"}, \"letterSpacing\": {\"value\": 1}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"cx\"}, \"y\": {\"signal\": \"cy - maxR * 0.1\"}, \"text\": {\"signal\": \"overallLbl\"}, \"fill\": {\"signal\": \"overallClr + '44'\"}, \"fontSize\": {\"value\": 7}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"center\"}, \"letterSpacing\": {\"value\": 0.5}}}}, {\"type\": \"rect\", \"encode\": {\"update\": {\"x\": {\"signal\": \"lx\"}, \"y\": {\"signal\": \"ly0\"}, \"width\": {\"value\": 3}, \"height\": {\"signal\": \"lg * 0.6\"}, \"fill\": {\"signal\": \"osClr\"}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"lx + 9\"}, \"y\": {\"signal\": \"ly0 + 12\"}, \"text\": {\"value\": \"OS PLATFORM\"}, \"fill\": {\"value\": \"#888888\"}, \"fontSize\": {\"value\": 9}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"letterSpacing\": {\"value\": 0.8}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"lx + 9\"}, \"y\": {\"signal\": \"ly0 + 26\"}, \"text\": {\"value\": \"by host\"}, \"fill\": {\"value\": \"#3a3a3a\"}, \"fontSize\": {\"value\": 8}, \"font\": {\"value\": \"monospace\"}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width - 12\"}, \"y\": {\"signal\": \"ly0 + 20\"}, \"text\": {\"signal\": \"osPct + '%'\"}, \"fill\": {\"signal\": \"osClr\"}, \"fontSize\": {\"value\": 14}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"right\"}}}}, {\"type\": \"rect\", \"encode\": {\"update\": {\"x\": {\"signal\": \"lx\"}, \"y\": {\"signal\": \"ly1\"}, \"width\": {\"value\": 3}, \"height\": {\"signal\": \"lg * 0.6\"}, \"fill\": {\"signal\": \"kexClr\"}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"lx + 9\"}, \"y\": {\"signal\": \"ly1 + 12\"}, \"text\": {\"value\": \"KEY EXCHANGE\"}, \"fill\": {\"value\": \"#888888\"}, \"fontSize\": {\"value\": 9}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"letterSpacing\": {\"value\": 0.8}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"lx + 9\"}, \"y\": {\"signal\": \"ly1 + 26\"}, \"text\": {\"value\": \"by application\"}, \"fill\": {\"value\": \"#3a3a3a\"}, \"fontSize\": {\"value\": 8}, \"font\": {\"value\": \"monospace\"}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width - 12\"}, \"y\": {\"signal\": \"ly1 + 20\"}, \"text\": {\"signal\": \"kexPct + '%'\"}, \"fill\": {\"signal\": \"kexClr\"}, \"fontSize\": {\"value\": 14}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"right\"}}}}, {\"type\": \"rect\", \"encode\": {\"update\": {\"x\": {\"signal\": \"lx\"}, \"y\": {\"signal\": \"ly2\"}, \"width\": {\"value\": 3}, \"height\": {\"signal\": \"lg * 0.6\"}, \"fill\": {\"signal\": \"sigClr\"}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"lx + 9\"}, \"y\": {\"signal\": \"ly2 + 12\"}, \"text\": {\"value\": \"CERT SIGNATURE\"}, \"fill\": {\"value\": \"#888888\"}, \"fontSize\": {\"value\": 9}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"letterSpacing\": {\"value\": 0.8}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"lx + 9\"}, \"y\": {\"signal\": \"ly2 + 26\"}, \"text\": {\"value\": \"by application\"}, \"fill\": {\"value\": \"#3a3a3a\"}, \"fontSize\": {\"value\": 8}, \"font\": {\"value\": \"monospace\"}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width - 12\"}, \"y\": {\"signal\": \"ly2 + 20\"}, \"text\": {\"signal\": \"sigPct + '%'\"}, \"fill\": {\"signal\": \"sigClr\"}, \"fontSize\": {\"value\": 14}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"right\"}}}}, {\"type\": \"rect\", \"encode\": {\"update\": {\"x\": {\"signal\": \"lx\"}, \"y\": {\"signal\": \"ly3\"}, \"width\": {\"value\": 3}, \"height\": {\"signal\": \"lg * 0.6\"}, \"fill\": {\"signal\": \"tlsClr\"}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"lx + 9\"}, \"y\": {\"signal\": \"ly3 + 12\"}, \"text\": {\"value\": \"TLS VERSION\"}, \"fill\": {\"value\": \"#888888\"}, \"fontSize\": {\"value\": 9}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"letterSpacing\": {\"value\": 0.8}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"lx + 9\"}, \"y\": {\"signal\": \"ly3 + 26\"}, \"text\": {\"value\": \"TLS 1.3 required\"}, \"fill\": {\"value\": \"#3a3a3a\"}, \"fontSize\": {\"value\": 8}, \"font\": {\"value\": \"monospace\"}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width - 12\"}, \"y\": {\"signal\": \"ly3 + 20\"}, \"text\": {\"signal\": \"tlsPct + '%'\"}, \"fill\": {\"signal\": \"tlsClr\"}, \"fontSize\": {\"value\": 14}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"right\"}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width / 2\"}, \"y\": {\"signal\": \"height / 2 - 8\"}, \"text\": {\"signal\": \"length(data('hosts_raw')) === 0 ? 'NO DATA FOR CURRENT FILTERS / TIME RANGE' : ''\"}, \"fill\": {\"value\": \"#666666\"}, \"font\": {\"value\": \"monospace\"}, \"fontSize\": {\"value\": 11}, \"fontWeight\": {\"value\": \"bold\"}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"zindex\": {\"value\": 100}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width / 2\"}, \"y\": {\"signal\": \"height / 2 + 12\"}, \"text\": {\"signal\": \"length(data('hosts_raw')) === 0 ? 'Adjust dashboard filters or expand the selected time range.' : ''\"}, \"fill\": {\"value\": \"#444444\"}, \"font\": {\"value\": \"monospace\"}, \"fontSize\": {\"value\": 9}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"zindex\": {\"value\": 100}}}}]}" + }, + "title": "", + "type": "vega", + "uiState": {} + } + }, + "gridData": { + "h": 14, + "i": "63e69b30-7da2-4962-ad90-575262384727", + "w": 17, + "x": 31, + "y": 2 + }, + "panelIndex": "63e69b30-7da2-4962-ad90-575262384727", + "type": "visualization" + }, + { + "embeddableConfig": { + "enhancements": { + "dynamicActions": { + "events": [ + { + "action": { + "config": { + "openInNewTab": false, + "useCurrentDateRange": true, + "useCurrentFilters": true + }, + "factoryId": "DASHBOARD_TO_DASHBOARD_DRILLDOWN", + "name": "Open Application Report" + }, + "eventId": "6801ef79-6e41-585d-b31a-e75702561c24", + "triggers": [ + "FILTER_TRIGGER" + ] + } + ] + } + }, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "id": "", + "params": { + "spec": "{\"$schema\": \"https://vega.github.io/schema/vega/v5.json\", \"padding\": {\"top\": 0, \"bottom\": 0, \"left\": 0, \"right\": 0}, \"background\": \"#111111\", \"signals\": [{\"name\": \"sel\", \"value\": null, \"on\": [{\"events\": {\"type\": \"click\", \"markname\": \"bg\"}, \"update\": \"datum.t === sel ? null : datum.t\", \"force\": true}]}, {\"name\": \"_kf\", \"value\": null, \"on\": [{\"events\": {\"type\": \"click\", \"markname\": \"bg\"}, \"update\": \"datum.t === sel ? kibanaRemoveFilter({'match_phrase': {'omb.kex_tier': datum.t}}) : kibanaAddFilter({'match_phrase': {'omb.kex_tier': datum.t}})\", \"force\": true}]}], \"data\": [{\"name\": \"raw\", \"url\": {\"%context%\": true, \"%timefield%\": \"@timestamp\", \"index\": \"tychon-pqc-inventory*\", \"body\": {\"size\": 0, \"aggs\": {\"k\": {\"terms\": {\"field\": \"omb.kex_tier\", \"size\": 20}}}}}, \"format\": {\"property\": \"aggregations.k.buckets\"}, \"transform\": [{\"type\": \"formula\", \"as\": \"t\", \"expr\": \"datum.key\"}]}, {\"name\": \"tc\", \"source\": \"raw\", \"transform\": [{\"type\": \"aggregate\", \"groupby\": [\"t\"], \"ops\": [\"sum\"], \"fields\": [\"doc_count\"], \"as\": [\"n\"]}]}, {\"name\": \"mx\", \"source\": \"tc\", \"transform\": [{\"type\": \"aggregate\", \"ops\": [\"max\"], \"fields\": [\"n\"], \"as\": [\"v\"]}]}, {\"name\": \"rows\", \"values\": [{\"t\": \"PQC READY\", \"lbl\": \"ML-KEM / Kyber\", \"desc\": \"Post-quantum \\u2014 harvest-proof\", \"badge\": \"PQC READY\", \"clr\": \"#00c853\", \"bg\": \"#00c85318\", \"ord\": 0}, {\"t\": \"MODERN\", \"lbl\": \"X25519 / ECDHE\", \"desc\": \"Elliptic curve \\u2014 quantum-vulnerable\", \"badge\": \"MODERN\", \"clr\": \"#448aff\", \"bg\": \"#448aff18\", \"ord\": 1}, {\"t\": \"CLASSICAL\", \"lbl\": \"DHE / DH\", \"desc\": \"Finite-field DH \\u2014 quantum-vulnerable\", \"badge\": \"CLASSICAL\", \"clr\": \"#ffa726\", \"bg\": \"#ffa72618\", \"ord\": 2}, {\"t\": \"LEGACY\", \"lbl\": \"RSA Key Exchange\", \"desc\": \"No forward secrecy \\u2014 deprecated\", \"badge\": \"LEGACY\", \"clr\": \"#ef5350\", \"bg\": \"#ef535018\", \"ord\": 3}], \"transform\": [{\"type\": \"lookup\", \"from\": \"tc\", \"key\": \"t\", \"fields\": [\"t\"], \"values\": [\"n\"], \"as\": [\"n\"], \"default\": 0}, {\"type\": \"formula\", \"as\": \"y\", \"expr\": \"datum.ord * 72 + 60\"}]}], \"marks\": [{\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"value\": 16}, \"y\": {\"value\": 18}, \"text\": {\"value\": \"POST-QUANTUM CRYPTOGRAPHY READINESS\"}, \"fill\": {\"value\": \"#cccccc\"}, \"fontSize\": {\"value\": 10}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"letterSpacing\": {\"value\": 1.5}}}}, {\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"value\": 16}, \"y\": {\"value\": 38}, \"text\": {\"value\": \"KEY EXCHANGE \\u2014 click a tier to filter\"}, \"fill\": {\"value\": \"#555555\"}, \"fontSize\": {\"value\": 9}, \"font\": {\"value\": \"monospace\"}, \"letterSpacing\": {\"value\": 1}}}}, {\"type\": \"rule\", \"encode\": {\"enter\": {\"x\": {\"value\": 0}, \"x2\": {\"signal\": \"width\"}, \"y\": {\"value\": 48}, \"stroke\": {\"value\": \"#252525\"}, \"strokeWidth\": {\"value\": 1}}}}, {\"type\": \"rect\", \"name\": \"bg\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 0}, \"y\": {\"field\": \"y\"}, \"width\": {\"signal\": \"width\"}, \"height\": {\"value\": 66}, \"fill\": {\"signal\": \"datum.t===sel?'#1c1c2e':datum.n>0?'#161622':'#161616'\"}, \"cursor\": {\"value\": \"pointer\"}}}}, {\"type\": \"rect\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 0}, \"y\": {\"field\": \"y\"}, \"width\": {\"value\": 4}, \"height\": {\"value\": 66}, \"fill\": {\"signal\": \"datum.n>0?datum.clr:'#2a2a2a'\"}}}}, {\"type\": \"rule\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 0}, \"x2\": {\"signal\": \"width\"}, \"y\": {\"signal\": \"datum.y + 65\"}, \"stroke\": {\"value\": \"#222222\"}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 18}, \"y\": {\"signal\": \"datum.y + 24\"}, \"text\": {\"signal\": \"datum.lbl\"}, \"limit\": {\"signal\": \"width*0.62-18\"}, \"fill\": {\"signal\": \"datum.n>0?'#e8e8e8':'#444444'\"}, \"fontSize\": {\"value\": 13}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 18}, \"y\": {\"signal\": \"datum.y + 44\"}, \"text\": {\"signal\": \"datum.desc\"}, \"limit\": {\"signal\": \"width*0.62-18\"}, \"fill\": {\"value\": \"#555555\"}, \"fontSize\": {\"value\": 10}, \"font\": {\"value\": \"monospace\"}}}}, {\"type\": \"rect\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width*0.65\"}, \"y\": {\"signal\": \"datum.y + 8\"}, \"width\": {\"value\": 82}, \"height\": {\"value\": 17}, \"cornerRadius\": {\"value\": 2}, \"fill\": {\"signal\": \"datum.n>0?datum.bg:'#1a1a1a'\"}, \"stroke\": {\"signal\": \"datum.n>0?datum.clr:'#2a2a2a'\"}, \"strokeWidth\": {\"value\": 1}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width*0.65+41\"}, \"y\": {\"signal\": \"datum.y + 20\"}, \"text\": {\"signal\": \"datum.badge\"}, \"fill\": {\"signal\": \"datum.n>0?datum.clr:'#383838'\"}, \"fontSize\": {\"value\": 9}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"center\"}, \"letterSpacing\": {\"value\": 1}}}}, {\"type\": \"rect\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width*0.65\"}, \"y\": {\"signal\": \"datum.y + 31\"}, \"width\": {\"value\": 82}, \"height\": {\"value\": 17}, \"cornerRadius\": {\"value\": 2}, \"fill\": {\"signal\": \"'#1a1a1a'\"}, \"stroke\": {\"signal\": \"'#333333'\"}, \"strokeWidth\": {\"value\": 1}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width*0.65+41\"}, \"y\": {\"signal\": \"datum.y + 43\"}, \"text\": {\"signal\": \"datum.t===sel?'SELECTED':''\"}, \"fill\": {\"signal\": \"datum.t===sel?datum.clr:'#448aff'\"}, \"fontSize\": {\"value\": 9}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"center\"}, \"letterSpacing\": {\"value\": 1}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width-10\"}, \"y\": {\"signal\": \"datum.y + 36\"}, \"text\": {\"signal\": \"datum.n>0?(datum.n>=1000?format(datum.n,'.3~s'):format(datum.n,',')):'\\u2014'\"}, \"fill\": {\"signal\": \"datum.t===sel?datum.clr:datum.n>0?'#dddddd':'#333333'\"}, \"fontSize\": {\"value\": 20}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"right\"}}}}, {\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"signal\": \"width/2\"}, \"y\": {\"signal\": \"height-8\"}, \"text\": {\"value\": \"\\u2191 at the highest tier\"}, \"fill\": {\"value\": \"#2a2a2a\"}, \"fontSize\": {\"value\": 9}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"center\"}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width / 2\"}, \"y\": {\"signal\": \"height / 2 - 8\"}, \"text\": {\"signal\": \"length(data('raw')) === 0 ? 'NO DATA FOR CURRENT FILTERS / TIME RANGE' : ''\"}, \"fill\": {\"value\": \"#666666\"}, \"font\": {\"value\": \"monospace\"}, \"fontSize\": {\"value\": 11}, \"fontWeight\": {\"value\": \"bold\"}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"zindex\": {\"value\": 100}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width / 2\"}, \"y\": {\"signal\": \"height / 2 + 12\"}, \"text\": {\"signal\": \"length(data('raw')) === 0 ? 'Adjust dashboard filters or expand the selected time range.' : ''\"}, \"fill\": {\"value\": \"#444444\"}, \"font\": {\"value\": \"monospace\"}, \"fontSize\": {\"value\": 9}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"zindex\": {\"value\": 100}}}}]}" + }, + "title": "Quantum Inventory Report", + "type": "vega", + "uiState": {} + } + }, + "gridData": { + "h": 19, + "i": "df9e2eaf-bfe4-4443-9b68-c192dee2365a", + "w": 16, + "x": 0, + "y": 16 + }, + "panelIndex": "df9e2eaf-bfe4-4443-9b68-c192dee2365a", + "type": "visualization" + }, + { + "embeddableConfig": { + "enhancements": { + "dynamicActions": { + "events": [] + } + }, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "id": "", + "params": { + "spec": "{\"$schema\": \"https://vega.github.io/schema/vega/v5.json\", \"padding\": {\"top\": 0, \"bottom\": 0, \"left\": 0, \"right\": 0}, \"background\": \"#111111\", \"signals\": [{\"name\": \"sel\", \"value\": null, \"on\": [{\"events\": {\"type\": \"click\", \"markname\": \"bg\"}, \"update\": \"datum.t === sel ? null : datum.t\", \"force\": true}]}, {\"name\": \"_kf\", \"value\": null, \"on\": [{\"events\": {\"type\": \"click\", \"markname\": \"bg\"}, \"update\": \"datum.t === sel ? kibanaRemoveFilter({'match_phrase': {'omb.protocol_tier': datum.t}}) : kibanaAddFilter({'match_phrase': {'omb.protocol_tier': datum.t}})\", \"force\": true}]}], \"data\": [{\"name\": \"raw\", \"url\": {\"%context%\": true, \"%timefield%\": \"@timestamp\", \"index\": \"tychon-pqc-inventory*\", \"body\": {\"size\": 0, \"aggs\": {\"k\": {\"terms\": {\"field\": \"omb.protocol_tier\", \"size\": 50}}}}}, \"format\": {\"property\": \"aggregations.k.buckets\"}, \"transform\": [{\"type\": \"formula\", \"as\": \"t\", \"expr\": \"datum.key\"}]}, {\"name\": \"tc\", \"source\": \"raw\", \"transform\": [{\"type\": \"aggregate\", \"groupby\": [\"t\"], \"ops\": [\"sum\"], \"fields\": [\"doc_count\"], \"as\": [\"n\"]}]}, {\"name\": \"mx\", \"source\": \"tc\", \"transform\": [{\"type\": \"aggregate\", \"ops\": [\"max\"], \"fields\": [\"n\"], \"as\": [\"v\"]}]}, {\"name\": \"rows\", \"values\": [{\"t\": \"TLS 1.3\", \"lbl\": \"TLS 1.3\", \"desc\": \"Required for PQC key exchange \\u2014 carries ML-KEM key_share\", \"badge\": \"PQC READY\", \"clr\": \"#00c853\", \"bg\": \"#00c85318\", \"ord\": 0}, {\"t\": \"TLS 1.2\", \"lbl\": \"TLS 1.2\", \"desc\": \"Supports ECDHE/DHE forward secrecy but not ML-KEM key encapsulation\", \"badge\": \"NO KEM EXT\", \"clr\": \"#ffa726\", \"bg\": \"#ffa72618\", \"ord\": 1}, {\"t\": \"LEGACY\", \"lbl\": \"TLS 1.1 or below\", \"desc\": \"Deprecated \\u2014 contains known protocol vulnerabilities, should be disabled\", \"badge\": \"DEPRECATED\", \"clr\": \"#ef5350\", \"bg\": \"#ef535018\", \"ord\": 2}], \"transform\": [{\"type\": \"lookup\", \"from\": \"tc\", \"key\": \"t\", \"fields\": [\"t\"], \"values\": [\"n\"], \"as\": [\"n\"], \"default\": 0}, {\"type\": \"formula\", \"as\": \"y\", \"expr\": \"datum.ord * 72 + 60\"}]}], \"marks\": [{\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"value\": 16}, \"y\": {\"value\": 18}, \"text\": {\"value\": \"TLS PROTOCOL VERSION\"}, \"fill\": {\"value\": \"#cccccc\"}, \"fontSize\": {\"value\": 10}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"letterSpacing\": {\"value\": 1.5}}}}, {\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"value\": 16}, \"y\": {\"value\": 38}, \"text\": {\"value\": \"PREFERRED PROTOCOL \\u2014 click a tier to filter\"}, \"fill\": {\"value\": \"#555555\"}, \"fontSize\": {\"value\": 9}, \"font\": {\"value\": \"monospace\"}, \"letterSpacing\": {\"value\": 1}}}}, {\"type\": \"rule\", \"encode\": {\"enter\": {\"x\": {\"value\": 0}, \"x2\": {\"signal\": \"width\"}, \"y\": {\"value\": 48}, \"stroke\": {\"value\": \"#252525\"}, \"strokeWidth\": {\"value\": 1}}}}, {\"type\": \"rect\", \"name\": \"bg\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 0}, \"y\": {\"field\": \"y\"}, \"width\": {\"signal\": \"width\"}, \"height\": {\"value\": 66}, \"fill\": {\"signal\": \"datum.t===sel?'#1c1c2e':datum.n>0?'#161622':'#161616'\"}, \"cursor\": {\"value\": \"pointer\"}}}}, {\"type\": \"rect\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 0}, \"y\": {\"field\": \"y\"}, \"width\": {\"value\": 4}, \"height\": {\"value\": 66}, \"fill\": {\"signal\": \"datum.n>0?datum.clr:'#2a2a2a'\"}}}}, {\"type\": \"rule\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 0}, \"x2\": {\"signal\": \"width\"}, \"y\": {\"signal\": \"datum.y + 65\"}, \"stroke\": {\"value\": \"#222222\"}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 18}, \"y\": {\"signal\": \"datum.y + 24\"}, \"text\": {\"signal\": \"datum.lbl\"}, \"limit\": {\"signal\": \"width*0.62-18\"}, \"fill\": {\"signal\": \"datum.n>0?'#e8e8e8':'#444444'\"}, \"fontSize\": {\"value\": 13}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 18}, \"y\": {\"signal\": \"datum.y + 44\"}, \"text\": {\"signal\": \"datum.desc\"}, \"limit\": {\"signal\": \"width*0.62-18\"}, \"fill\": {\"value\": \"#555555\"}, \"fontSize\": {\"value\": 10}, \"font\": {\"value\": \"monospace\"}}}}, {\"type\": \"rect\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width*0.65\"}, \"y\": {\"signal\": \"datum.y + 8\"}, \"width\": {\"value\": 82}, \"height\": {\"value\": 17}, \"cornerRadius\": {\"value\": 2}, \"fill\": {\"signal\": \"datum.n>0?datum.bg:'#1a1a1a'\"}, \"stroke\": {\"signal\": \"datum.n>0?datum.clr:'#2a2a2a'\"}, \"strokeWidth\": {\"value\": 1}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width*0.65+41\"}, \"y\": {\"signal\": \"datum.y + 20\"}, \"text\": {\"signal\": \"datum.badge\"}, \"fill\": {\"signal\": \"datum.n>0?datum.clr:'#383838'\"}, \"fontSize\": {\"value\": 9}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"center\"}, \"letterSpacing\": {\"value\": 1}}}}, {\"type\": \"rect\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width*0.65\"}, \"y\": {\"signal\": \"datum.y + 31\"}, \"width\": {\"value\": 82}, \"height\": {\"value\": 17}, \"cornerRadius\": {\"value\": 2}, \"fill\": {\"signal\": \"'#1a1a1a'\"}, \"stroke\": {\"signal\": \"'#333333'\"}, \"strokeWidth\": {\"value\": 1}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width*0.65+41\"}, \"y\": {\"signal\": \"datum.y + 43\"}, \"text\": {\"signal\": \"datum.t===sel?'SELECTED':''\"}, \"fill\": {\"signal\": \"datum.t===sel?datum.clr:'#448aff'\"}, \"fontSize\": {\"value\": 9}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"center\"}, \"letterSpacing\": {\"value\": 1}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width-10\"}, \"y\": {\"signal\": \"datum.y + 36\"}, \"text\": {\"signal\": \"datum.n>0?(datum.n>=1000?format(datum.n,'.3~s'):format(datum.n,',')):'\\u2014'\"}, \"fill\": {\"signal\": \"datum.t===sel?datum.clr:datum.n>0?'#dddddd':'#333333'\"}, \"fontSize\": {\"value\": 20}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"right\"}}}}, {\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"signal\": \"width/2\"}, \"y\": {\"signal\": \"height-8\"}, \"text\": {\"value\": \"\\u2191 at the highest tier\"}, \"fill\": {\"value\": \"#2a2a2a\"}, \"fontSize\": {\"value\": 9}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"center\"}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width / 2\"}, \"y\": {\"signal\": \"height / 2 - 8\"}, \"text\": {\"signal\": \"length(data('raw')) === 0 ? 'NO DATA FOR CURRENT FILTERS / TIME RANGE' : ''\"}, \"fill\": {\"value\": \"#666666\"}, \"font\": {\"value\": \"monospace\"}, \"fontSize\": {\"value\": 11}, \"fontWeight\": {\"value\": \"bold\"}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"zindex\": {\"value\": 100}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width / 2\"}, \"y\": {\"signal\": \"height / 2 + 12\"}, \"text\": {\"signal\": \"length(data('raw')) === 0 ? 'Adjust dashboard filters or expand the selected time range.' : ''\"}, \"fill\": {\"value\": \"#444444\"}, \"font\": {\"value\": \"monospace\"}, \"fontSize\": {\"value\": 9}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"zindex\": {\"value\": 100}}}}]}" + }, + "title": "", + "type": "vega", + "uiState": {} + } + }, + "gridData": { + "h": 19, + "i": "b36ed613-82db-46d9-9173-888fa0d6a3f3", + "w": 15, + "x": 16, + "y": 16 + }, + "panelIndex": "b36ed613-82db-46d9-9173-888fa0d6a3f3", + "type": "visualization" + }, + { + "embeddableConfig": { + "enhancements": { + "dynamicActions": { + "events": [] + } + }, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "id": "", + "params": { + "spec": "{\"$schema\": \"https://vega.github.io/schema/vega/v5.json\", \"padding\": {\"top\": 0, \"bottom\": 0, \"left\": 0, \"right\": 0}, \"background\": \"#111111\", \"signals\": [{\"name\": \"sel\", \"value\": null, \"on\": [{\"events\": {\"type\": \"click\", \"markname\": \"bg\"}, \"update\": \"datum.t === sel ? null : datum.t\", \"force\": true}]}, {\"name\": \"_kf\", \"value\": null, \"on\": [{\"events\": {\"type\": \"click\", \"markname\": \"bg\"}, \"update\": \"datum.t === sel ? kibanaRemoveFilter({'match_phrase': {'omb.sig_tier': datum.t}}) : kibanaAddFilter({'match_phrase': {'omb.sig_tier': datum.t}})\", \"force\": true}]}], \"data\": [{\"name\": \"raw\", \"url\": {\"%context%\": true, \"%timefield%\": \"@timestamp\", \"index\": \"tychon-pqc-inventory*\", \"body\": {\"size\": 0, \"aggs\": {\"k\": {\"terms\": {\"field\": \"omb.sig_tier\", \"size\": 20}}}}}, \"format\": {\"property\": \"aggregations.k.buckets\"}, \"transform\": [{\"type\": \"formula\", \"as\": \"t\", \"expr\": \"datum.key\"}]}, {\"name\": \"tc\", \"source\": \"raw\", \"transform\": [{\"type\": \"aggregate\", \"groupby\": [\"t\"], \"ops\": [\"sum\"], \"fields\": [\"doc_count\"], \"as\": [\"n\"]}]}, {\"name\": \"mx\", \"source\": \"tc\", \"transform\": [{\"type\": \"aggregate\", \"ops\": [\"max\"], \"fields\": [\"n\"], \"as\": [\"v\"]}]}, {\"name\": \"rows\", \"values\": [{\"t\": \"PQC READY\", \"lbl\": \"ML-DSA / Dilithium\", \"desc\": \"Post-quantum lattice signature \\u2014 quantum-resistant\", \"badge\": \"PQC READY\", \"clr\": \"#00c853\", \"bg\": \"#00c85318\", \"ord\": 0}, {\"t\": \"MODERN\", \"lbl\": \"ECDSA (P-256 / P-384)\", \"desc\": \"Elliptic curve signature \\u2014 efficient, quantum-vulnerable\", \"badge\": \"MODERN\", \"clr\": \"#448aff\", \"bg\": \"#448aff18\", \"ord\": 1}, {\"t\": \"CLASSICAL\", \"lbl\": \"RSA / SHA-256 RSA\", \"desc\": \"RSA signature \\u2014 quantum-vulnerable via Shor's algorithm\", \"badge\": \"CLASSICAL\", \"clr\": \"#ffa726\", \"bg\": \"#ffa72618\", \"ord\": 2}, {\"t\": \"LEGACY\", \"lbl\": \"MD5 / SHA-1 RSA\", \"desc\": \"Broken hash \\u2014 deprecated by all modern standards\", \"badge\": \"LEGACY\", \"clr\": \"#ef5350\", \"bg\": \"#ef535018\", \"ord\": 3}], \"transform\": [{\"type\": \"lookup\", \"from\": \"tc\", \"key\": \"t\", \"fields\": [\"t\"], \"values\": [\"n\"], \"as\": [\"n\"], \"default\": 0}, {\"type\": \"formula\", \"as\": \"y\", \"expr\": \"datum.ord * 72 + 60\"}]}], \"marks\": [{\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"value\": 16}, \"y\": {\"value\": 18}, \"text\": {\"value\": \"CERTIFICATE SIGNATURE\"}, \"fill\": {\"value\": \"#cccccc\"}, \"fontSize\": {\"value\": 10}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"letterSpacing\": {\"value\": 1.5}}}}, {\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"value\": 16}, \"y\": {\"value\": 38}, \"text\": {\"value\": \"SIGNATURE ALGORITHM \\u2014 click a tier to filter\"}, \"fill\": {\"value\": \"#555555\"}, \"fontSize\": {\"value\": 9}, \"font\": {\"value\": \"monospace\"}, \"letterSpacing\": {\"value\": 1}}}}, {\"type\": \"rule\", \"encode\": {\"enter\": {\"x\": {\"value\": 0}, \"x2\": {\"signal\": \"width\"}, \"y\": {\"value\": 48}, \"stroke\": {\"value\": \"#252525\"}, \"strokeWidth\": {\"value\": 1}}}}, {\"type\": \"rect\", \"name\": \"bg\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 0}, \"y\": {\"field\": \"y\"}, \"width\": {\"signal\": \"width\"}, \"height\": {\"value\": 66}, \"fill\": {\"signal\": \"datum.t===sel?'#1c1c2e':datum.n>0?'#161622':'#161616'\"}, \"cursor\": {\"value\": \"pointer\"}}}}, {\"type\": \"rect\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 0}, \"y\": {\"field\": \"y\"}, \"width\": {\"value\": 4}, \"height\": {\"value\": 66}, \"fill\": {\"signal\": \"datum.n>0?datum.clr:'#2a2a2a'\"}}}}, {\"type\": \"rule\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 0}, \"x2\": {\"signal\": \"width\"}, \"y\": {\"signal\": \"datum.y + 65\"}, \"stroke\": {\"value\": \"#222222\"}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 18}, \"y\": {\"signal\": \"datum.y + 24\"}, \"text\": {\"signal\": \"datum.lbl\"}, \"limit\": {\"signal\": \"width*0.62-18\"}, \"fill\": {\"signal\": \"datum.n>0?'#e8e8e8':'#444444'\"}, \"fontSize\": {\"value\": 13}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 18}, \"y\": {\"signal\": \"datum.y + 44\"}, \"text\": {\"signal\": \"datum.desc\"}, \"limit\": {\"signal\": \"width*0.62-18\"}, \"fill\": {\"value\": \"#555555\"}, \"fontSize\": {\"value\": 10}, \"font\": {\"value\": \"monospace\"}}}}, {\"type\": \"rect\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width*0.65\"}, \"y\": {\"signal\": \"datum.y + 8\"}, \"width\": {\"value\": 82}, \"height\": {\"value\": 17}, \"cornerRadius\": {\"value\": 2}, \"fill\": {\"signal\": \"datum.n>0?datum.bg:'#1a1a1a'\"}, \"stroke\": {\"signal\": \"datum.n>0?datum.clr:'#2a2a2a'\"}, \"strokeWidth\": {\"value\": 1}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width*0.65+41\"}, \"y\": {\"signal\": \"datum.y + 20\"}, \"text\": {\"signal\": \"datum.badge\"}, \"fill\": {\"signal\": \"datum.n>0?datum.clr:'#383838'\"}, \"fontSize\": {\"value\": 9}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"center\"}, \"letterSpacing\": {\"value\": 1}}}}, {\"type\": \"rect\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width*0.65\"}, \"y\": {\"signal\": \"datum.y + 31\"}, \"width\": {\"value\": 82}, \"height\": {\"value\": 17}, \"cornerRadius\": {\"value\": 2}, \"fill\": {\"signal\": \"'#1a1a1a'\"}, \"stroke\": {\"signal\": \"'#333333'\"}, \"strokeWidth\": {\"value\": 1}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width*0.65+41\"}, \"y\": {\"signal\": \"datum.y + 43\"}, \"text\": {\"signal\": \"datum.t===sel?'SELECTED':''\"}, \"fill\": {\"signal\": \"datum.t===sel?datum.clr:'#448aff'\"}, \"fontSize\": {\"value\": 9}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"center\"}, \"letterSpacing\": {\"value\": 1}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width-10\"}, \"y\": {\"signal\": \"datum.y + 36\"}, \"text\": {\"signal\": \"datum.n>0?(datum.n>=1000?format(datum.n,'.3~s'):format(datum.n,',')):'\\u2014'\"}, \"fill\": {\"signal\": \"datum.t===sel?datum.clr:datum.n>0?'#dddddd':'#333333'\"}, \"fontSize\": {\"value\": 20}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"right\"}}}}, {\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"signal\": \"width/2\"}, \"y\": {\"signal\": \"height-8\"}, \"text\": {\"value\": \"\\u2191 at the highest tier\"}, \"fill\": {\"value\": \"#2a2a2a\"}, \"fontSize\": {\"value\": 9}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"center\"}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width / 2\"}, \"y\": {\"signal\": \"height / 2 - 8\"}, \"text\": {\"signal\": \"length(data('raw')) === 0 ? 'NO DATA FOR CURRENT FILTERS / TIME RANGE' : ''\"}, \"fill\": {\"value\": \"#666666\"}, \"font\": {\"value\": \"monospace\"}, \"fontSize\": {\"value\": 11}, \"fontWeight\": {\"value\": \"bold\"}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"zindex\": {\"value\": 100}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width / 2\"}, \"y\": {\"signal\": \"height / 2 + 12\"}, \"text\": {\"signal\": \"length(data('raw')) === 0 ? 'Adjust dashboard filters or expand the selected time range.' : ''\"}, \"fill\": {\"value\": \"#444444\"}, \"font\": {\"value\": \"monospace\"}, \"fontSize\": {\"value\": 9}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"zindex\": {\"value\": 100}}}}]}" + }, + "title": "", + "type": "vega", + "uiState": {} + } + }, + "gridData": { + "h": 19, + "i": "5c4c8a1f-627a-4bc5-8a2c-a45cbfc1cd5b", + "w": 17, + "x": 31, + "y": 16 + }, + "panelIndex": "5c4c8a1f-627a-4bc5-8a2c-a45cbfc1cd5b", + "type": "visualization" + }, + { + "embeddableConfig": { + "enhancements": { + "dynamicActions": { + "events": [] + } + }, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "id": "", + "params": { + "spec": "{\"$schema\": \"https://vega.github.io/schema/vega/v5.json\", \"padding\": {\"top\": 0, \"bottom\": 0, \"left\": 0, \"right\": 0}, \"background\": \"#111111\", \"signals\": [{\"name\": \"sel\", \"value\": null, \"on\": [{\"events\": {\"type\": \"click\", \"markname\": \"bg\"}, \"update\": \"datum.t === sel ? null : datum.t\", \"force\": true}]}, {\"name\": \"_kf\", \"value\": null, \"on\": [{\"events\": {\"type\": \"click\", \"markname\": \"bg\"}, \"update\": \"datum.t === sel ? kibanaRemoveFilter({'match_phrase': {'host.os_category': datum.t}}) : kibanaAddFilter({'match_phrase': {'host.os_category': datum.t}})\", \"force\": true}]}], \"data\": [{\"name\": \"raw\", \"url\": {\"%context%\": true, \"%timefield%\": \"@timestamp\", \"index\": \"tychon-pqc-inventory*\", \"body\": {\"size\": 0, \"aggs\": {\"k\": {\"terms\": {\"field\": \"host.os_category\", \"size\": 20, \"include\": [\"Windows 10\", \"Windows 11\"]}, \"aggs\": {\"u\": {\"cardinality\": {\"field\": \"host.id\"}}}}}}}, \"format\": {\"property\": \"aggregations.k.buckets\"}, \"transform\": [{\"type\": \"formula\", \"as\": \"t\", \"expr\": \"datum.key\"}, {\"type\": \"formula\", \"as\": \"hcount\", \"expr\": \"datum.u ? datum.u.value : 0\"}]}, {\"name\": \"tc\", \"source\": \"raw\", \"transform\": [{\"type\": \"aggregate\", \"groupby\": [\"t\"], \"ops\": [\"sum\"], \"fields\": [\"hcount\"], \"as\": [\"n\"]}]}, {\"name\": \"mx\", \"source\": \"tc\", \"transform\": [{\"type\": \"aggregate\", \"ops\": [\"max\"], \"fields\": [\"n\"], \"as\": [\"v\"]}]}, {\"name\": \"rows\", \"values\": [{\"t\": \"Windows 11\", \"lbl\": \"Windows 11\", \"desc\": \"ML-KEM hybrid KEX in Schannel TLS 1.3 (24H2 / build 26100+) \\u2014 native PQC support\", \"badge\": \"PQC READY\", \"clr\": \"#00c853\", \"bg\": \"#00c85318\", \"ord\": 0}, {\"t\": \"Windows 10\", \"lbl\": \"Windows 10\", \"desc\": \"TLS 1.3 capable \\u2014 no native PQC algorithm support in any release\", \"badge\": \"CLASSICAL\", \"clr\": \"#ffa726\", \"bg\": \"#ffa72618\", \"ord\": 1}], \"transform\": [{\"type\": \"lookup\", \"from\": \"tc\", \"key\": \"t\", \"fields\": [\"t\"], \"values\": [\"n\"], \"as\": [\"n\"], \"default\": 0}, {\"type\": \"formula\", \"as\": \"y\", \"expr\": \"datum.ord * 72 + 60\"}]}], \"marks\": [{\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"value\": 16}, \"y\": {\"value\": 18}, \"text\": {\"value\": \"WINDOWS WORKSTATIONS\"}, \"fill\": {\"value\": \"#cccccc\"}, \"fontSize\": {\"value\": 10}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"letterSpacing\": {\"value\": 1.5}}}}, {\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"value\": 16}, \"y\": {\"value\": 38}, \"text\": {\"value\": \"OS VERSION \\u2014 click a tier to filter\"}, \"fill\": {\"value\": \"#555555\"}, \"fontSize\": {\"value\": 9}, \"font\": {\"value\": \"monospace\"}, \"letterSpacing\": {\"value\": 1}}}}, {\"type\": \"rule\", \"encode\": {\"enter\": {\"x\": {\"value\": 0}, \"x2\": {\"signal\": \"width\"}, \"y\": {\"value\": 48}, \"stroke\": {\"value\": \"#252525\"}, \"strokeWidth\": {\"value\": 1}}}}, {\"type\": \"rect\", \"name\": \"bg\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 0}, \"y\": {\"field\": \"y\"}, \"width\": {\"signal\": \"width\"}, \"height\": {\"value\": 66}, \"fill\": {\"signal\": \"datum.t===sel?'#1c1c2e':datum.n>0?'#161622':'#161616'\"}, \"cursor\": {\"value\": \"pointer\"}}}}, {\"type\": \"rect\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 0}, \"y\": {\"field\": \"y\"}, \"width\": {\"value\": 4}, \"height\": {\"value\": 66}, \"fill\": {\"signal\": \"datum.n>0?datum.clr:'#2a2a2a'\"}}}}, {\"type\": \"rule\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 0}, \"x2\": {\"signal\": \"width\"}, \"y\": {\"signal\": \"datum.y + 65\"}, \"stroke\": {\"value\": \"#222222\"}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 18}, \"y\": {\"signal\": \"datum.y + 24\"}, \"text\": {\"signal\": \"datum.lbl\"}, \"limit\": {\"signal\": \"width*0.62-18\"}, \"fill\": {\"signal\": \"datum.n>0?'#e8e8e8':'#444444'\"}, \"fontSize\": {\"value\": 13}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 18}, \"y\": {\"signal\": \"datum.y + 44\"}, \"text\": {\"signal\": \"datum.desc\"}, \"limit\": {\"signal\": \"width*0.62-18\"}, \"fill\": {\"value\": \"#555555\"}, \"fontSize\": {\"value\": 10}, \"font\": {\"value\": \"monospace\"}}}}, {\"type\": \"rect\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width*0.65\"}, \"y\": {\"signal\": \"datum.y + 8\"}, \"width\": {\"value\": 82}, \"height\": {\"value\": 17}, \"cornerRadius\": {\"value\": 2}, \"fill\": {\"signal\": \"datum.n>0?datum.bg:'#1a1a1a'\"}, \"stroke\": {\"signal\": \"datum.n>0?datum.clr:'#2a2a2a'\"}, \"strokeWidth\": {\"value\": 1}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width*0.65+41\"}, \"y\": {\"signal\": \"datum.y + 20\"}, \"text\": {\"signal\": \"datum.badge\"}, \"fill\": {\"signal\": \"datum.n>0?datum.clr:'#383838'\"}, \"fontSize\": {\"value\": 9}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"center\"}, \"letterSpacing\": {\"value\": 1}}}}, {\"type\": \"rect\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width*0.65\"}, \"y\": {\"signal\": \"datum.y + 31\"}, \"width\": {\"value\": 82}, \"height\": {\"value\": 17}, \"cornerRadius\": {\"value\": 2}, \"fill\": {\"signal\": \"'#1a1a1a'\"}, \"stroke\": {\"signal\": \"'#333333'\"}, \"strokeWidth\": {\"value\": 1}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width*0.65+41\"}, \"y\": {\"signal\": \"datum.y + 43\"}, \"text\": {\"signal\": \"datum.t===sel?'SELECTED':''\"}, \"fill\": {\"signal\": \"datum.t===sel?datum.clr:'#448aff'\"}, \"fontSize\": {\"value\": 9}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"center\"}, \"letterSpacing\": {\"value\": 1}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width-10\"}, \"y\": {\"signal\": \"datum.y + 36\"}, \"text\": {\"signal\": \"datum.n>0?(datum.n>=1000?format(datum.n,'.3~s'):format(datum.n,',')):'\\u2014'\"}, \"fill\": {\"signal\": \"datum.t===sel?datum.clr:datum.n>0?'#dddddd':'#333333'\"}, \"fontSize\": {\"value\": 20}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"right\"}}}}, {\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"signal\": \"width/2\"}, \"y\": {\"signal\": \"height-8\"}, \"text\": {\"value\": \"\\u2191 at the highest tier\"}, \"fill\": {\"value\": \"#2a2a2a\"}, \"fontSize\": {\"value\": 9}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"center\"}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width / 2\"}, \"y\": {\"signal\": \"height / 2 - 8\"}, \"text\": {\"signal\": \"length(data('raw')) === 0 ? 'NO DATA FOR CURRENT FILTERS / TIME RANGE' : ''\"}, \"fill\": {\"value\": \"#666666\"}, \"font\": {\"value\": \"monospace\"}, \"fontSize\": {\"value\": 11}, \"fontWeight\": {\"value\": \"bold\"}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"zindex\": {\"value\": 100}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width / 2\"}, \"y\": {\"signal\": \"height / 2 + 12\"}, \"text\": {\"signal\": \"length(data('raw')) === 0 ? 'Adjust dashboard filters or expand the selected time range.' : ''\"}, \"fill\": {\"value\": \"#444444\"}, \"font\": {\"value\": \"monospace\"}, \"fontSize\": {\"value\": 9}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"zindex\": {\"value\": 100}}}}]}" + }, + "title": "", + "type": "vega", + "uiState": {} + } + }, + "gridData": { + "h": 22, + "i": "2c4f3e75-eaf8-437c-8d64-17d896a31239", + "w": 16, + "x": 0, + "y": 35 + }, + "panelIndex": "2c4f3e75-eaf8-437c-8d64-17d896a31239", + "type": "visualization" + }, + { + "embeddableConfig": { + "enhancements": { + "dynamicActions": { + "events": [] + } + }, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "id": "", + "params": { + "spec": "{\"$schema\": \"https://vega.github.io/schema/vega/v5.json\", \"padding\": {\"top\": 0, \"bottom\": 0, \"left\": 0, \"right\": 0}, \"background\": \"#111111\", \"signals\": [{\"name\": \"sel\", \"value\": null, \"on\": [{\"events\": {\"type\": \"click\", \"markname\": \"bg\"}, \"update\": \"datum.t === sel ? null : datum.t\", \"force\": true}]}, {\"name\": \"_kf\", \"value\": null, \"on\": [{\"events\": {\"type\": \"click\", \"markname\": \"bg\"}, \"update\": \"datum.t === sel ? kibanaRemoveFilter({'match_phrase': {'host.os_category': datum.t}}) : kibanaAddFilter({'match_phrase': {'host.os_category': datum.t}})\", \"force\": true}]}], \"data\": [{\"name\": \"raw\", \"url\": {\"%context%\": true, \"%timefield%\": \"@timestamp\", \"index\": \"tychon-pqc-inventory*\", \"body\": {\"size\": 0, \"aggs\": {\"k\": {\"terms\": {\"field\": \"host.os_category\", \"size\": 20, \"include\": [\"Server 2025\", \"Server 2022\", \"Server 2019\", \"Server 2016\"]}, \"aggs\": {\"u\": {\"cardinality\": {\"field\": \"host.id\"}}}}}}}, \"format\": {\"property\": \"aggregations.k.buckets\"}, \"transform\": [{\"type\": \"formula\", \"as\": \"t\", \"expr\": \"datum.key\"}, {\"type\": \"formula\", \"as\": \"hcount\", \"expr\": \"datum.u ? datum.u.value : 0\"}]}, {\"name\": \"tc\", \"source\": \"raw\", \"transform\": [{\"type\": \"aggregate\", \"groupby\": [\"t\"], \"ops\": [\"sum\"], \"fields\": [\"hcount\"], \"as\": [\"n\"]}]}, {\"name\": \"mx\", \"source\": \"tc\", \"transform\": [{\"type\": \"aggregate\", \"ops\": [\"max\"], \"fields\": [\"n\"], \"as\": [\"v\"]}]}, {\"name\": \"rows\", \"values\": [{\"t\": \"Server 2025\", \"lbl\": \"Windows Server 2025\", \"desc\": \"PQC-capable \\u2014 ML-KEM and ML-DSA available via Windows CNG\", \"badge\": \"PQC READY\", \"clr\": \"#00c853\", \"bg\": \"#00c85318\", \"ord\": 0}, {\"t\": \"Server 2022\", \"lbl\": \"Windows Server 2022\", \"desc\": \"TLS 1.3 default \\u2014 no native PQC algorithm support in CNG\", \"badge\": \"MODERN\", \"clr\": \"#448aff\", \"bg\": \"#448aff18\", \"ord\": 1}, {\"t\": \"Server 2019\", \"lbl\": \"Windows Server 2019\", \"desc\": \"TLS 1.2/1.3 supported \\u2014 no PQC, mainstream support ends Jan 2029\", \"badge\": \"CLASSICAL\", \"clr\": \"#ffa726\", \"bg\": \"#ffa72618\", \"ord\": 2}, {\"t\": \"Server 2016\", \"lbl\": \"Windows Server 2016\", \"desc\": \"TLS 1.2 only \\u2014 no PQC support, mainstream support ended Jan 2022\", \"badge\": \"LEGACY\", \"clr\": \"#ef5350\", \"bg\": \"#ef535018\", \"ord\": 3}], \"transform\": [{\"type\": \"lookup\", \"from\": \"tc\", \"key\": \"t\", \"fields\": [\"t\"], \"values\": [\"n\"], \"as\": [\"n\"], \"default\": 0}, {\"type\": \"formula\", \"as\": \"y\", \"expr\": \"datum.ord * 72 + 60\"}]}], \"marks\": [{\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"value\": 16}, \"y\": {\"value\": 18}, \"text\": {\"value\": \"WINDOWS SERVER\"}, \"fill\": {\"value\": \"#cccccc\"}, \"fontSize\": {\"value\": 10}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"letterSpacing\": {\"value\": 1.5}}}}, {\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"value\": 16}, \"y\": {\"value\": 38}, \"text\": {\"value\": \"OS VERSION \\u2014 click a tier to filter\"}, \"fill\": {\"value\": \"#555555\"}, \"fontSize\": {\"value\": 9}, \"font\": {\"value\": \"monospace\"}, \"letterSpacing\": {\"value\": 1}}}}, {\"type\": \"rule\", \"encode\": {\"enter\": {\"x\": {\"value\": 0}, \"x2\": {\"signal\": \"width\"}, \"y\": {\"value\": 48}, \"stroke\": {\"value\": \"#252525\"}, \"strokeWidth\": {\"value\": 1}}}}, {\"type\": \"rect\", \"name\": \"bg\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 0}, \"y\": {\"field\": \"y\"}, \"width\": {\"signal\": \"width\"}, \"height\": {\"value\": 66}, \"fill\": {\"signal\": \"datum.t===sel?'#1c1c2e':datum.n>0?'#161622':'#161616'\"}, \"cursor\": {\"value\": \"pointer\"}}}}, {\"type\": \"rect\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 0}, \"y\": {\"field\": \"y\"}, \"width\": {\"value\": 4}, \"height\": {\"value\": 66}, \"fill\": {\"signal\": \"datum.n>0?datum.clr:'#2a2a2a'\"}}}}, {\"type\": \"rule\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 0}, \"x2\": {\"signal\": \"width\"}, \"y\": {\"signal\": \"datum.y + 65\"}, \"stroke\": {\"value\": \"#222222\"}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 18}, \"y\": {\"signal\": \"datum.y + 24\"}, \"text\": {\"signal\": \"datum.lbl\"}, \"limit\": {\"signal\": \"width*0.62-18\"}, \"fill\": {\"signal\": \"datum.n>0?'#e8e8e8':'#444444'\"}, \"fontSize\": {\"value\": 13}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 18}, \"y\": {\"signal\": \"datum.y + 44\"}, \"text\": {\"signal\": \"datum.desc\"}, \"limit\": {\"signal\": \"width*0.62-18\"}, \"fill\": {\"value\": \"#555555\"}, \"fontSize\": {\"value\": 10}, \"font\": {\"value\": \"monospace\"}}}}, {\"type\": \"rect\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width*0.65\"}, \"y\": {\"signal\": \"datum.y + 8\"}, \"width\": {\"value\": 82}, \"height\": {\"value\": 17}, \"cornerRadius\": {\"value\": 2}, \"fill\": {\"signal\": \"datum.n>0?datum.bg:'#1a1a1a'\"}, \"stroke\": {\"signal\": \"datum.n>0?datum.clr:'#2a2a2a'\"}, \"strokeWidth\": {\"value\": 1}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width*0.65+41\"}, \"y\": {\"signal\": \"datum.y + 20\"}, \"text\": {\"signal\": \"datum.badge\"}, \"fill\": {\"signal\": \"datum.n>0?datum.clr:'#383838'\"}, \"fontSize\": {\"value\": 9}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"center\"}, \"letterSpacing\": {\"value\": 1}}}}, {\"type\": \"rect\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width*0.65\"}, \"y\": {\"signal\": \"datum.y + 31\"}, \"width\": {\"value\": 82}, \"height\": {\"value\": 17}, \"cornerRadius\": {\"value\": 2}, \"fill\": {\"signal\": \"'#1a1a1a'\"}, \"stroke\": {\"signal\": \"'#333333'\"}, \"strokeWidth\": {\"value\": 1}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width*0.65+41\"}, \"y\": {\"signal\": \"datum.y + 43\"}, \"text\": {\"signal\": \"datum.t===sel?'SELECTED':''\"}, \"fill\": {\"signal\": \"datum.t===sel?datum.clr:'#448aff'\"}, \"fontSize\": {\"value\": 9}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"center\"}, \"letterSpacing\": {\"value\": 1}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width-10\"}, \"y\": {\"signal\": \"datum.y + 36\"}, \"text\": {\"signal\": \"datum.n>0?(datum.n>=1000?format(datum.n,'.3~s'):format(datum.n,',')):'\\u2014'\"}, \"fill\": {\"signal\": \"datum.t===sel?datum.clr:datum.n>0?'#dddddd':'#333333'\"}, \"fontSize\": {\"value\": 20}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"right\"}}}}, {\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"signal\": \"width/2\"}, \"y\": {\"signal\": \"height-8\"}, \"text\": {\"value\": \"\\u2191 at the highest tier\"}, \"fill\": {\"value\": \"#2a2a2a\"}, \"fontSize\": {\"value\": 9}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"center\"}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width / 2\"}, \"y\": {\"signal\": \"height / 2 - 8\"}, \"text\": {\"signal\": \"length(data('raw')) === 0 ? 'NO DATA FOR CURRENT FILTERS / TIME RANGE' : ''\"}, \"fill\": {\"value\": \"#666666\"}, \"font\": {\"value\": \"monospace\"}, \"fontSize\": {\"value\": 11}, \"fontWeight\": {\"value\": \"bold\"}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"zindex\": {\"value\": 100}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width / 2\"}, \"y\": {\"signal\": \"height / 2 + 12\"}, \"text\": {\"signal\": \"length(data('raw')) === 0 ? 'Adjust dashboard filters or expand the selected time range.' : ''\"}, \"fill\": {\"value\": \"#444444\"}, \"font\": {\"value\": \"monospace\"}, \"fontSize\": {\"value\": 9}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"zindex\": {\"value\": 100}}}}]}" + }, + "title": "", + "type": "vega", + "uiState": {} + } + }, + "gridData": { + "h": 22, + "i": "b7978898-3127-443e-91fa-cf36712fc0b0", + "w": 15, + "x": 16, + "y": 35 + }, + "panelIndex": "b7978898-3127-443e-91fa-cf36712fc0b0", + "type": "visualization" + }, + { + "embeddableConfig": { + "enhancements": { + "dynamicActions": { + "events": [] + } + }, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "id": "", + "params": { + "spec": "{\"$schema\": \"https://vega.github.io/schema/vega/v5.json\", \"padding\": {\"top\": 0, \"bottom\": 0, \"left\": 0, \"right\": 0}, \"background\": \"#111111\", \"signals\": [{\"name\": \"sel\", \"value\": null, \"on\": [{\"events\": {\"type\": \"click\", \"markname\": \"bg\"}, \"update\": \"datum.t === sel ? null : datum.t\", \"force\": true}]}, {\"name\": \"_kf\", \"value\": null, \"on\": [{\"events\": {\"type\": \"click\", \"markname\": \"bg\"}, \"update\": \"datum.t === sel ? kibanaRemoveFilter({'match_phrase': {'host.os_category': datum.t}}) : kibanaAddFilter({'match_phrase': {'host.os_category': datum.t}})\", \"force\": true}]}], \"data\": [{\"name\": \"raw\", \"url\": {\"%context%\": true, \"%timefield%\": \"@timestamp\", \"index\": \"tychon-pqc-inventory*\", \"body\": {\"size\": 0, \"aggs\": {\"k\": {\"terms\": {\"field\": \"host.os_category\", \"size\": 20, \"include\": [\"macOS 26\", \"macOS 15\", \"macOS 14\", \"macOS 13\", \"macOS 12\"]}, \"aggs\": {\"u\": {\"cardinality\": {\"field\": \"host.id\"}}}}}}}, \"format\": {\"property\": \"aggregations.k.buckets\"}, \"transform\": [{\"type\": \"formula\", \"as\": \"t\", \"expr\": \"datum.key\"}, {\"type\": \"formula\", \"as\": \"hcount\", \"expr\": \"datum.u ? datum.u.value : 0\"}]}, {\"name\": \"tc\", \"source\": \"raw\", \"transform\": [{\"type\": \"aggregate\", \"groupby\": [\"t\"], \"ops\": [\"sum\"], \"fields\": [\"hcount\"], \"as\": [\"n\"]}]}, {\"name\": \"mx\", \"source\": \"tc\", \"transform\": [{\"type\": \"aggregate\", \"ops\": [\"max\"], \"fields\": [\"n\"], \"as\": [\"v\"]}]}, {\"name\": \"rows\", \"values\": [{\"t\": \"macOS 26\", \"lbl\": \"macOS 26 Tahoe\", \"desc\": \"ML-KEM, ML-DSA, SLH-DSA native via Security.framework \\u2014 full PQC support\", \"badge\": \"PQC READY\", \"clr\": \"#00c853\", \"bg\": \"#00c85318\", \"ord\": 0}, {\"t\": \"macOS 15\", \"lbl\": \"macOS 15 Sequoia\", \"desc\": \"ML-KEM hybrid KEX via Network.framework \\u2014 partial PQC, not FIPS 203/204 compliant\", \"badge\": \"MODERN\", \"clr\": \"#448aff\", \"bg\": \"#448aff18\", \"ord\": 1}, {\"t\": \"macOS 14\", \"lbl\": \"macOS 14 Sonoma\", \"desc\": \"TLS 1.3 default \\u2014 no native PQC algorithm support in Security.framework\", \"badge\": \"MODERN\", \"clr\": \"#448aff\", \"bg\": \"#448aff18\", \"ord\": 2}, {\"t\": \"macOS 13\", \"lbl\": \"macOS 13 Ventura\", \"desc\": \"TLS 1.3 default \\u2014 no native PQC algorithm support in Security.framework\", \"badge\": \"MODERN\", \"clr\": \"#448aff\", \"bg\": \"#448aff18\", \"ord\": 3}, {\"t\": \"macOS 12\", \"lbl\": \"macOS 12 Monterey\", \"desc\": \"TLS 1.3 capable \\u2014 older cipher defaults, no PQC support\", \"badge\": \"MODERN\", \"clr\": \"#448aff\", \"bg\": \"#448aff18\", \"ord\": 4}], \"transform\": [{\"type\": \"lookup\", \"from\": \"tc\", \"key\": \"t\", \"fields\": [\"t\"], \"values\": [\"n\"], \"as\": [\"n\"], \"default\": 0}, {\"type\": \"formula\", \"as\": \"y\", \"expr\": \"datum.ord * 72 + 60\"}]}], \"marks\": [{\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"value\": 16}, \"y\": {\"value\": 18}, \"text\": {\"value\": \"MACOS\"}, \"fill\": {\"value\": \"#cccccc\"}, \"fontSize\": {\"value\": 10}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"letterSpacing\": {\"value\": 1.5}}}}, {\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"value\": 16}, \"y\": {\"value\": 38}, \"text\": {\"value\": \"OS VERSION \\u2014 click a tier to filter\"}, \"fill\": {\"value\": \"#555555\"}, \"fontSize\": {\"value\": 9}, \"font\": {\"value\": \"monospace\"}, \"letterSpacing\": {\"value\": 1}}}}, {\"type\": \"rule\", \"encode\": {\"enter\": {\"x\": {\"value\": 0}, \"x2\": {\"signal\": \"width\"}, \"y\": {\"value\": 48}, \"stroke\": {\"value\": \"#252525\"}, \"strokeWidth\": {\"value\": 1}}}}, {\"type\": \"rect\", \"name\": \"bg\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 0}, \"y\": {\"field\": \"y\"}, \"width\": {\"signal\": \"width\"}, \"height\": {\"value\": 66}, \"fill\": {\"signal\": \"datum.t===sel?'#1c1c2e':datum.n>0?'#161622':'#161616'\"}, \"cursor\": {\"value\": \"pointer\"}}}}, {\"type\": \"rect\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 0}, \"y\": {\"field\": \"y\"}, \"width\": {\"value\": 4}, \"height\": {\"value\": 66}, \"fill\": {\"signal\": \"datum.n>0?datum.clr:'#2a2a2a'\"}}}}, {\"type\": \"rule\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 0}, \"x2\": {\"signal\": \"width\"}, \"y\": {\"signal\": \"datum.y + 65\"}, \"stroke\": {\"value\": \"#222222\"}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 18}, \"y\": {\"signal\": \"datum.y + 24\"}, \"text\": {\"signal\": \"datum.lbl\"}, \"limit\": {\"signal\": \"width*0.62-18\"}, \"fill\": {\"signal\": \"datum.n>0?'#e8e8e8':'#444444'\"}, \"fontSize\": {\"value\": 13}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 18}, \"y\": {\"signal\": \"datum.y + 44\"}, \"text\": {\"signal\": \"datum.desc\"}, \"limit\": {\"signal\": \"width*0.62-18\"}, \"fill\": {\"value\": \"#555555\"}, \"fontSize\": {\"value\": 10}, \"font\": {\"value\": \"monospace\"}}}}, {\"type\": \"rect\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width*0.65\"}, \"y\": {\"signal\": \"datum.y + 8\"}, \"width\": {\"value\": 82}, \"height\": {\"value\": 17}, \"cornerRadius\": {\"value\": 2}, \"fill\": {\"signal\": \"datum.n>0?datum.bg:'#1a1a1a'\"}, \"stroke\": {\"signal\": \"datum.n>0?datum.clr:'#2a2a2a'\"}, \"strokeWidth\": {\"value\": 1}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width*0.65+41\"}, \"y\": {\"signal\": \"datum.y + 20\"}, \"text\": {\"signal\": \"datum.badge\"}, \"fill\": {\"signal\": \"datum.n>0?datum.clr:'#383838'\"}, \"fontSize\": {\"value\": 9}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"center\"}, \"letterSpacing\": {\"value\": 1}}}}, {\"type\": \"rect\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width*0.65\"}, \"y\": {\"signal\": \"datum.y + 31\"}, \"width\": {\"value\": 82}, \"height\": {\"value\": 17}, \"cornerRadius\": {\"value\": 2}, \"fill\": {\"signal\": \"'#1a1a1a'\"}, \"stroke\": {\"signal\": \"'#333333'\"}, \"strokeWidth\": {\"value\": 1}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width*0.65+41\"}, \"y\": {\"signal\": \"datum.y + 43\"}, \"text\": {\"signal\": \"datum.t===sel?'SELECTED':''\"}, \"fill\": {\"signal\": \"datum.t===sel?datum.clr:'#448aff'\"}, \"fontSize\": {\"value\": 9}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"center\"}, \"letterSpacing\": {\"value\": 1}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width-10\"}, \"y\": {\"signal\": \"datum.y + 36\"}, \"text\": {\"signal\": \"datum.n>0?(datum.n>=1000?format(datum.n,'.3~s'):format(datum.n,',')):'\\u2014'\"}, \"fill\": {\"signal\": \"datum.t===sel?datum.clr:datum.n>0?'#dddddd':'#333333'\"}, \"fontSize\": {\"value\": 20}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"right\"}}}}, {\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"signal\": \"width/2\"}, \"y\": {\"signal\": \"height-8\"}, \"text\": {\"value\": \"\\u2191 at the highest tier\"}, \"fill\": {\"value\": \"#2a2a2a\"}, \"fontSize\": {\"value\": 9}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"center\"}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width / 2\"}, \"y\": {\"signal\": \"height / 2 - 8\"}, \"text\": {\"signal\": \"length(data('raw')) === 0 ? 'NO DATA FOR CURRENT FILTERS / TIME RANGE' : ''\"}, \"fill\": {\"value\": \"#666666\"}, \"font\": {\"value\": \"monospace\"}, \"fontSize\": {\"value\": 11}, \"fontWeight\": {\"value\": \"bold\"}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"zindex\": {\"value\": 100}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width / 2\"}, \"y\": {\"signal\": \"height / 2 + 12\"}, \"text\": {\"signal\": \"length(data('raw')) === 0 ? 'Adjust dashboard filters or expand the selected time range.' : ''\"}, \"fill\": {\"value\": \"#444444\"}, \"font\": {\"value\": \"monospace\"}, \"fontSize\": {\"value\": 9}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"zindex\": {\"value\": 100}}}}]}" + }, + "title": "", + "type": "vega", + "uiState": {} + } + }, + "gridData": { + "h": 22, + "i": "aa1550df-8d69-4c14-92fb-6566f846bfce", + "w": 17, + "x": 31, + "y": 35 + }, + "panelIndex": "aa1550df-8d69-4c14-92fb-6566f846bfce", + "type": "visualization" + }, + { + "embeddableConfig": { + "enhancements": { + "dynamicActions": { + "events": [] + } + }, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "id": "", + "params": { + "spec": "{\"$schema\": \"https://vega.github.io/schema/vega/v5.json\", \"padding\": {\"top\": 0, \"bottom\": 0, \"left\": 0, \"right\": 0}, \"background\": \"#111111\", \"signals\": [{\"name\": \"sel\", \"value\": null, \"on\": [{\"events\": {\"type\": \"click\", \"markname\": \"bg\"}, \"update\": \"datum.t === sel ? null : datum.t\", \"force\": true}]}, {\"name\": \"_kf\", \"value\": null, \"on\": [{\"events\": {\"type\": \"click\", \"markname\": \"bg\"}, \"update\": \"datum.t === sel ? kibanaRemoveFilter({'match_phrase': {'host.os_category': datum.t}}) : kibanaAddFilter({'match_phrase': {'host.os_category': datum.t}})\", \"force\": true}]}], \"data\": [{\"name\": \"raw\", \"url\": {\"%context%\": true, \"%timefield%\": \"@timestamp\", \"index\": \"tychon-pqc-inventory*\", \"body\": {\"size\": 0, \"aggs\": {\"k\": {\"terms\": {\"field\": \"host.os_category\", \"size\": 20, \"include\": [\"CentOS 9\", \"CentOS 8\", \"CentOS 7\"]}, \"aggs\": {\"u\": {\"cardinality\": {\"field\": \"host.id\"}}}}}}}, \"format\": {\"property\": \"aggregations.k.buckets\"}, \"transform\": [{\"type\": \"formula\", \"as\": \"t\", \"expr\": \"datum.key\"}, {\"type\": \"formula\", \"as\": \"hcount\", \"expr\": \"datum.u ? datum.u.value : 0\"}]}, {\"name\": \"tc\", \"source\": \"raw\", \"transform\": [{\"type\": \"aggregate\", \"groupby\": [\"t\"], \"ops\": [\"sum\"], \"fields\": [\"hcount\"], \"as\": [\"n\"]}]}, {\"name\": \"mx\", \"source\": \"tc\", \"transform\": [{\"type\": \"aggregate\", \"ops\": [\"max\"], \"fields\": [\"n\"], \"as\": [\"v\"]}]}, {\"name\": \"rows\", \"values\": [{\"t\": \"CentOS 9\", \"lbl\": \"CentOS Stream 9\", \"desc\": \"OpenSSL 3.x \\u2014 TLS 1.3 default, OQS PQC provider available\", \"badge\": \"MODERN\", \"clr\": \"#448aff\", \"bg\": \"#448aff18\", \"ord\": 0}, {\"t\": \"CentOS 8\", \"lbl\": \"CentOS Stream 8\", \"desc\": \"EOL May 2024 \\u2014 OpenSSL 1.1.1, TLS 1.3 supported, no PQC\", \"badge\": \"LEGACY\", \"clr\": \"#ef5350\", \"bg\": \"#ef535018\", \"ord\": 1}, {\"t\": \"CentOS 7\", \"lbl\": \"CentOS 7\", \"desc\": \"EOL Jun 2024 \\u2014 OpenSSL 1.0.2, TLS 1.2 only, no PQC support\", \"badge\": \"LEGACY\", \"clr\": \"#ef5350\", \"bg\": \"#ef535018\", \"ord\": 2}], \"transform\": [{\"type\": \"lookup\", \"from\": \"tc\", \"key\": \"t\", \"fields\": [\"t\"], \"values\": [\"n\"], \"as\": [\"n\"], \"default\": 0}, {\"type\": \"formula\", \"as\": \"y\", \"expr\": \"datum.ord * 72 + 60\"}]}], \"marks\": [{\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"value\": 16}, \"y\": {\"value\": 18}, \"text\": {\"value\": \"CENTOS\"}, \"fill\": {\"value\": \"#cccccc\"}, \"fontSize\": {\"value\": 10}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"letterSpacing\": {\"value\": 1.5}}}}, {\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"value\": 16}, \"y\": {\"value\": 38}, \"text\": {\"value\": \"OS VERSION \\u2014 click a tier to filter\"}, \"fill\": {\"value\": \"#555555\"}, \"fontSize\": {\"value\": 9}, \"font\": {\"value\": \"monospace\"}, \"letterSpacing\": {\"value\": 1}}}}, {\"type\": \"rule\", \"encode\": {\"enter\": {\"x\": {\"value\": 0}, \"x2\": {\"signal\": \"width\"}, \"y\": {\"value\": 48}, \"stroke\": {\"value\": \"#252525\"}, \"strokeWidth\": {\"value\": 1}}}}, {\"type\": \"rect\", \"name\": \"bg\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 0}, \"y\": {\"field\": \"y\"}, \"width\": {\"signal\": \"width\"}, \"height\": {\"value\": 66}, \"fill\": {\"signal\": \"datum.t===sel?'#1c1c2e':datum.n>0?'#161622':'#161616'\"}, \"cursor\": {\"value\": \"pointer\"}}}}, {\"type\": \"rect\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 0}, \"y\": {\"field\": \"y\"}, \"width\": {\"value\": 4}, \"height\": {\"value\": 66}, \"fill\": {\"signal\": \"datum.n>0?datum.clr:'#2a2a2a'\"}}}}, {\"type\": \"rule\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 0}, \"x2\": {\"signal\": \"width\"}, \"y\": {\"signal\": \"datum.y + 65\"}, \"stroke\": {\"value\": \"#222222\"}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 18}, \"y\": {\"signal\": \"datum.y + 24\"}, \"text\": {\"signal\": \"datum.lbl\"}, \"limit\": {\"signal\": \"width*0.60-18\"}, \"ellipsis\": \"\\u2026\", \"fill\": {\"signal\": \"datum.n>0?'#e8e8e8':'#444444'\"}, \"fontSize\": {\"value\": 13}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 18}, \"y\": {\"signal\": \"datum.y + 44\"}, \"text\": {\"signal\": \"datum.desc\"}, \"limit\": {\"signal\": \"width*0.60-18\"}, \"ellipsis\": \"\\u2026\", \"fill\": {\"value\": \"#555555\"}, \"fontSize\": {\"value\": 10}, \"font\": {\"value\": \"monospace\"}}}}, {\"type\": \"rect\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width*0.65\"}, \"y\": {\"signal\": \"datum.y + 8\"}, \"width\": {\"value\": 82}, \"height\": {\"value\": 17}, \"cornerRadius\": {\"value\": 2}, \"fill\": {\"signal\": \"datum.n>0?datum.bg:'#1a1a1a'\"}, \"stroke\": {\"signal\": \"datum.n>0?datum.clr:'#2a2a2a'\"}, \"strokeWidth\": {\"value\": 1}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width*0.65+41\"}, \"y\": {\"signal\": \"datum.y + 20\"}, \"text\": {\"signal\": \"datum.badge\"}, \"fill\": {\"signal\": \"datum.n>0?datum.clr:'#383838'\"}, \"fontSize\": {\"value\": 9}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"center\"}, \"letterSpacing\": {\"value\": 1}}}}, {\"type\": \"rect\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width*0.65\"}, \"y\": {\"signal\": \"datum.y + 31\"}, \"width\": {\"value\": 82}, \"height\": {\"value\": 17}, \"cornerRadius\": {\"value\": 2}, \"fill\": {\"signal\": \"'#1a1a1a'\"}, \"stroke\": {\"signal\": \"'#333333'\"}, \"strokeWidth\": {\"value\": 1}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width*0.65+41\"}, \"y\": {\"signal\": \"datum.y + 43\"}, \"text\": {\"signal\": \"datum.t===sel?'SELECTED':''\"}, \"fill\": {\"signal\": \"datum.t===sel?datum.clr:'#448aff'\"}, \"fontSize\": {\"value\": 9}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"center\"}, \"letterSpacing\": {\"value\": 1}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width-10\"}, \"y\": {\"signal\": \"datum.y + 36\"}, \"text\": {\"signal\": \"datum.n>0?(datum.n>=1000?format(datum.n,'.3~s'):format(datum.n,',')):'\\u2014'\"}, \"fill\": {\"signal\": \"datum.t===sel?datum.clr:datum.n>0?'#dddddd':'#333333'\"}, \"fontSize\": {\"value\": 20}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"right\"}}}}, {\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"signal\": \"width/2\"}, \"y\": {\"signal\": \"height-8\"}, \"text\": {\"value\": \"\\u2191 at the highest tier\"}, \"fill\": {\"value\": \"#2a2a2a\"}, \"fontSize\": {\"value\": 9}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"center\"}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width / 2\"}, \"y\": {\"signal\": \"height / 2 - 8\"}, \"text\": {\"signal\": \"length(data('raw')) === 0 ? 'NO DATA FOR CURRENT FILTERS / TIME RANGE' : ''\"}, \"fill\": {\"value\": \"#666666\"}, \"font\": {\"value\": \"monospace\"}, \"fontSize\": {\"value\": 11}, \"fontWeight\": {\"value\": \"bold\"}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"zindex\": {\"value\": 100}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width / 2\"}, \"y\": {\"signal\": \"height / 2 + 12\"}, \"text\": {\"signal\": \"length(data('raw')) === 0 ? 'Adjust dashboard filters or expand the selected time range.' : ''\"}, \"fill\": {\"value\": \"#444444\"}, \"font\": {\"value\": \"monospace\"}, \"fontSize\": {\"value\": 9}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"zindex\": {\"value\": 100}}}}]}" + }, + "title": "", + "type": "vega", + "uiState": {} + } + }, + "gridData": { + "h": 18, + "i": "2d7ed859-178e-419d-9500-bfc7e9ee1448", + "w": 16, + "x": 0, + "y": 57 + }, + "panelIndex": "2d7ed859-178e-419d-9500-bfc7e9ee1448", + "type": "visualization" + }, + { + "embeddableConfig": { + "enhancements": { + "dynamicActions": { + "events": [] + } + }, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "id": "", + "params": { + "spec": "{\"$schema\": \"https://vega.github.io/schema/vega/v5.json\", \"padding\": {\"top\": 0, \"bottom\": 0, \"left\": 0, \"right\": 0}, \"background\": \"#111111\", \"signals\": [{\"name\": \"sel\", \"value\": null, \"on\": [{\"events\": {\"type\": \"click\", \"markname\": \"bg\"}, \"update\": \"datum.t === sel ? null : datum.t\", \"force\": true}]}, {\"name\": \"_kf\", \"value\": null, \"on\": [{\"events\": {\"type\": \"click\", \"markname\": \"bg\"}, \"update\": \"datum.t === sel ? kibanaRemoveFilter({'match_phrase': {'host.os_category': datum.t}}) : kibanaAddFilter({'match_phrase': {'host.os_category': datum.t}})\", \"force\": true}]}], \"data\": [{\"name\": \"raw\", \"url\": {\"%context%\": true, \"%timefield%\": \"@timestamp\", \"index\": \"tychon-pqc-inventory*\", \"body\": {\"size\": 0, \"aggs\": {\"k\": {\"terms\": {\"field\": \"host.os_category\", \"size\": 20, \"include\": [\"RHEL 10\", \"RHEL 9\", \"RHEL 8\", \"RHEL 7\"]}, \"aggs\": {\"u\": {\"cardinality\": {\"field\": \"host.id\"}}}}}}}, \"format\": {\"property\": \"aggregations.k.buckets\"}, \"transform\": [{\"type\": \"formula\", \"as\": \"t\", \"expr\": \"datum.key\"}, {\"type\": \"formula\", \"as\": \"hcount\", \"expr\": \"datum.u ? datum.u.value : 0\"}]}, {\"name\": \"tc\", \"source\": \"raw\", \"transform\": [{\"type\": \"aggregate\", \"groupby\": [\"t\"], \"ops\": [\"sum\"], \"fields\": [\"hcount\"], \"as\": [\"n\"]}]}, {\"name\": \"mx\", \"source\": \"tc\", \"transform\": [{\"type\": \"aggregate\", \"ops\": [\"max\"], \"fields\": [\"n\"], \"as\": [\"v\"]}]}, {\"name\": \"rows\", \"values\": [{\"t\": \"RHEL 10\", \"lbl\": \"RHEL 10\", \"desc\": \"OpenSSL 3.5.x \\u2014 ML-KEM/ML-DSA/SLH-DSA built-in, full NIST PQC support\", \"badge\": \"PQC READY\", \"clr\": \"#00c853\", \"bg\": \"#00c85318\", \"ord\": 0}, {\"t\": \"RHEL 9\", \"lbl\": \"RHEL 9\", \"desc\": \"OpenSSL 3.x \\u2014 TLS 1.3 default, OQS PQC provider available separately\", \"badge\": \"MODERN\", \"clr\": \"#448aff\", \"bg\": \"#448aff18\", \"ord\": 1}, {\"t\": \"RHEL 8\", \"lbl\": \"RHEL 8\", \"desc\": \"OpenSSL 1.1.1 \\u2014 TLS 1.3 supported, no native PQC support\", \"badge\": \"CLASSICAL\", \"clr\": \"#ffa726\", \"bg\": \"#ffa72618\", \"ord\": 2}, {\"t\": \"RHEL 7\", \"lbl\": \"RHEL 7\", \"desc\": \"OpenSSL 1.0.2 \\u2014 EOL Jun 2024, TLS 1.2 only, no PQC support\", \"badge\": \"LEGACY\", \"clr\": \"#ef5350\", \"bg\": \"#ef535018\", \"ord\": 3}], \"transform\": [{\"type\": \"lookup\", \"from\": \"tc\", \"key\": \"t\", \"fields\": [\"t\"], \"values\": [\"n\"], \"as\": [\"n\"], \"default\": 0}, {\"type\": \"formula\", \"as\": \"y\", \"expr\": \"datum.ord * 72 + 60\"}]}], \"marks\": [{\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"value\": 16}, \"y\": {\"value\": 18}, \"text\": {\"value\": \"RED HAT ENTERPRISE LINUX\"}, \"fill\": {\"value\": \"#cccccc\"}, \"fontSize\": {\"value\": 10}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"letterSpacing\": {\"value\": 1.5}}}}, {\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"value\": 16}, \"y\": {\"value\": 38}, \"text\": {\"value\": \"OS VERSION \\u2014 click a tier to filter\"}, \"fill\": {\"value\": \"#555555\"}, \"fontSize\": {\"value\": 9}, \"font\": {\"value\": \"monospace\"}, \"letterSpacing\": {\"value\": 1}}}}, {\"type\": \"rule\", \"encode\": {\"enter\": {\"x\": {\"value\": 0}, \"x2\": {\"signal\": \"width\"}, \"y\": {\"value\": 48}, \"stroke\": {\"value\": \"#252525\"}, \"strokeWidth\": {\"value\": 1}}}}, {\"type\": \"rect\", \"name\": \"bg\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 0}, \"y\": {\"field\": \"y\"}, \"width\": {\"signal\": \"width\"}, \"height\": {\"value\": 66}, \"fill\": {\"signal\": \"datum.t===sel?'#1c1c2e':datum.n>0?'#161622':'#161616'\"}, \"cursor\": {\"value\": \"pointer\"}}}}, {\"type\": \"rect\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 0}, \"y\": {\"field\": \"y\"}, \"width\": {\"value\": 4}, \"height\": {\"value\": 66}, \"fill\": {\"signal\": \"datum.n>0?datum.clr:'#2a2a2a'\"}}}}, {\"type\": \"rule\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 0}, \"x2\": {\"signal\": \"width\"}, \"y\": {\"signal\": \"datum.y + 65\"}, \"stroke\": {\"value\": \"#222222\"}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 18}, \"y\": {\"signal\": \"datum.y + 24\"}, \"text\": {\"signal\": \"datum.lbl\"}, \"limit\": {\"signal\": \"width*0.60-18\"}, \"ellipsis\": \"\\u2026\", \"fill\": {\"signal\": \"datum.n>0?'#e8e8e8':'#444444'\"}, \"fontSize\": {\"value\": 13}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 18}, \"y\": {\"signal\": \"datum.y + 44\"}, \"text\": {\"signal\": \"datum.desc\"}, \"limit\": {\"signal\": \"width*0.60-18\"}, \"ellipsis\": \"\\u2026\", \"fill\": {\"value\": \"#555555\"}, \"fontSize\": {\"value\": 10}, \"font\": {\"value\": \"monospace\"}}}}, {\"type\": \"rect\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width*0.65\"}, \"y\": {\"signal\": \"datum.y + 8\"}, \"width\": {\"value\": 82}, \"height\": {\"value\": 17}, \"cornerRadius\": {\"value\": 2}, \"fill\": {\"signal\": \"datum.n>0?datum.bg:'#1a1a1a'\"}, \"stroke\": {\"signal\": \"datum.n>0?datum.clr:'#2a2a2a'\"}, \"strokeWidth\": {\"value\": 1}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width*0.65+41\"}, \"y\": {\"signal\": \"datum.y + 20\"}, \"text\": {\"signal\": \"datum.badge\"}, \"fill\": {\"signal\": \"datum.n>0?datum.clr:'#383838'\"}, \"fontSize\": {\"value\": 9}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"center\"}, \"letterSpacing\": {\"value\": 1}}}}, {\"type\": \"rect\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width*0.65\"}, \"y\": {\"signal\": \"datum.y + 31\"}, \"width\": {\"value\": 82}, \"height\": {\"value\": 17}, \"cornerRadius\": {\"value\": 2}, \"fill\": {\"signal\": \"'#1a1a1a'\"}, \"stroke\": {\"signal\": \"'#333333'\"}, \"strokeWidth\": {\"value\": 1}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width*0.65+41\"}, \"y\": {\"signal\": \"datum.y + 43\"}, \"text\": {\"signal\": \"datum.t===sel?'SELECTED':''\"}, \"fill\": {\"signal\": \"datum.t===sel?datum.clr:'#448aff'\"}, \"fontSize\": {\"value\": 9}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"center\"}, \"letterSpacing\": {\"value\": 1}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width-10\"}, \"y\": {\"signal\": \"datum.y + 36\"}, \"text\": {\"signal\": \"datum.n>0?(datum.n>=1000?format(datum.n,'.3~s'):format(datum.n,',')):'\\u2014'\"}, \"fill\": {\"signal\": \"datum.t===sel?datum.clr:datum.n>0?'#dddddd':'#333333'\"}, \"fontSize\": {\"value\": 20}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"right\"}}}}, {\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"signal\": \"width/2\"}, \"y\": {\"signal\": \"height-8\"}, \"text\": {\"value\": \"\\u2191 at the highest tier\"}, \"fill\": {\"value\": \"#2a2a2a\"}, \"fontSize\": {\"value\": 9}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"center\"}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width / 2\"}, \"y\": {\"signal\": \"height / 2 - 8\"}, \"text\": {\"signal\": \"length(data('raw')) === 0 ? 'NO DATA FOR CURRENT FILTERS / TIME RANGE' : ''\"}, \"fill\": {\"value\": \"#666666\"}, \"font\": {\"value\": \"monospace\"}, \"fontSize\": {\"value\": 11}, \"fontWeight\": {\"value\": \"bold\"}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"zindex\": {\"value\": 100}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width / 2\"}, \"y\": {\"signal\": \"height / 2 + 12\"}, \"text\": {\"signal\": \"length(data('raw')) === 0 ? 'Adjust dashboard filters or expand the selected time range.' : ''\"}, \"fill\": {\"value\": \"#444444\"}, \"font\": {\"value\": \"monospace\"}, \"fontSize\": {\"value\": 9}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"zindex\": {\"value\": 100}}}}]}" + }, + "title": "", + "type": "vega", + "uiState": {} + } + }, + "gridData": { + "h": 18, + "i": "2b788a90-8404-40ce-832e-cbe6cdc4bfb5", + "w": 15, + "x": 16, + "y": 57 + }, + "panelIndex": "2b788a90-8404-40ce-832e-cbe6cdc4bfb5", + "type": "visualization" + }, + { + "embeddableConfig": { + "enhancements": { + "dynamicActions": { + "events": [] + } + }, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "id": "", + "params": { + "spec": "{\"$schema\": \"https://vega.github.io/schema/vega/v5.json\", \"padding\": {\"top\": 0, \"bottom\": 0, \"left\": 0, \"right\": 0}, \"background\": \"#111111\", \"signals\": [{\"name\": \"sel\", \"value\": null, \"on\": [{\"events\": {\"type\": \"click\", \"markname\": \"bg\"}, \"update\": \"datum.t === sel ? null : datum.t\", \"force\": true}]}, {\"name\": \"_kf\", \"value\": null, \"on\": [{\"events\": {\"type\": \"click\", \"markname\": \"bg\"}, \"update\": \"datum.t === sel ? kibanaRemoveFilter({'match_phrase': {'host.os_category': datum.t}}) : kibanaAddFilter({'match_phrase': {'host.os_category': datum.t}})\", \"force\": true}]}], \"data\": [{\"name\": \"raw\", \"url\": {\"%context%\": true, \"%timefield%\": \"@timestamp\", \"index\": \"tychon-pqc-inventory*\", \"body\": {\"size\": 0, \"aggs\": {\"k\": {\"terms\": {\"field\": \"host.os_category\", \"size\": 20, \"include\": [\"Ubuntu 26.04\", \"Ubuntu 25.04\", \"Ubuntu 24.04\", \"Ubuntu 22.04\", \"Ubuntu 20.04\"]}, \"aggs\": {\"u\": {\"cardinality\": {\"field\": \"host.id\"}}}}}}}, \"format\": {\"property\": \"aggregations.k.buckets\"}, \"transform\": [{\"type\": \"formula\", \"as\": \"t\", \"expr\": \"datum.key\"}, {\"type\": \"formula\", \"as\": \"hcount\", \"expr\": \"datum.u ? datum.u.value : 0\"}]}, {\"name\": \"tc\", \"source\": \"raw\", \"transform\": [{\"type\": \"aggregate\", \"groupby\": [\"t\"], \"ops\": [\"sum\"], \"fields\": [\"hcount\"], \"as\": [\"n\"]}]}, {\"name\": \"mx\", \"source\": \"tc\", \"transform\": [{\"type\": \"aggregate\", \"ops\": [\"max\"], \"fields\": [\"n\"], \"as\": [\"v\"]}]}, {\"name\": \"rows\", \"values\": [{\"t\": \"Ubuntu 26.04\", \"lbl\": \"Ubuntu 26.04 LTS\", \"desc\": \"OpenSSL 3.5.x \\u2014 ML-KEM/ML-DSA/SLH-DSA built-in, full NIST PQC support\", \"badge\": \"PQC READY\", \"clr\": \"#00c853\", \"bg\": \"#00c85318\", \"ord\": 0}, {\"t\": \"Ubuntu 25.04\", \"lbl\": \"Ubuntu 25.04\", \"desc\": \"OpenSSL 3.4.x \\u2014 ML-KEM/ML-DSA built-in, NIST PQC without oqs-provider\", \"badge\": \"PQC READY\", \"clr\": \"#00c853\", \"bg\": \"#00c85318\", \"ord\": 1}, {\"t\": \"Ubuntu 24.04\", \"lbl\": \"Ubuntu 24.04 LTS\", \"desc\": \"OpenSSL 3.0.x \\u2014 TLS 1.3 default, OQS PQC provider available separately\", \"badge\": \"MODERN\", \"clr\": \"#448aff\", \"bg\": \"#448aff18\", \"ord\": 2}, {\"t\": \"Ubuntu 22.04\", \"lbl\": \"Ubuntu 22.04 LTS\", \"desc\": \"OpenSSL 3.0.x \\u2014 TLS 1.3 default, no native PQC support\", \"badge\": \"MODERN\", \"clr\": \"#448aff\", \"bg\": \"#448aff18\", \"ord\": 3}, {\"t\": \"Ubuntu 20.04\", \"lbl\": \"Ubuntu 20.04 LTS\", \"desc\": \"OpenSSL 1.1.1 \\u2014 TLS 1.3 capable, standard support ends Apr 2025\", \"badge\": \"CLASSICAL\", \"clr\": \"#ffa726\", \"bg\": \"#ffa72618\", \"ord\": 4}], \"transform\": [{\"type\": \"lookup\", \"from\": \"tc\", \"key\": \"t\", \"fields\": [\"t\"], \"values\": [\"n\"], \"as\": [\"n\"], \"default\": 0}, {\"type\": \"formula\", \"as\": \"y\", \"expr\": \"datum.ord * 72 + 60\"}]}], \"marks\": [{\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"value\": 16}, \"y\": {\"value\": 18}, \"text\": {\"value\": \"UBUNTU\"}, \"fill\": {\"value\": \"#cccccc\"}, \"fontSize\": {\"value\": 10}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"letterSpacing\": {\"value\": 1.5}}}}, {\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"value\": 16}, \"y\": {\"value\": 38}, \"text\": {\"value\": \"OS VERSION \\u2014 click a tier to filter\"}, \"fill\": {\"value\": \"#555555\"}, \"fontSize\": {\"value\": 9}, \"font\": {\"value\": \"monospace\"}, \"letterSpacing\": {\"value\": 1}}}}, {\"type\": \"rule\", \"encode\": {\"enter\": {\"x\": {\"value\": 0}, \"x2\": {\"signal\": \"width\"}, \"y\": {\"value\": 48}, \"stroke\": {\"value\": \"#252525\"}, \"strokeWidth\": {\"value\": 1}}}}, {\"type\": \"rect\", \"name\": \"bg\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 0}, \"y\": {\"field\": \"y\"}, \"width\": {\"signal\": \"width\"}, \"height\": {\"value\": 66}, \"fill\": {\"signal\": \"datum.t===sel?'#1c1c2e':datum.n>0?'#161622':'#161616'\"}, \"cursor\": {\"value\": \"pointer\"}}}}, {\"type\": \"rect\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 0}, \"y\": {\"field\": \"y\"}, \"width\": {\"value\": 4}, \"height\": {\"value\": 66}, \"fill\": {\"signal\": \"datum.n>0?datum.clr:'#2a2a2a'\"}}}}, {\"type\": \"rule\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 0}, \"x2\": {\"signal\": \"width\"}, \"y\": {\"signal\": \"datum.y + 65\"}, \"stroke\": {\"value\": \"#222222\"}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 18}, \"y\": {\"signal\": \"datum.y + 24\"}, \"text\": {\"signal\": \"datum.lbl\"}, \"limit\": {\"signal\": \"width*0.60-18\"}, \"ellipsis\": \"\\u2026\", \"fill\": {\"signal\": \"datum.n>0?'#e8e8e8':'#444444'\"}, \"fontSize\": {\"value\": 13}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 18}, \"y\": {\"signal\": \"datum.y + 44\"}, \"text\": {\"signal\": \"datum.desc\"}, \"limit\": {\"signal\": \"width*0.60-18\"}, \"ellipsis\": \"\\u2026\", \"fill\": {\"value\": \"#555555\"}, \"fontSize\": {\"value\": 10}, \"font\": {\"value\": \"monospace\"}}}}, {\"type\": \"rect\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width*0.65\"}, \"y\": {\"signal\": \"datum.y + 8\"}, \"width\": {\"value\": 82}, \"height\": {\"value\": 17}, \"cornerRadius\": {\"value\": 2}, \"fill\": {\"signal\": \"datum.n>0?datum.bg:'#1a1a1a'\"}, \"stroke\": {\"signal\": \"datum.n>0?datum.clr:'#2a2a2a'\"}, \"strokeWidth\": {\"value\": 1}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width*0.65+41\"}, \"y\": {\"signal\": \"datum.y + 20\"}, \"text\": {\"signal\": \"datum.badge\"}, \"fill\": {\"signal\": \"datum.n>0?datum.clr:'#383838'\"}, \"fontSize\": {\"value\": 9}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"center\"}, \"letterSpacing\": {\"value\": 1}}}}, {\"type\": \"rect\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width*0.65\"}, \"y\": {\"signal\": \"datum.y + 31\"}, \"width\": {\"value\": 82}, \"height\": {\"value\": 17}, \"cornerRadius\": {\"value\": 2}, \"fill\": {\"signal\": \"'#1a1a1a'\"}, \"stroke\": {\"signal\": \"'#333333'\"}, \"strokeWidth\": {\"value\": 1}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width*0.65+41\"}, \"y\": {\"signal\": \"datum.y + 43\"}, \"text\": {\"signal\": \"datum.t===sel?'SELECTED':''\"}, \"fill\": {\"signal\": \"datum.t===sel?datum.clr:'#448aff'\"}, \"fontSize\": {\"value\": 9}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"center\"}, \"letterSpacing\": {\"value\": 1}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width-10\"}, \"y\": {\"signal\": \"datum.y + 36\"}, \"text\": {\"signal\": \"datum.n>0?(datum.n>=1000?format(datum.n,'.3~s'):format(datum.n,',')):'\\u2014'\"}, \"fill\": {\"signal\": \"datum.t===sel?datum.clr:datum.n>0?'#dddddd':'#333333'\"}, \"fontSize\": {\"value\": 20}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"right\"}}}}, {\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"signal\": \"width/2\"}, \"y\": {\"signal\": \"height-8\"}, \"text\": {\"value\": \"\\u2191 at the highest tier\"}, \"fill\": {\"value\": \"#2a2a2a\"}, \"fontSize\": {\"value\": 9}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"center\"}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width / 2\"}, \"y\": {\"signal\": \"height / 2 - 8\"}, \"text\": {\"signal\": \"length(data('raw')) === 0 ? 'NO DATA FOR CURRENT FILTERS / TIME RANGE' : ''\"}, \"fill\": {\"value\": \"#666666\"}, \"font\": {\"value\": \"monospace\"}, \"fontSize\": {\"value\": 11}, \"fontWeight\": {\"value\": \"bold\"}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"zindex\": {\"value\": 100}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width / 2\"}, \"y\": {\"signal\": \"height / 2 + 12\"}, \"text\": {\"signal\": \"length(data('raw')) === 0 ? 'Adjust dashboard filters or expand the selected time range.' : ''\"}, \"fill\": {\"value\": \"#444444\"}, \"font\": {\"value\": \"monospace\"}, \"fontSize\": {\"value\": 9}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"zindex\": {\"value\": 100}}}}]}" + }, + "title": "", + "type": "vega", + "uiState": {} + } + }, + "gridData": { + "h": 18, + "i": "31106bc5-1c4d-4890-a085-22581cdc5f4c", + "w": 17, + "x": 31, + "y": 57 + }, + "panelIndex": "31106bc5-1c4d-4890-a085-22581cdc5f4c", + "type": "visualization" + } + ], + "timeRestore": false, + "title": "[TYCHON Quantum Command] Inventory", + "version": 3 + }, + "coreMigrationVersion": "8.8.0", + "created_at": "2026-07-20T16:55:14.701Z", + "id": "tychon_quantum_command-32c01eb5-0d80-4a28-9de7-55b2046f7c45-inventory", + "references": [ + { + "id": "tychon_quantum_command-02366033-dee4-4ea4-8458-7c8a8b58987e-cost-analysis", + "name": "0ccceeab-cd4b-4170-99a4-8e45770e048b:drilldown:DASHBOARD_TO_DASHBOARD_DRILLDOWN:57dde807-dddf-51b2-832a-36d295102863:dashboardId", + "type": "dashboard" + }, + { + "id": "tychon_quantum_command-d0159137-9139-4a93-85bb-2ac9ddab3982-certificate-operations-dashboard", + "name": "63e69b30-7da2-4962-ad90-575262384727:drilldown:DASHBOARD_TO_DASHBOARD_DRILLDOWN:30c0b8ba-7a54-5cab-ac59-232baa7bb8b8:dashboardId", + "type": "dashboard" + }, + { + "id": "tychon_quantum_command-443e5928-b1c4-4e07-b0b9-c675dd057e2f-application-report", + "name": "df9e2eaf-bfe4-4443-9b68-c192dee2365a:drilldown:DASHBOARD_TO_DASHBOARD_DRILLDOWN:6801ef79-6e41-585d-b31a-e75702561c24:dashboardId", + "type": "dashboard" + }, + { + "id": "tychon_quantum_command-07b6a21f-5bba-413b-8d49-e8c246dde2ba", + "name": "tag-ref-tychon_quantum_command-07b6a21f-5bba-413b-8d49-e8c246dde2ba", + "type": "tag" + }, + { + "id": "tychon_quantum_command-dacb217e-57b4-4296-8545-cbf6b5739344", + "name": "tag-ref-tychon_quantum_command-dacb217e-57b4-4296-8545-cbf6b5739344", + "type": "tag" + }, + { + "id": "tychon_quantum_command-e9b715ba-5f19-4f99-b837-2c1a24143212", + "name": "tag-ref-tychon_quantum_command-e9b715ba-5f19-4f99-b837-2c1a24143212", + "type": "tag" + } + ], + "type": "dashboard", + "typeMigrationVersion": "10.3.0" +} diff --git a/packages/tychon_quantum_command/kibana/dashboard/tychon_quantum_command-443e5928-b1c4-4e07-b0b9-c675dd057e2f-application-report.json b/packages/tychon_quantum_command/kibana/dashboard/tychon_quantum_command-443e5928-b1c4-4e07-b0b9-c675dd057e2f-application-report.json new file mode 100644 index 00000000000..28e8e762ef0 --- /dev/null +++ b/packages/tychon_quantum_command/kibana/dashboard/tychon_quantum_command-443e5928-b1c4-4e07-b0b9-c675dd057e2f-application-report.json @@ -0,0 +1,2533 @@ +{ + "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": { + "ignoreFilters": false, + "ignoreQuery": false, + "ignoreTimerange": false, + "ignoreValidations": false + }, + "panelsJSON": {}, + "showApplySelections": false + }, + "description": "Aligns to schema 2.0.3.", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "useMargins": false + }, + "panelsJSON": [ + { + "embeddableConfig": { + "enhancements": {}, + "hidePanelTitles": true, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "id": "", + "params": { + "fontSize": 12, + "markdown": "[Inventory](/app/dashboards#/view/tychon_quantum_command-32c01eb5-0d80-4a28-9de7-55b2046f7c45-inventory) | Application Report | [Application Detail](/app/dashboards#/view/tychon_quantum_command-6dfff015-3cc9-48b6-9410-7d8c01ff0d9a-application-detail) | [Certificate Report](/app/dashboards#/view/tychon_quantum_command-d0159137-9139-4a93-85bb-2ac9ddab3982-certificate-operations-dashboard) | [Application Connections Topology](/app/dashboards#/view/tychon_quantum_command-6f3d60d5-b5fb-45a5-9298-acf3ceb3ea1b-application-connections-topology) | [Cost Analysis](/app/dashboards#/view/tychon_quantum_command-02366033-dee4-4ea4-8458-7c8a8b58987e-cost-analysis)", + "openLinksInNewTab": false + }, + "title": "", + "type": "markdown", + "uiState": {} + } + }, + "gridData": { + "h": 3, + "i": "tychon-quantum-command-nav", + "w": 48, + "x": 0, + "y": 0 + }, + "panelIndex": "tychon-quantum-command-nav", + "title": "", + "type": "visualization" + }, + { + "embeddableConfig": { + "enhancements": { + "dynamicActions": { + "events": [] + } + }, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "id": "", + "params": { + "spec": "{\"$schema\": \"https://vega.github.io/schema/vega/v5.json\", \"padding\": {\"top\": 0, \"bottom\": 0, \"left\": 0, \"right\": 0}, \"background\": \"#111111\", \"signals\": [{\"name\": \"sel\", \"value\": null, \"on\": [{\"events\": {\"type\": \"click\", \"markname\": \"bg\"}, \"update\": \"datum.t === sel ? null : datum.t\", \"force\": true}]}, {\"name\": \"_kf\", \"value\": null, \"on\": [{\"events\": {\"type\": \"click\", \"markname\": \"bg\"}, \"update\": \"datum.t === sel ? kibanaRemoveFilter({'match_phrase': {'omb.kex_tier': datum.t}}) : kibanaAddFilter({'match_phrase': {'omb.kex_tier': datum.t}})\", \"force\": true}]}], \"data\": [{\"name\": \"raw\", \"url\": {\"%context%\": true, \"%timefield%\": \"@timestamp\", \"index\": \"tychon-pqc-inventory*\", \"body\": {\"size\": 0, \"aggs\": {\"k\": {\"terms\": {\"field\": \"omb.kex_tier\", \"size\": 20}, \"aggs\": {\"u\": {\"cardinality\": {\"field\": \"process.executable\"}}}}}}}, \"format\": {\"property\": \"aggregations.k.buckets\"}, \"transform\": [{\"type\": \"formula\", \"as\": \"t\", \"expr\": \"datum.key\"}, {\"type\": \"formula\", \"as\": \"hcount\", \"expr\": \"datum.u ? datum.u.value : 0\"}]}, {\"name\": \"tc\", \"source\": \"raw\", \"transform\": [{\"type\": \"aggregate\", \"groupby\": [\"t\"], \"ops\": [\"sum\"], \"fields\": [\"hcount\"], \"as\": [\"n\"]}]}, {\"name\": \"mx\", \"source\": \"tc\", \"transform\": [{\"type\": \"aggregate\", \"ops\": [\"max\"], \"fields\": [\"n\"], \"as\": [\"v\"]}]}, {\"name\": \"rows\", \"values\": [{\"t\": \"PQC READY\", \"lbl\": \"ML-KEM / Kyber\", \"desc\": \"Post-quantum \\u2014 harvest-proof\", \"badge\": \"PQC READY\", \"clr\": \"#00c853\", \"bg\": \"#00c85318\", \"ord\": 0}, {\"t\": \"MODERN\", \"lbl\": \"X25519 / ECDHE\", \"desc\": \"Elliptic curve \\u2014 quantum-vulnerable\", \"badge\": \"MODERN\", \"clr\": \"#448aff\", \"bg\": \"#448aff18\", \"ord\": 1}, {\"t\": \"CLASSICAL\", \"lbl\": \"DHE / DH\", \"desc\": \"Finite-field DH \\u2014 quantum-vulnerable\", \"badge\": \"CLASSICAL\", \"clr\": \"#ffa726\", \"bg\": \"#ffa72618\", \"ord\": 2}, {\"t\": \"LEGACY\", \"lbl\": \"RSA Key Exchange\", \"desc\": \"No forward secrecy \\u2014 deprecated\", \"badge\": \"LEGACY\", \"clr\": \"#ef5350\", \"bg\": \"#ef535018\", \"ord\": 3}], \"transform\": [{\"type\": \"lookup\", \"from\": \"tc\", \"key\": \"t\", \"fields\": [\"t\"], \"values\": [\"n\"], \"as\": [\"n\"], \"default\": 0}, {\"type\": \"formula\", \"as\": \"y\", \"expr\": \"datum.ord * 72 + 60\"}]}], \"marks\": [{\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"value\": 16}, \"y\": {\"value\": 18}, \"text\": {\"value\": \"POST-QUANTUM CRYPTOGRAPHY READINESS\"}, \"fill\": {\"value\": \"#cccccc\"}, \"fontSize\": {\"value\": 10}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"letterSpacing\": {\"value\": 1.5}}}}, {\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"value\": 16}, \"y\": {\"value\": 38}, \"text\": {\"value\": \"KEY EXCHANGE \\u2014 click a tier to filter\"}, \"fill\": {\"value\": \"#555555\"}, \"fontSize\": {\"value\": 9}, \"font\": {\"value\": \"monospace\"}, \"letterSpacing\": {\"value\": 1}}}}, {\"type\": \"rule\", \"encode\": {\"enter\": {\"x\": {\"value\": 0}, \"x2\": {\"signal\": \"width\"}, \"y\": {\"value\": 48}, \"stroke\": {\"value\": \"#252525\"}, \"strokeWidth\": {\"value\": 1}}}}, {\"type\": \"rect\", \"name\": \"bg\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 0}, \"y\": {\"field\": \"y\"}, \"width\": {\"signal\": \"width\"}, \"height\": {\"value\": 66}, \"fill\": {\"signal\": \"datum.t===sel?'#1c1c2e':datum.n>0?'#161622':'#161616'\"}, \"cursor\": {\"value\": \"pointer\"}}}}, {\"type\": \"rect\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 0}, \"y\": {\"field\": \"y\"}, \"width\": {\"value\": 4}, \"height\": {\"value\": 66}, \"fill\": {\"signal\": \"datum.n>0?datum.clr:'#2a2a2a'\"}}}}, {\"type\": \"rule\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 0}, \"x2\": {\"signal\": \"width\"}, \"y\": {\"signal\": \"datum.y + 65\"}, \"stroke\": {\"value\": \"#222222\"}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 18}, \"y\": {\"signal\": \"datum.y + 24\"}, \"text\": {\"signal\": \"datum.lbl\"}, \"limit\": {\"signal\": \"width*0.62-18\"}, \"fill\": {\"signal\": \"datum.n>0?'#e8e8e8':'#444444'\"}, \"fontSize\": {\"value\": 13}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 18}, \"y\": {\"signal\": \"datum.y + 44\"}, \"text\": {\"signal\": \"datum.desc\"}, \"limit\": {\"signal\": \"width*0.62-18\"}, \"fill\": {\"value\": \"#555555\"}, \"fontSize\": {\"value\": 10}, \"font\": {\"value\": \"monospace\"}}}}, {\"type\": \"rect\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width*0.65\"}, \"y\": {\"signal\": \"datum.y + 8\"}, \"width\": {\"value\": 82}, \"height\": {\"value\": 17}, \"cornerRadius\": {\"value\": 2}, \"fill\": {\"signal\": \"datum.n>0?datum.bg:'#1a1a1a'\"}, \"stroke\": {\"signal\": \"datum.n>0?datum.clr:'#2a2a2a'\"}, \"strokeWidth\": {\"value\": 1}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width*0.65+41\"}, \"y\": {\"signal\": \"datum.y + 20\"}, \"text\": {\"signal\": \"datum.badge\"}, \"fill\": {\"signal\": \"datum.n>0?datum.clr:'#383838'\"}, \"fontSize\": {\"value\": 9}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"center\"}, \"letterSpacing\": {\"value\": 1}}}}, {\"type\": \"rect\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width*0.65\"}, \"y\": {\"signal\": \"datum.y + 31\"}, \"width\": {\"value\": 82}, \"height\": {\"value\": 17}, \"cornerRadius\": {\"value\": 2}, \"fill\": {\"signal\": \"'#1a1a1a'\"}, \"stroke\": {\"signal\": \"'#333333'\"}, \"strokeWidth\": {\"value\": 1}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width*0.65+41\"}, \"y\": {\"signal\": \"datum.y + 43\"}, \"text\": {\"signal\": \"datum.t===sel?'SELECTED':''\"}, \"fill\": {\"signal\": \"datum.t===sel?datum.clr:'#448aff'\"}, \"fontSize\": {\"value\": 9}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"center\"}, \"letterSpacing\": {\"value\": 1}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width-10\"}, \"y\": {\"signal\": \"datum.y + 36\"}, \"text\": {\"signal\": \"datum.n>0?(datum.n>=1000?format(datum.n,'.3~s'):format(datum.n,',')):'\\u2014'\"}, \"fill\": {\"signal\": \"datum.t===sel?datum.clr:datum.n>0?'#dddddd':'#333333'\"}, \"fontSize\": {\"value\": 20}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"right\"}}}}, {\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"signal\": \"width/2\"}, \"y\": {\"signal\": \"height-8\"}, \"text\": {\"value\": \"\\u2191 at the highest tier\"}, \"fill\": {\"value\": \"#2a2a2a\"}, \"fontSize\": {\"value\": 9}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"center\"}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width / 2\"}, \"y\": {\"signal\": \"height / 2 - 8\"}, \"text\": {\"signal\": \"length(data('raw')) === 0 ? 'NO DATA FOR CURRENT FILTERS / TIME RANGE' : ''\"}, \"fill\": {\"value\": \"#666666\"}, \"font\": {\"value\": \"monospace\"}, \"fontSize\": {\"value\": 11}, \"fontWeight\": {\"value\": \"bold\"}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"zindex\": {\"value\": 100}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width / 2\"}, \"y\": {\"signal\": \"height / 2 + 12\"}, \"text\": {\"signal\": \"length(data('raw')) === 0 ? 'Adjust dashboard filters or expand the selected time range.' : ''\"}, \"fill\": {\"value\": \"#444444\"}, \"font\": {\"value\": \"monospace\"}, \"fontSize\": {\"value\": 9}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"zindex\": {\"value\": 100}}}}]}" + }, + "title": "", + "type": "vega", + "uiState": {} + } + }, + "gridData": { + "h": 19, + "i": "b5127f43-801b-4411-a631-e5c71ca96645", + "w": 16, + "x": 0, + "y": 2 + }, + "panelIndex": "b5127f43-801b-4411-a631-e5c71ca96645", + "type": "visualization" + }, + { + "embeddableConfig": { + "enhancements": { + "dynamicActions": { + "events": [] + } + }, + "hidePanelTitles": true, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "id": "", + "params": { + "spec": "{\"$schema\": \"https://vega.github.io/schema/vega/v5.json\", \"padding\": {\"top\": 0, \"bottom\": 0, \"left\": 0, \"right\": 0}, \"background\": \"#111111\", \"signals\": [{\"name\": \"totalApps\", \"update\": \"length(data('apps_total'))>0 ? data('apps_total')[0].n : 0\"}, {\"name\": \"kexReady\", \"update\": \"length(data('kex_pqc'))>0 ? data('kex_pqc')[0].n : 0\"}, {\"name\": \"kexPct\", \"update\": \"totalApps > 0 ? round(kexReady / totalApps * 100) : 0\"}, {\"name\": \"kexClr\", \"update\": \"kexPct>=90 ? '#00c853' : kexPct>=60 ? '#448aff' : kexPct>=30 ? '#ffa726' : '#ef5350'\"}, {\"name\": \"protoReady\", \"update\": \"length(data('proto_pqc'))>0 ? data('proto_pqc')[0].n : 0\"}, {\"name\": \"protoPct\", \"update\": \"totalApps > 0 ? round(protoReady / totalApps * 100) : 0\"}, {\"name\": \"protoClr\", \"update\": \"protoPct>=90 ? '#00c853' : protoPct>=60 ? '#448aff' : protoPct>=30 ? '#ffa726' : '#ef5350'\"}, {\"name\": \"sigReady\", \"update\": \"length(data('sig_pqc'))>0 ? data('sig_pqc')[0].n : 0\"}, {\"name\": \"sigPct\", \"update\": \"totalApps > 0 ? round(sigReady / totalApps * 100) : 0\"}, {\"name\": \"sigClr\", \"update\": \"sigPct>=90 ? '#00c853' : sigPct>=60 ? '#448aff' : sigPct>=30 ? '#ffa726' : '#ef5350'\"}, {\"name\": \"barW\", \"update\": \"width * 0.62 - 18\"}], \"data\": [{\"name\": \"apps_raw\", \"url\": {\"%context%\": true, \"%timefield%\": \"@timestamp\", \"index\": \"tychon-pqc-inventory*\", \"body\": {\"size\": 0, \"aggs\": {\"v\": {\"cardinality\": {\"field\": \"process.executable\"}}}}}, \"format\": {\"property\": \"aggregations.v\"}, \"transform\": [{\"type\": \"formula\", \"as\": \"n\", \"expr\": \"datum.value\"}]}, {\"name\": \"apps_total\", \"source\": \"apps_raw\"}, {\"name\": \"kex_pqc_raw\", \"url\": {\"%context%\": true, \"%timefield%\": \"@timestamp\", \"index\": \"tychon-pqc-inventory*\", \"body\": {\"size\": 0, \"aggs\": {\"f\": {\"filter\": {\"term\": {\"omb.kex_tier\": \"PQC READY\"}}, \"aggs\": {\"u\": {\"cardinality\": {\"field\": \"process.executable\"}}}}}}}, \"format\": {\"property\": \"aggregations.f.u\"}, \"transform\": [{\"type\": \"formula\", \"as\": \"n\", \"expr\": \"datum.value\"}]}, {\"name\": \"kex_pqc\", \"source\": \"kex_pqc_raw\"}, {\"name\": \"proto_pqc_raw\", \"url\": {\"%context%\": true, \"%timefield%\": \"@timestamp\", \"index\": \"tychon-pqc-inventory*\", \"body\": {\"size\": 0, \"aggs\": {\"f\": {\"filter\": {\"term\": {\"omb.protocol_tier\": \"TLS 1.3\"}}, \"aggs\": {\"u\": {\"cardinality\": {\"field\": \"process.executable\"}}}}}}}, \"format\": {\"property\": \"aggregations.f.u\"}, \"transform\": [{\"type\": \"formula\", \"as\": \"n\", \"expr\": \"datum.value\"}]}, {\"name\": \"proto_pqc\", \"source\": \"proto_pqc_raw\"}, {\"name\": \"sig_pqc_raw\", \"url\": {\"%context%\": true, \"%timefield%\": \"@timestamp\", \"index\": \"tychon-pqc-inventory*\", \"body\": {\"size\": 0, \"aggs\": {\"f\": {\"filter\": {\"term\": {\"omb.sig_tier\": \"PQC READY\"}}, \"aggs\": {\"u\": {\"cardinality\": {\"field\": \"process.executable\"}}}}}}}, \"format\": {\"property\": \"aggregations.f.u\"}, \"transform\": [{\"type\": \"formula\", \"as\": \"n\", \"expr\": \"datum.value\"}]}, {\"name\": \"sig_pqc\", \"source\": \"sig_pqc_raw\"}], \"marks\": [{\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"value\": 16}, \"y\": {\"value\": 22}, \"text\": {\"value\": \"APPLICATION PQC DASHBOARD\"}, \"fill\": {\"value\": \"#cccccc\"}, \"fontSize\": {\"value\": 11}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"letterSpacing\": {\"value\": 1.5}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"value\": 16}, \"y\": {\"value\": 40}, \"text\": {\"signal\": \"'PQC COMPLIANCE PROGRESS \\u2014 ' + (totalApps>=1000?format(totalApps,'.3~s'):format(totalApps,',')) + ' unique applications'\"}, \"fill\": {\"value\": \"#555555\"}, \"fontSize\": {\"value\": 9}, \"font\": {\"value\": \"monospace\"}, \"letterSpacing\": {\"value\": 1}}}}, {\"type\": \"rule\", \"encode\": {\"enter\": {\"x\": {\"value\": 0}, \"x2\": {\"signal\": \"width\"}, \"y\": {\"value\": 48}, \"stroke\": {\"value\": \"#252525\"}, \"strokeWidth\": {\"value\": 1}}}}, {\"type\": \"rect\", \"encode\": {\"update\": {\"x\": {\"value\": 0}, \"y\": {\"value\": 60}, \"width\": {\"signal\": \"width\"}, \"height\": {\"value\": 78}, \"fill\": {\"value\": \"#161616\"}}}}, {\"type\": \"rect\", \"encode\": {\"update\": {\"x\": {\"value\": 0}, \"y\": {\"value\": 60}, \"width\": {\"value\": 4}, \"height\": {\"value\": 78}, \"fill\": {\"signal\": \"kexClr\"}}}}, {\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"value\": 18}, \"y\": {\"value\": 78}, \"text\": {\"value\": \"KEX COMPLIANCE\"}, \"fill\": {\"value\": \"#888888\"}, \"fontSize\": {\"value\": 9}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"letterSpacing\": {\"value\": 1}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"value\": 18}, \"y\": {\"value\": 93}, \"text\": {\"signal\": \"(kexReady>=1000?format(kexReady,'.3~s'):format(kexReady,',')) + ' of ' + (totalApps>=1000?format(totalApps,'.3~s'):format(totalApps,',')) + ' applications \\u2014 PQC READY key exchange'\"}, \"fill\": {\"value\": \"#444444\"}, \"fontSize\": {\"value\": 9}, \"font\": {\"value\": \"monospace\"}}}}, {\"type\": \"rect\", \"encode\": {\"update\": {\"x\": {\"value\": 18}, \"y\": {\"value\": 106}, \"width\": {\"signal\": \"barW\"}, \"height\": {\"value\": 8}, \"cornerRadius\": {\"value\": 4}, \"fill\": {\"value\": \"#1e1e1e\"}, \"stroke\": {\"value\": \"#2a2a2a\"}, \"strokeWidth\": {\"value\": 1}}}}, {\"type\": \"rect\", \"encode\": {\"update\": {\"x\": {\"value\": 18}, \"y\": {\"value\": 106}, \"width\": {\"signal\": \"max(0, barW * kexPct / 100)\"}, \"height\": {\"value\": 8}, \"cornerRadius\": {\"value\": 4}, \"fill\": {\"signal\": \"kexClr\"}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width - 10\"}, \"y\": {\"value\": 122}, \"text\": {\"signal\": \"kexPct + '%'\"}, \"fill\": {\"signal\": \"kexClr\"}, \"fontSize\": {\"value\": 24}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"right\"}}}}, {\"type\": \"rule\", \"encode\": {\"enter\": {\"x\": {\"value\": 0}, \"x2\": {\"signal\": \"width\"}, \"y\": {\"value\": 138}, \"stroke\": {\"value\": \"#222222\"}, \"strokeWidth\": {\"value\": 1}}}}, {\"type\": \"rect\", \"encode\": {\"update\": {\"x\": {\"value\": 0}, \"y\": {\"value\": 140}, \"width\": {\"signal\": \"width\"}, \"height\": {\"value\": 78}, \"fill\": {\"value\": \"#161616\"}}}}, {\"type\": \"rect\", \"encode\": {\"update\": {\"x\": {\"value\": 0}, \"y\": {\"value\": 140}, \"width\": {\"value\": 4}, \"height\": {\"value\": 78}, \"fill\": {\"signal\": \"protoClr\"}}}}, {\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"value\": 18}, \"y\": {\"value\": 158}, \"text\": {\"value\": \"PROTOCOL COMPLIANCE\"}, \"fill\": {\"value\": \"#888888\"}, \"fontSize\": {\"value\": 9}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"letterSpacing\": {\"value\": 1}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"value\": 18}, \"y\": {\"value\": 173}, \"text\": {\"signal\": \"(protoReady>=1000?format(protoReady,'.3~s'):format(protoReady,',')) + ' of ' + (totalApps>=1000?format(totalApps,'.3~s'):format(totalApps,',')) + ' applications \\u2014 TLS 1.3 capable'\"}, \"fill\": {\"value\": \"#444444\"}, \"fontSize\": {\"value\": 9}, \"font\": {\"value\": \"monospace\"}}}}, {\"type\": \"rect\", \"encode\": {\"update\": {\"x\": {\"value\": 18}, \"y\": {\"value\": 186}, \"width\": {\"signal\": \"barW\"}, \"height\": {\"value\": 8}, \"cornerRadius\": {\"value\": 4}, \"fill\": {\"value\": \"#1e1e1e\"}, \"stroke\": {\"value\": \"#2a2a2a\"}, \"strokeWidth\": {\"value\": 1}}}}, {\"type\": \"rect\", \"encode\": {\"update\": {\"x\": {\"value\": 18}, \"y\": {\"value\": 186}, \"width\": {\"signal\": \"max(0, barW * protoPct / 100)\"}, \"height\": {\"value\": 8}, \"cornerRadius\": {\"value\": 4}, \"fill\": {\"signal\": \"protoClr\"}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width - 10\"}, \"y\": {\"value\": 202}, \"text\": {\"signal\": \"protoPct + '%'\"}, \"fill\": {\"signal\": \"protoClr\"}, \"fontSize\": {\"value\": 24}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"right\"}}}}, {\"type\": \"rule\", \"encode\": {\"enter\": {\"x\": {\"value\": 0}, \"x2\": {\"signal\": \"width\"}, \"y\": {\"value\": 218}, \"stroke\": {\"value\": \"#222222\"}, \"strokeWidth\": {\"value\": 1}}}}, {\"type\": \"rect\", \"encode\": {\"update\": {\"x\": {\"value\": 0}, \"y\": {\"value\": 220}, \"width\": {\"signal\": \"width\"}, \"height\": {\"value\": 78}, \"fill\": {\"value\": \"#161616\"}}}}, {\"type\": \"rect\", \"encode\": {\"update\": {\"x\": {\"value\": 0}, \"y\": {\"value\": 220}, \"width\": {\"value\": 4}, \"height\": {\"value\": 78}, \"fill\": {\"signal\": \"sigClr\"}}}}, {\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"value\": 18}, \"y\": {\"value\": 238}, \"text\": {\"value\": \"CERT SIGNATURE\"}, \"fill\": {\"value\": \"#888888\"}, \"fontSize\": {\"value\": 9}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"letterSpacing\": {\"value\": 1}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"value\": 18}, \"y\": {\"value\": 253}, \"text\": {\"signal\": \"(sigReady>=1000?format(sigReady,'.3~s'):format(sigReady,',')) + ' of ' + (totalApps>=1000?format(totalApps,'.3~s'):format(totalApps,',')) + ' applications \\u2014 PQC READY signature'\"}, \"fill\": {\"value\": \"#444444\"}, \"fontSize\": {\"value\": 9}, \"font\": {\"value\": \"monospace\"}}}}, {\"type\": \"rect\", \"encode\": {\"update\": {\"x\": {\"value\": 18}, \"y\": {\"value\": 266}, \"width\": {\"signal\": \"barW\"}, \"height\": {\"value\": 8}, \"cornerRadius\": {\"value\": 4}, \"fill\": {\"value\": \"#1e1e1e\"}, \"stroke\": {\"value\": \"#2a2a2a\"}, \"strokeWidth\": {\"value\": 1}}}}, {\"type\": \"rect\", \"encode\": {\"update\": {\"x\": {\"value\": 18}, \"y\": {\"value\": 266}, \"width\": {\"signal\": \"max(0, barW * sigPct / 100)\"}, \"height\": {\"value\": 8}, \"cornerRadius\": {\"value\": 4}, \"fill\": {\"signal\": \"sigClr\"}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width - 10\"}, \"y\": {\"value\": 282}, \"text\": {\"signal\": \"sigPct + '%'\"}, \"fill\": {\"signal\": \"sigClr\"}, \"fontSize\": {\"value\": 24}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"right\"}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width / 2\"}, \"y\": {\"signal\": \"height / 2 - 8\"}, \"text\": {\"signal\": \"length(data('apps_raw')) === 0 ? 'NO DATA FOR CURRENT FILTERS / TIME RANGE' : ''\"}, \"fill\": {\"value\": \"#666666\"}, \"font\": {\"value\": \"monospace\"}, \"fontSize\": {\"value\": 11}, \"fontWeight\": {\"value\": \"bold\"}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"zindex\": {\"value\": 100}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width / 2\"}, \"y\": {\"signal\": \"height / 2 + 12\"}, \"text\": {\"signal\": \"length(data('apps_raw')) === 0 ? 'Adjust dashboard filters or expand the selected time range.' : ''\"}, \"fill\": {\"value\": \"#444444\"}, \"font\": {\"value\": \"monospace\"}, \"fontSize\": {\"value\": 9}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"zindex\": {\"value\": 100}}}}]}" + }, + "title": "", + "type": "vega", + "uiState": {} + } + }, + "gridData": { + "h": 19, + "i": "1192b05f-8047-4601-ba71-3f601169574b", + "w": 15, + "x": 16, + "y": 2 + }, + "panelIndex": "1192b05f-8047-4601-ba71-3f601169574b", + "title": "", + "type": "visualization" + }, + { + "embeddableConfig": { + "enhancements": { + "dynamicActions": { + "events": [] + } + }, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "id": "", + "params": { + "spec": "{\"$schema\": \"https://vega.github.io/schema/vega/v5.json\", \"padding\": {\"top\": 0, \"bottom\": 0, \"left\": 0, \"right\": 0}, \"background\": \"#111111\", \"signals\": [{\"name\": \"sel\", \"value\": null, \"on\": [{\"events\": {\"type\": \"click\", \"markname\": \"bg\"}, \"update\": \"datum.t === sel ? null : datum.t\", \"force\": true}]}, {\"name\": \"_kf\", \"value\": null, \"on\": [{\"events\": {\"type\": \"click\", \"markname\": \"bg\"}, \"update\": \"datum.t === sel ? kibanaRemoveFilter({'match_phrase': {'omb.sig_tier': datum.t}}) : kibanaAddFilter({'match_phrase': {'omb.sig_tier': datum.t}})\", \"force\": true}]}], \"data\": [{\"name\": \"raw\", \"url\": {\"%context%\": true, \"%timefield%\": \"@timestamp\", \"index\": \"tychon-pqc-inventory*\", \"body\": {\"size\": 0, \"aggs\": {\"k\": {\"terms\": {\"field\": \"omb.sig_tier\", \"size\": 20}}}}}, \"format\": {\"property\": \"aggregations.k.buckets\"}, \"transform\": [{\"type\": \"formula\", \"as\": \"t\", \"expr\": \"datum.key\"}]}, {\"name\": \"tc\", \"source\": \"raw\", \"transform\": [{\"type\": \"aggregate\", \"groupby\": [\"t\"], \"ops\": [\"sum\"], \"fields\": [\"doc_count\"], \"as\": [\"n\"]}]}, {\"name\": \"mx\", \"source\": \"tc\", \"transform\": [{\"type\": \"aggregate\", \"ops\": [\"max\"], \"fields\": [\"n\"], \"as\": [\"v\"]}]}, {\"name\": \"rows\", \"values\": [{\"t\": \"PQC READY\", \"lbl\": \"ML-DSA / Dilithium\", \"desc\": \"Post-quantum lattice signature \\u2014 quantum-resistant\", \"badge\": \"PQC READY\", \"clr\": \"#00c853\", \"bg\": \"#00c85318\", \"ord\": 0}, {\"t\": \"MODERN\", \"lbl\": \"ECDSA (P-256 / P-384)\", \"desc\": \"Elliptic curve signature \\u2014 efficient, quantum-vulnerable\", \"badge\": \"MODERN\", \"clr\": \"#448aff\", \"bg\": \"#448aff18\", \"ord\": 1}, {\"t\": \"CLASSICAL\", \"lbl\": \"RSA / SHA-256 RSA\", \"desc\": \"RSA signature \\u2014 quantum-vulnerable via Shor's algorithm\", \"badge\": \"CLASSICAL\", \"clr\": \"#ffa726\", \"bg\": \"#ffa72618\", \"ord\": 2}, {\"t\": \"LEGACY\", \"lbl\": \"MD5 / SHA-1 RSA\", \"desc\": \"Broken hash \\u2014 deprecated by all modern standards\", \"badge\": \"LEGACY\", \"clr\": \"#ef5350\", \"bg\": \"#ef535018\", \"ord\": 3}], \"transform\": [{\"type\": \"lookup\", \"from\": \"tc\", \"key\": \"t\", \"fields\": [\"t\"], \"values\": [\"n\"], \"as\": [\"n\"], \"default\": 0}, {\"type\": \"formula\", \"as\": \"y\", \"expr\": \"datum.ord * 72 + 60\"}]}], \"marks\": [{\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"value\": 16}, \"y\": {\"value\": 18}, \"text\": {\"value\": \"CERTIFICATE SIGNATURE\"}, \"fill\": {\"value\": \"#cccccc\"}, \"fontSize\": {\"value\": 10}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"letterSpacing\": {\"value\": 1.5}}}}, {\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"value\": 16}, \"y\": {\"value\": 38}, \"text\": {\"value\": \"SIGNATURE ALGORITHM \\u2014 click a tier to filter\"}, \"fill\": {\"value\": \"#555555\"}, \"fontSize\": {\"value\": 9}, \"font\": {\"value\": \"monospace\"}, \"letterSpacing\": {\"value\": 1}}}}, {\"type\": \"rule\", \"encode\": {\"enter\": {\"x\": {\"value\": 0}, \"x2\": {\"signal\": \"width\"}, \"y\": {\"value\": 48}, \"stroke\": {\"value\": \"#252525\"}, \"strokeWidth\": {\"value\": 1}}}}, {\"type\": \"rect\", \"name\": \"bg\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 0}, \"y\": {\"field\": \"y\"}, \"width\": {\"signal\": \"width\"}, \"height\": {\"value\": 66}, \"fill\": {\"signal\": \"datum.t===sel?'#1c1c2e':datum.n>0?'#161622':'#161616'\"}, \"cursor\": {\"value\": \"pointer\"}}}}, {\"type\": \"rect\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 0}, \"y\": {\"field\": \"y\"}, \"width\": {\"value\": 4}, \"height\": {\"value\": 66}, \"fill\": {\"signal\": \"datum.n>0?datum.clr:'#2a2a2a'\"}}}}, {\"type\": \"rule\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 0}, \"x2\": {\"signal\": \"width\"}, \"y\": {\"signal\": \"datum.y + 65\"}, \"stroke\": {\"value\": \"#222222\"}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 18}, \"y\": {\"signal\": \"datum.y + 24\"}, \"text\": {\"signal\": \"datum.lbl\"}, \"limit\": {\"signal\": \"width*0.62-18\"}, \"fill\": {\"signal\": \"datum.n>0?'#e8e8e8':'#444444'\"}, \"fontSize\": {\"value\": 13}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 18}, \"y\": {\"signal\": \"datum.y + 44\"}, \"text\": {\"signal\": \"datum.desc\"}, \"limit\": {\"signal\": \"width*0.62-18\"}, \"fill\": {\"value\": \"#555555\"}, \"fontSize\": {\"value\": 10}, \"font\": {\"value\": \"monospace\"}}}}, {\"type\": \"rect\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width*0.65\"}, \"y\": {\"signal\": \"datum.y + 8\"}, \"width\": {\"value\": 82}, \"height\": {\"value\": 17}, \"cornerRadius\": {\"value\": 2}, \"fill\": {\"signal\": \"datum.n>0?datum.bg:'#1a1a1a'\"}, \"stroke\": {\"signal\": \"datum.n>0?datum.clr:'#2a2a2a'\"}, \"strokeWidth\": {\"value\": 1}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width*0.65+41\"}, \"y\": {\"signal\": \"datum.y + 20\"}, \"text\": {\"signal\": \"datum.badge\"}, \"fill\": {\"signal\": \"datum.n>0?datum.clr:'#383838'\"}, \"fontSize\": {\"value\": 9}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"center\"}, \"letterSpacing\": {\"value\": 1}}}}, {\"type\": \"rect\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width*0.65\"}, \"y\": {\"signal\": \"datum.y + 31\"}, \"width\": {\"value\": 82}, \"height\": {\"value\": 17}, \"cornerRadius\": {\"value\": 2}, \"fill\": {\"signal\": \"'#1a1a1a'\"}, \"stroke\": {\"signal\": \"'#333333'\"}, \"strokeWidth\": {\"value\": 1}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width*0.65+41\"}, \"y\": {\"signal\": \"datum.y + 43\"}, \"text\": {\"signal\": \"datum.t===sel?'SELECTED':''\"}, \"fill\": {\"signal\": \"datum.t===sel?datum.clr:'#448aff'\"}, \"fontSize\": {\"value\": 9}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"center\"}, \"letterSpacing\": {\"value\": 1}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width-10\"}, \"y\": {\"signal\": \"datum.y + 36\"}, \"text\": {\"signal\": \"datum.n>0?(datum.n>=1000?format(datum.n,'.3~s'):format(datum.n,',')):'\\u2014'\"}, \"fill\": {\"signal\": \"datum.t===sel?datum.clr:datum.n>0?'#dddddd':'#333333'\"}, \"fontSize\": {\"value\": 20}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"right\"}}}}, {\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"signal\": \"width/2\"}, \"y\": {\"signal\": \"height-8\"}, \"text\": {\"value\": \"\\u2191 at the highest tier\"}, \"fill\": {\"value\": \"#2a2a2a\"}, \"fontSize\": {\"value\": 9}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"center\"}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width / 2\"}, \"y\": {\"signal\": \"height / 2 - 8\"}, \"text\": {\"signal\": \"length(data('raw')) === 0 ? 'NO DATA FOR CURRENT FILTERS / TIME RANGE' : ''\"}, \"fill\": {\"value\": \"#666666\"}, \"font\": {\"value\": \"monospace\"}, \"fontSize\": {\"value\": 11}, \"fontWeight\": {\"value\": \"bold\"}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"zindex\": {\"value\": 100}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width / 2\"}, \"y\": {\"signal\": \"height / 2 + 12\"}, \"text\": {\"signal\": \"length(data('raw')) === 0 ? 'Adjust dashboard filters or expand the selected time range.' : ''\"}, \"fill\": {\"value\": \"#444444\"}, \"font\": {\"value\": \"monospace\"}, \"fontSize\": {\"value\": 9}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"zindex\": {\"value\": 100}}}}]}" + }, + "title": "", + "type": "vega", + "uiState": {} + } + }, + "gridData": { + "h": 19, + "i": "3b53c655-5c7c-4910-9b19-657d22031234", + "w": 17, + "x": 31, + "y": 2 + }, + "panelIndex": "3b53c655-5c7c-4910-9b19-657d22031234", + "type": "visualization" + }, + { + "embeddableConfig": { + "enhancements": { + "dynamicActions": { + "events": [] + } + }, + "hidePanelTitles": true, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "id": "", + "params": { + "spec": "{\"$schema\": \"https://vega.github.io/schema/vega/v5.json\", \"padding\": {\"top\": 0, \"bottom\": 0, \"left\": 0, \"right\": 0}, \"background\": \"#111111\", \"signals\": [{\"name\": \"sel\", \"value\": null, \"on\": [{\"events\": {\"type\": \"click\", \"markname\": \"rowBg\"}, \"update\": \"datum.family === sel ? null : datum.family\", \"force\": true}]}, {\"name\": \"_kf\", \"value\": null, \"on\": [{\"events\": {\"type\": \"click\", \"markname\": \"rowBg\"}, \"update\": \"datum.family === sel ? kibanaRemoveFilter({'terms': {'process.name': datum.filterTerms}}) : kibanaAddFilter({'terms': {'process.name': datum.filterTerms}})\", \"force\": true}]}], \"data\": [{\"name\": \"raw\", \"url\": {\"%context%\": true, \"%timefield%\": \"@timestamp\", \"index\": \"tychon-pqc*\", \"body\": {\"size\": 0, \"aggs\": {\"procs\": {\"terms\": {\"field\": \"process.name\", \"size\": 80}, \"aggs\": {\"kex\": {\"terms\": {\"field\": \"omb.kex_tier\", \"size\": 5}, \"aggs\": {\"thosts\": {\"cardinality\": {\"field\": \"host.id\"}}}}}}}}}, \"format\": {\"property\": \"aggregations.procs.buckets\"}, \"transform\": [{\"type\": \"formula\", \"as\": \"family\", \"expr\": \"lower(datum.key)==='w3wp.exe'||lower(datum.key)==='iisexpress.exe'||lower(datum.key)==='inetinfo.exe' ? 'IIS' : lower(datum.key)==='node'||lower(datum.key)==='node.exe'||lower(datum.key)==='nodejs'||lower(datum.key)==='nodejs.exe' ? 'Node.js' : lower(datum.key)==='apache2'||lower(datum.key)==='httpd'||lower(datum.key)==='apache'||lower(datum.key)==='httpd.exe'||lower(datum.key)==='apache.exe'||lower(datum.key)==='httpd.worker' ? 'Apache' : lower(datum.key)==='nginx'||lower(datum.key)==='nginx.exe'||lower(datum.key)==='nginx-debug'||lower(datum.key)==='openresty' ? 'Nginx' : lower(datum.key)==='jsvc'||lower(datum.key)==='tomcat'||lower(datum.key)==='tomcat.exe'||lower(datum.key)==='tomcat9'||lower(datum.key)==='tomcat9.exe'||lower(datum.key)==='tomcat10'||lower(datum.key)==='tomcat10.exe'||lower(datum.key)==='tomcat8'||lower(datum.key)==='tomcat8.exe'||lower(datum.key)==='tomcat7'||lower(datum.key)==='tomcat7.exe'||lower(datum.key)==='catalina'||lower(datum.key)==='catalina.sh' ? 'Tomcat' : lower(datum.key)==='dotnet'||lower(datum.key)==='dotnet.exe' ? '.NET / Kestrel' : lower(datum.key)==='caddy'||lower(datum.key)==='caddy.exe' ? 'Caddy' : lower(datum.key)==='traefik'||lower(datum.key)==='traefik.exe' ? 'Traefik' : lower(datum.key)==='haproxy' ? 'HAProxy' : lower(datum.key)==='gunicorn' ? 'Gunicorn' : lower(datum.key)==='uwsgi' ? 'uWSGI' : lower(datum.key)==='puma'||lower(datum.key)==='passenger'||lower(datum.key)==='passenger-ruby' ? 'Puma' : lower(datum.key)==='varnishd' ? 'Varnish' : lower(datum.key)==='lighttpd' ? 'Lighttpd' : lower(datum.key)==='java'||lower(datum.key)==='java.exe'||lower(datum.key)==='javaw.exe' ? 'Java App Server' : 'Other'\"}, {\"type\": \"filter\", \"expr\": \"datum.family != null\"}]}, {\"name\": \"mapped\", \"source\": \"raw\", \"transform\": [{\"type\": \"flatten\", \"fields\": [\"kex.buckets\"], \"as\": [\"tb\"]}, {\"type\": \"formula\", \"as\": \"tier\", \"expr\": \"datum.tb.key\"}, {\"type\": \"formula\", \"as\": \"tier_h\", \"expr\": \"datum.tb.thosts ? datum.tb.thosts.value : 0\"}, {\"type\": \"formula\", \"as\": \"tier_ord\", \"expr\": \"datum.tier==='LEGACY' ? 0 : datum.tier==='CLASSICAL' ? 1 : datum.tier==='MODERN' ? 2 : datum.tier==='PQC READY' ? 3 : 4\"}]}, {\"name\": \"by_ft\", \"source\": \"mapped\", \"transform\": [{\"type\": \"aggregate\", \"groupby\": [\"family\", \"tier\", \"tier_ord\"], \"fields\": [\"tier_h\"], \"ops\": [\"sum\"], \"as\": [\"tier_total\"]}]}, {\"name\": \"fam_totals\", \"source\": \"by_ft\", \"transform\": [{\"type\": \"aggregate\", \"groupby\": [\"family\"], \"fields\": [\"tier_total\"], \"ops\": [\"sum\"], \"as\": [\"fam_total\"]}]}, {\"name\": \"fam_risk\", \"source\": \"by_ft\", \"transform\": [{\"type\": \"filter\", \"expr\": \"datum.tier === 'LEGACY' || datum.tier === 'CLASSICAL'\"}, {\"type\": \"aggregate\", \"groupby\": [\"family\"], \"fields\": [\"tier_total\"], \"ops\": [\"sum\"], \"as\": [\"risk_total\"]}]}, {\"name\": \"fam_pqc\", \"source\": \"by_ft\", \"transform\": [{\"type\": \"filter\", \"expr\": \"datum.tier === 'PQC READY'\"}, {\"type\": \"aggregate\", \"groupby\": [\"family\"], \"fields\": [\"tier_total\"], \"ops\": [\"sum\"], \"as\": [\"pqc_total\"]}]}, {\"name\": \"fam_rows\", \"source\": \"fam_totals\", \"transform\": [{\"type\": \"lookup\", \"from\": \"fam_risk\", \"key\": \"family\", \"fields\": [\"family\"], \"values\": [\"risk_total\"], \"default\": 0}, {\"type\": \"lookup\", \"from\": \"fam_pqc\", \"key\": \"family\", \"fields\": [\"family\"], \"values\": [\"pqc_total\"], \"default\": 0}, {\"type\": \"formula\", \"as\": \"clr\", \"expr\": \"datum.family==='IIS' ? '#0078d4' : datum.family==='Node.js' ? '#68a063' : datum.family==='Apache' ? '#d22128' : datum.family==='Nginx' ? '#009900' : datum.family==='Tomcat' ? '#f8a51a' : datum.family==='.NET / Kestrel' ? '#7b5ea7' : datum.family==='Caddy' ? '#00acd7' : datum.family==='Traefik' ? '#24a1c1' : datum.family==='HAProxy' ? '#7db8e8' : datum.family==='Gunicorn' ? '#499848' : datum.family==='uWSGI' ? '#cc4125' : datum.family==='Puma' ? '#e040fb' : datum.family==='Varnish' ? '#ff6d00' : datum.family==='Lighttpd' ? '#909090' : datum.family==='Java App Server' ? '#c7a008' : '#666666'\"}, {\"type\": \"formula\", \"as\": \"filterTerms\", \"expr\": \"datum.family==='IIS' ? ['w3wp.exe','iisexpress.exe','inetinfo.exe'] : datum.family==='Node.js' ? ['node','node.exe','nodejs','nodejs.exe'] : datum.family==='Apache' ? ['apache2','httpd','apache','httpd.exe','apache.exe','httpd.worker'] : datum.family==='Nginx' ? ['nginx','nginx.exe','nginx-debug','openresty'] : datum.family==='Tomcat' ? ['jsvc','tomcat','tomcat.exe','tomcat9','tomcat9.exe','tomcat10','tomcat10.exe','tomcat8','tomcat8.exe','tomcat7','tomcat7.exe','catalina','catalina.sh'] : datum.family==='.NET / Kestrel' ? ['dotnet','dotnet.exe'] : datum.family==='Caddy' ? ['caddy','caddy.exe'] : datum.family==='Traefik' ? ['traefik','traefik.exe'] : datum.family==='HAProxy' ? ['haproxy'] : datum.family==='Gunicorn' ? ['gunicorn'] : datum.family==='uWSGI' ? ['uwsgi'] : datum.family==='Puma' ? ['puma','passenger','passenger-ruby'] : datum.family==='Varnish' ? ['varnishd'] : datum.family==='Lighttpd' ? ['lighttpd'] : datum.family==='Java App Server' ? ['java','java.exe','javaw.exe'] : [datum.family]\"}, {\"type\": \"collect\", \"sort\": {\"field\": \"risk_total\", \"order\": \"descending\"}}, {\"type\": \"window\", \"ops\": [\"row_number\"], \"as\": [\"rowIdx\"]}, {\"type\": \"formula\", \"as\": \"y\", \"expr\": \"(datum.rowIdx - 1) * 38 + 52\"}]}, {\"name\": \"stacked\", \"source\": \"by_ft\", \"transform\": [{\"type\": \"lookup\", \"from\": \"fam_rows\", \"key\": \"family\", \"fields\": [\"family\"], \"values\": [\"y\", \"fam_total\", \"risk_total\"]}, {\"type\": \"filter\", \"expr\": \"datum.y != null\"}, {\"type\": \"formula\", \"as\": \"tier_clr\", \"expr\": \"datum.tier==='LEGACY' ? '#ef5350' : datum.tier==='CLASSICAL' ? '#ffa726' : datum.tier==='MODERN' ? '#42a5f5' : datum.tier==='PQC READY' ? '#66bb6a' : '#555555'\"}, {\"type\": \"joinaggregate\", \"fields\": [\"fam_total\"], \"ops\": [\"max\"], \"as\": [\"max_fam\"]}, {\"type\": \"window\", \"groupby\": [\"family\"], \"sort\": {\"field\": \"tier_ord\", \"order\": \"ascending\"}, \"ops\": [\"sum\"], \"fields\": [\"tier_total\"], \"as\": [\"cumul\"]}]}], \"marks\": [{\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"value\": 16}, \"y\": {\"value\": 18}, \"text\": {\"value\": \"WEB SERVER DISTRIBUTION\"}, \"fill\": {\"value\": \"#cccccc\"}, \"fontSize\": {\"value\": 10}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"letterSpacing\": {\"value\": 1.5}}}}, {\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"value\": 16}, \"y\": {\"value\": 30}, \"text\": {\"value\": \"HOSTS BY SERVER FAMILY & PQC KEX TIER \\u00c2\\u00b7 sorted by at-risk count \\u00c2\\u00b7 click to filter\"}, \"fill\": {\"value\": \"#555555\"}, \"fontSize\": {\"value\": 8}, \"font\": {\"value\": \"monospace\"}, \"letterSpacing\": {\"value\": 0.8}}}}, {\"type\": \"rect\", \"encode\": {\"enter\": {\"x\": {\"value\": 170}, \"y\": {\"value\": 37}, \"width\": {\"value\": 7}, \"height\": {\"value\": 6}, \"fill\": {\"value\": \"#ef5350\"}, \"cornerRadius\": {\"value\": 1}}}}, {\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"value\": 180}, \"y\": {\"value\": 44}, \"text\": {\"value\": \"LEGACY\"}, \"fill\": {\"value\": \"#666666\"}, \"fontSize\": {\"value\": 8}, \"font\": {\"value\": \"monospace\"}}}}, {\"type\": \"rect\", \"encode\": {\"enter\": {\"x\": {\"value\": 228}, \"y\": {\"value\": 37}, \"width\": {\"value\": 7}, \"height\": {\"value\": 6}, \"fill\": {\"value\": \"#ffa726\"}, \"cornerRadius\": {\"value\": 1}}}}, {\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"value\": 238}, \"y\": {\"value\": 44}, \"text\": {\"value\": \"CLASSICAL\"}, \"fill\": {\"value\": \"#666666\"}, \"fontSize\": {\"value\": 8}, \"font\": {\"value\": \"monospace\"}}}}, {\"type\": \"rect\", \"encode\": {\"enter\": {\"x\": {\"value\": 300}, \"y\": {\"value\": 37}, \"width\": {\"value\": 7}, \"height\": {\"value\": 6}, \"fill\": {\"value\": \"#42a5f5\"}, \"cornerRadius\": {\"value\": 1}}}}, {\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"value\": 310}, \"y\": {\"value\": 44}, \"text\": {\"value\": \"MODERN\"}, \"fill\": {\"value\": \"#666666\"}, \"fontSize\": {\"value\": 8}, \"font\": {\"value\": \"monospace\"}}}}, {\"type\": \"rect\", \"encode\": {\"enter\": {\"x\": {\"value\": 362}, \"y\": {\"value\": 37}, \"width\": {\"value\": 7}, \"height\": {\"value\": 6}, \"fill\": {\"value\": \"#66bb6a\"}, \"cornerRadius\": {\"value\": 1}}}}, {\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"value\": 372}, \"y\": {\"value\": 44}, \"text\": {\"value\": \"PQC READY\"}, \"fill\": {\"value\": \"#666666\"}, \"fontSize\": {\"value\": 8}, \"font\": {\"value\": \"monospace\"}}}}, {\"type\": \"rule\", \"encode\": {\"enter\": {\"x\": {\"value\": 0}, \"x2\": {\"signal\": \"width\"}, \"y\": {\"value\": 50}, \"stroke\": {\"value\": \"#252525\"}, \"strokeWidth\": {\"value\": 1}}}}, {\"type\": \"rect\", \"name\": \"rowBg\", \"from\": {\"data\": \"fam_rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 0}, \"y\": {\"field\": \"y\"}, \"width\": {\"signal\": \"width\"}, \"height\": {\"value\": 37}, \"fill\": {\"signal\": \"datum.family===sel ? '#1c1c2e' : '#161616'\"}, \"cursor\": {\"value\": \"pointer\"}}}}, {\"type\": \"rect\", \"from\": {\"data\": \"fam_rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 0}, \"y\": {\"field\": \"y\"}, \"width\": {\"value\": 4}, \"height\": {\"value\": 37}, \"fill\": {\"field\": \"clr\"}}}}, {\"type\": \"text\", \"from\": {\"data\": \"fam_rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 14}, \"y\": {\"signal\": \"datum.y + 14\"}, \"text\": {\"field\": \"family\"}, \"limit\": {\"value\": 148}, \"fill\": {\"signal\": \"datum.family===sel ? '#ffffff' : '#e8e8e8'\"}, \"fontSize\": {\"value\": 11}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}}}}, {\"type\": \"rect\", \"from\": {\"data\": \"fam_rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 170}, \"y\": {\"signal\": \"datum.y + 22\"}, \"width\": {\"signal\": \"width - 245\"}, \"height\": {\"value\": 8}, \"fill\": {\"value\": \"#1e1e1e\"}, \"cornerRadius\": {\"value\": 2}}}}, {\"type\": \"rect\", \"from\": {\"data\": \"stacked\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"170 + ((datum.cumul - datum.tier_total) / (datum.max_fam > 0 ? datum.max_fam : 1)) * (width - 245)\"}, \"x2\": {\"signal\": \"170 + (datum.cumul / (datum.max_fam > 0 ? datum.max_fam : 1)) * (width - 245)\"}, \"y\": {\"signal\": \"datum.y + 22\"}, \"height\": {\"value\": 8}, \"fill\": {\"field\": \"tier_clr\"}, \"fillOpacity\": {\"signal\": \"datum.family===sel ? 1 : 0.8\"}, \"cornerRadius\": {\"value\": 1}}}}, {\"type\": \"text\", \"from\": {\"data\": \"fam_rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width - 10\"}, \"y\": {\"signal\": \"datum.y + 14\"}, \"text\": {\"signal\": \"datum.fam_total >= 1000 ? format(datum.fam_total, '.3~s') : format(datum.fam_total, ',')\"}, \"fill\": {\"signal\": \"datum.family===sel ? datum.clr : '#cccccc'\"}, \"fontSize\": {\"value\": 11}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"right\"}}}}, {\"type\": \"text\", \"from\": {\"data\": \"fam_rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width - 10\"}, \"y\": {\"signal\": \"datum.y + 35\"}, \"text\": {\"signal\": \"datum.risk_total > 0 ? format(datum.risk_total, ',') + ' AT RISK' : datum.pqc_total > 0 ? 'PQC READY' : 'NOT PQC READY'\"}, \"fill\": {\"signal\": \"datum.risk_total > 0 ? '#ef5350' : datum.pqc_total > 0 ? '#66bb6a' : '#ffa726'\"}, \"fontSize\": {\"value\": 7}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"right\"}}}}, {\"type\": \"rule\", \"from\": {\"data\": \"fam_rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 0}, \"x2\": {\"signal\": \"width\"}, \"y\": {\"signal\": \"datum.y + 37\"}, \"stroke\": {\"value\": \"#1e1e1e\"}, \"strokeWidth\": {\"value\": 1}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width / 2\"}, \"y\": {\"signal\": \"height / 2 - 8\"}, \"text\": {\"signal\": \"length(data('raw')) === 0 ? 'NO DATA FOR CURRENT FILTERS / TIME RANGE' : ''\"}, \"fill\": {\"value\": \"#666666\"}, \"font\": {\"value\": \"monospace\"}, \"fontSize\": {\"value\": 11}, \"fontWeight\": {\"value\": \"bold\"}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"zindex\": {\"value\": 100}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width / 2\"}, \"y\": {\"signal\": \"height / 2 + 12\"}, \"text\": {\"signal\": \"length(data('raw')) === 0 ? 'Adjust dashboard filters or expand the selected time range.' : ''\"}, \"fill\": {\"value\": \"#444444\"}, \"font\": {\"value\": \"monospace\"}, \"fontSize\": {\"value\": 9}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"zindex\": {\"value\": 100}}}}]}" + }, + "title": "", + "type": "vega", + "uiState": {} + } + }, + "gridData": { + "h": 19, + "i": "0634e4b1-c33f-45ed-a33c-ba3937c4ed1f", + "w": 26, + "x": 0, + "y": 21 + }, + "panelIndex": "0634e4b1-c33f-45ed-a33c-ba3937c4ed1f", + "title": "", + "type": "visualization" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "0e56225a-3b03-4f4e-bdbc-2fd59f0ef78c", + "name": "indexpattern-datasource-layer-9110ccf0-1795-4d13-bab1-9a55f24a24a6", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "9110ccf0-1795-4d13-bab1-9a55f24a24a6": { + "columnOrder": [ + "9c1ef140-d9ad-40dd-b4f7-5fffeb57893c", + "27ead65c-5a7b-4ce3-83ff-bc77a2cc20a0" + ], + "columns": { + "27ead65c-5a7b-4ce3-83ff-bc77a2cc20a0": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "App Process Count", + "operationType": "unique_count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "process.executable" + }, + "9c1ef140-d9ad-40dd-b4f7-5fffeb57893c": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Weak Cipher", + "operationType": "terms", + "params": { + "exclude": [ + "svchost.exe", + "dllhost.exe" + ], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "27ead65c-5a7b-4ce3-83ff-bc77a2cc20a0", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 999 + }, + "scale": "ordinal", + "sourceField": "tls.weak_ciphers" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "9c1ef140-d9ad-40dd-b4f7-5fffeb57893c", + "isTransposed": false, + "oneClickFilter": true, + "width": 314 + }, + { + "columnId": "27ead65c-5a7b-4ce3-83ff-bc77a2cc20a0", + "isTransposed": false + } + ], + "layerId": "9110ccf0-1795-4d13-bab1-9a55f24a24a6", + "layerType": "data" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": { + "dynamicActions": { + "events": [ + { + "action": { + "config": { + "openInNewTab": false, + "useCurrentDateRange": true, + "useCurrentFilters": true + }, + "factoryId": "DASHBOARD_TO_DASHBOARD_DRILLDOWN", + "name": "Open Application Detail" + }, + "eventId": "9c6edb36-c71b-5cf1-8dcd-a37de6214334", + "triggers": [ + "FILTER_TRIGGER" + ] + } + ] + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" + }, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false + }, + "gridData": { + "h": 19, + "i": "2e9c8eb8-3234-44f1-aaf7-95b6832d1657", + "w": 11, + "x": 26, + "y": 21 + }, + "panelIndex": "2e9c8eb8-3234-44f1-aaf7-95b6832d1657", + "title": "Weak Ciphers In-Use", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "0e56225a-3b03-4f4e-bdbc-2fd59f0ef78c", + "name": "indexpattern-datasource-layer-9110ccf0-1795-4d13-bab1-9a55f24a24a6", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "currentIndexPatternId": "0e56225a-3b03-4f4e-bdbc-2fd59f0ef78c", + "layers": { + "9110ccf0-1795-4d13-bab1-9a55f24a24a6": { + "columnOrder": [ + "9c1ef140-d9ad-40dd-b4f7-5fffeb57893c", + "27ead65c-5a7b-4ce3-83ff-bc77a2cc20a0" + ], + "columns": { + "27ead65c-5a7b-4ce3-83ff-bc77a2cc20a0": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "App Count ", + "operationType": "unique_count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "process.executable" + }, + "9c1ef140-d9ad-40dd-b4f7-5fffeb57893c": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Insecure Cipher", + "operationType": "terms", + "params": { + "exclude": [ + "svchost.exe", + "dllhost.exe" + ], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "27ead65c-5a7b-4ce3-83ff-bc77a2cc20a0", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 999 + }, + "scale": "ordinal", + "sourceField": "tls.insecure_ciphers" + } + }, + "incompleteColumns": {}, + "indexPatternId": "0e56225a-3b03-4f4e-bdbc-2fd59f0ef78c", + "sampling": 1 + } + } + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "9c1ef140-d9ad-40dd-b4f7-5fffeb57893c", + "isTransposed": false, + "oneClickFilter": true + }, + { + "columnId": "27ead65c-5a7b-4ce3-83ff-bc77a2cc20a0", + "isTransposed": false + } + ], + "layerId": "9110ccf0-1795-4d13-bab1-9a55f24a24a6", + "layerType": "data" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": { + "dynamicActions": { + "events": [ + { + "action": { + "config": { + "openInNewTab": false, + "useCurrentDateRange": true, + "useCurrentFilters": true + }, + "factoryId": "DASHBOARD_TO_DASHBOARD_DRILLDOWN", + "name": "Open Application Detail" + }, + "eventId": "b0c9f1de-0afd-5b7d-b3a1-fb28c055a10a", + "triggers": [ + "FILTER_TRIGGER" + ] + } + ] + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" + }, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false + }, + "gridData": { + "h": 19, + "i": "ae78c400-d497-4d7f-9541-3e14fb724097", + "w": 11, + "x": 37, + "y": 21 + }, + "panelIndex": "ae78c400-d497-4d7f-9541-3e14fb724097", + "title": "Insecure Ciphers In-Use", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "0e56225a-3b03-4f4e-bdbc-2fd59f0ef78c", + "name": "indexpattern-datasource-layer-8e8a2d62-de50-4140-91d5-4d323f4bfe51", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "currentIndexPatternId": "0e56225a-3b03-4f4e-bdbc-2fd59f0ef78c", + "layers": { + "8e8a2d62-de50-4140-91d5-4d323f4bfe51": { + "columnOrder": [ + "b9ce2593-2e18-4a93-997b-fea289547d59", + "119c83a6-13f7-4470-b14e-00f524c8f68c", + "57ed4372-97b0-41ed-a161-eb151f832cdb" + ], + "columns": { + "119c83a6-13f7-4470-b14e-00f524c8f68c": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "omb.kex_primary_quantum_safe : false " + }, + "isBucketed": false, + "label": "Not Resilient", + "operationType": "unique_count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "process.name" + }, + "57ed4372-97b0-41ed-a161-eb151f832cdb": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "omb.kex_primary_quantum_safe : true " + }, + "isBucketed": false, + "label": "Quantum Resilient ", + "operationType": "unique_count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "process.name" + }, + "b9ce2593-2e18-4a93-997b-fea289547d59": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Port Number", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "119c83a6-13f7-4470-b14e-00f524c8f68c", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 999 + }, + "scale": "ordinal", + "sourceField": "server.port" + } + }, + "incompleteColumns": {}, + "indexPatternId": "0e56225a-3b03-4f4e-bdbc-2fd59f0ef78c", + "sampling": 1 + } + } + }, + "indexpattern": { + "currentIndexPatternId": "0e56225a-3b03-4f4e-bdbc-2fd59f0ef78c", + "layers": {} + }, + "textBased": { + "indexPatternRefs": [ + { + "id": "0e56225a-3b03-4f4e-bdbc-2fd59f0ef78c", + "timeField": "@timestamp", + "title": "tychon-pqc*" + } + ], + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "alignment": "center", + "columnId": "b9ce2593-2e18-4a93-997b-fea289547d59" + }, + { + "columnId": "119c83a6-13f7-4470-b14e-00f524c8f68c", + "isMetric": true, + "isTransposed": false + }, + { + "columnId": "57ed4372-97b0-41ed-a161-eb151f832cdb", + "isMetric": true, + "isTransposed": false + } + ], + "layerId": "8e8a2d62-de50-4140-91d5-4d323f4bfe51", + "layerType": "data" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": { + "dynamicActions": { + "events": [ + { + "action": { + "config": { + "openInNewTab": false, + "useCurrentDateRange": true, + "useCurrentFilters": true + }, + "factoryId": "DASHBOARD_TO_DASHBOARD_DRILLDOWN", + "name": "Open Application Connections Topology" + }, + "eventId": "0ba322cf-440b-5ad3-a615-62aad7cf634c", + "triggers": [ + "FILTER_TRIGGER" + ] + } + ] + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" + }, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false + }, + "gridData": { + "h": 19, + "i": "5a1a9fd8-a9e5-4333-ad15-e08a3b6cb091", + "w": 10, + "x": 0, + "y": 40 + }, + "panelIndex": "5a1a9fd8-a9e5-4333-ad15-e08a3b6cb091", + "title": "Port Usage", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "0e56225a-3b03-4f4e-bdbc-2fd59f0ef78c", + "name": "indexpattern-datasource-layer-9110ccf0-1795-4d13-bab1-9a55f24a24a6", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "layers": { + "9110ccf0-1795-4d13-bab1-9a55f24a24a6": { + "columnOrder": [ + "9c1ef140-d9ad-40dd-b4f7-5fffeb57893c", + "27ead65c-5a7b-4ce3-83ff-bc77a2cc20a0" + ], + "columns": { + "27ead65c-5a7b-4ce3-83ff-bc77a2cc20a0": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Host Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "9c1ef140-d9ad-40dd-b4f7-5fffeb57893c": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Software Package Name", + "operationType": "terms", + "params": { + "exclude": [ + "svchost.exe", + "dllhost.exe" + ], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "27ead65c-5a7b-4ce3-83ff-bc77a2cc20a0", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 999 + }, + "scale": "ordinal", + "sourceField": "process.name" + } + }, + "incompleteColumns": {}, + "sampling": 1 + } + } + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "tychon.index : \"inventory\" and quantum_ready: false " + }, + "visualization": { + "columns": [ + { + "columnId": "9c1ef140-d9ad-40dd-b4f7-5fffeb57893c", + "isTransposed": false, + "oneClickFilter": true + }, + { + "columnId": "27ead65c-5a7b-4ce3-83ff-bc77a2cc20a0", + "isTransposed": false + } + ], + "layerId": "9110ccf0-1795-4d13-bab1-9a55f24a24a6", + "layerType": "data" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": { + "dynamicActions": { + "events": [ + { + "action": { + "config": { + "openInNewTab": false, + "useCurrentDateRange": true, + "useCurrentFilters": true + }, + "factoryId": "DASHBOARD_TO_DASHBOARD_DRILLDOWN", + "name": "Open Application Detail" + }, + "eventId": "d46a3ff4-c28b-57a1-a225-f58957519288", + "triggers": [ + "FILTER_TRIGGER" + ] + } + ] + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "tychon.index : \"inventory\" and quantum_ready: false " + }, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false + }, + "gridData": { + "h": 19, + "i": "bd58f6e5-41a8-4bd7-9b5b-c8f2502833b1", + "w": 16, + "x": 10, + "y": 40 + }, + "panelIndex": "bd58f6e5-41a8-4bd7-9b5b-c8f2502833b1", + "title": "Vulnerable Software", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "0e56225a-3b03-4f4e-bdbc-2fd59f0ef78c", + "name": "indexpattern-datasource-layer-9110ccf0-1795-4d13-bab1-9a55f24a24a6", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "currentIndexPatternId": "0e56225a-3b03-4f4e-bdbc-2fd59f0ef78c", + "layers": { + "9110ccf0-1795-4d13-bab1-9a55f24a24a6": { + "columnOrder": [ + "9c1ef140-d9ad-40dd-b4f7-5fffeb57893c", + "27ead65c-5a7b-4ce3-83ff-bc77a2cc20a0" + ], + "columns": { + "27ead65c-5a7b-4ce3-83ff-bc77a2cc20a0": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "App Count ", + "operationType": "unique_count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "process.executable" + }, + "9c1ef140-d9ad-40dd-b4f7-5fffeb57893c": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Key Exchange", + "operationType": "terms", + "params": { + "exclude": [ + ".*(mlkem|ffdh).*" + ], + "excludeIsRegex": true, + "include": [ + "" + ], + "includeIsRegex": true, + "missingBucket": false, + "orderBy": { + "columnId": "27ead65c-5a7b-4ce3-83ff-bc77a2cc20a0", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 999 + }, + "scale": "ordinal", + "sourceField": "tls.supported_key_exchanges" + } + }, + "incompleteColumns": {}, + "indexPatternId": "0e56225a-3b03-4f4e-bdbc-2fd59f0ef78c", + "sampling": 1 + } + } + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "omb.kex_tier", + "index": "9d644013-9636-4968-9154-38f0c5207120", + "key": "omb.kex_tier", + "negate": true, + "params": { + "query": "PQC READY" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "omb.kex_tier": "PQC READY" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "9c1ef140-d9ad-40dd-b4f7-5fffeb57893c", + "isTransposed": false, + "oneClickFilter": true, + "width": 314 + }, + { + "columnId": "27ead65c-5a7b-4ce3-83ff-bc77a2cc20a0", + "isTransposed": false + } + ], + "layerId": "9110ccf0-1795-4d13-bab1-9a55f24a24a6", + "layerType": "data" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": { + "dynamicActions": { + "events": [ + { + "action": { + "config": { + "openInNewTab": false, + "useCurrentDateRange": true, + "useCurrentFilters": true + }, + "factoryId": "DASHBOARD_TO_DASHBOARD_DRILLDOWN", + "name": "Open Application Connections Topology" + }, + "eventId": "e17bab29-a9ff-52fc-911c-0fbbde37ba9b", + "triggers": [ + "FILTER_TRIGGER" + ] + } + ] + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "omb.kex_tier", + "index": "9d644013-9636-4968-9154-38f0c5207120", + "key": "omb.kex_tier", + "negate": true, + "params": { + "query": "PQC READY" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "omb.kex_tier": "PQC READY" + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false + }, + "gridData": { + "h": 19, + "i": "d2885626-4e44-41c7-b5ba-45c5b524280a", + "w": 11, + "x": 26, + "y": 40 + }, + "panelIndex": "d2885626-4e44-41c7-b5ba-45c5b524280a", + "title": "Non-Quantum Ready KX", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "0e56225a-3b03-4f4e-bdbc-2fd59f0ef78c", + "name": "indexpattern-datasource-layer-9110ccf0-1795-4d13-bab1-9a55f24a24a6", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "currentIndexPatternId": "0e56225a-3b03-4f4e-bdbc-2fd59f0ef78c", + "layers": { + "9110ccf0-1795-4d13-bab1-9a55f24a24a6": { + "columnOrder": [ + "7bb8af8f-5ff6-433e-9a1a-ca36a3af873d", + "27ead65c-5a7b-4ce3-83ff-bc77a2cc20a0" + ], + "columns": { + "27ead65c-5a7b-4ce3-83ff-bc77a2cc20a0": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "App Count ", + "operationType": "unique_count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "process.executable" + }, + "7bb8af8f-5ff6-433e-9a1a-ca36a3af873d": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Signature", + "operationType": "terms", + "params": { + "exclude": [ + "(MLDSA|SLH|FND).*" + ], + "excludeIsRegex": true, + "include": [ + "" + ], + "includeIsRegex": true, + "missingBucket": false, + "orderBy": { + "columnId": "27ead65c-5a7b-4ce3-83ff-bc77a2cc20a0", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 50 + }, + "scale": "ordinal", + "sourceField": "x509.sig_algorithm" + } + }, + "incompleteColumns": {}, + "indexPatternId": "0e56225a-3b03-4f4e-bdbc-2fd59f0ef78c", + "sampling": 1 + } + } + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "x509.signature_algorithm", + "index": "7503da64-ec7e-41aa-962f-15507a9e77a5", + "key": "x509.signature_algorithm", + "negate": true, + "params": { + "query": "PQC READY " + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "x509.signature_algorithm": "PQC READY " + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "7bb8af8f-5ff6-433e-9a1a-ca36a3af873d", + "isTransposed": false, + "oneClickFilter": true + }, + { + "columnId": "27ead65c-5a7b-4ce3-83ff-bc77a2cc20a0", + "isTransposed": false + } + ], + "layerId": "9110ccf0-1795-4d13-bab1-9a55f24a24a6", + "layerType": "data" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": { + "dynamicActions": { + "events": [ + { + "action": { + "config": { + "openInNewTab": false, + "useCurrentDateRange": true, + "useCurrentFilters": true + }, + "factoryId": "DASHBOARD_TO_DASHBOARD_DRILLDOWN", + "name": "Open Certificate Operations" + }, + "eventId": "dfda3f15-fd80-541a-a930-8a72e988f26d", + "triggers": [ + "FILTER_TRIGGER" + ] + } + ] + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "x509.signature_algorithm", + "index": "7503da64-ec7e-41aa-962f-15507a9e77a5", + "key": "x509.signature_algorithm", + "negate": true, + "params": { + "query": "PQC READY " + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "x509.signature_algorithm": "PQC READY " + } + } + } + ], + "query": { + "language": "kuery", + "query": "" + }, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false + }, + "gridData": { + "h": 19, + "i": "01b3101c-246d-448d-a05d-3a05e7747926", + "w": 11, + "x": 37, + "y": 40 + }, + "panelIndex": "01b3101c-246d-448d-a05d-3a05e7747926", + "title": "Non-Quantum Ready Signatures", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "0e56225a-3b03-4f4e-bdbc-2fd59f0ef78c", + "name": "indexpattern-datasource-layer-e75aaba0-a144-4cc0-a761-f8be87375cb4", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "currentIndexPatternId": "0e56225a-3b03-4f4e-bdbc-2fd59f0ef78c", + "layers": { + "e75aaba0-a144-4cc0-a761-f8be87375cb4": { + "columnOrder": [ + "b5fce59b-3087-426d-aab0-9b9bbecb3ed8", + "f9d9e11f-6962-422b-b6da-2fd7558dd085", + "c01e7181-5ff6-4dcf-acab-76dda3f5a746", + "590cd120-8a6e-4be0-bd3b-0ba0026d28a6", + "434e93db-3c69-4dae-807b-d0719c662bac", + "78f4e7ab-8d4a-44c8-a828-9c575851796c", + "eae233bd-7ec6-46a2-8f6b-85fb3c94e9a2", + "a5eeb316-c12c-4532-b3d7-60b8f2f06876", + "f998a85c-6b52-4d94-9644-c76256e90cc5", + "3406b6a3-14cc-43af-9f24-ac050dd0a821", + "d4469a63-4cf7-4e5f-bdcc-b9a494d4a232", + "5b34e39e-686f-462c-9121-c0695e10982f", + "d80e5fa1-371d-4474-b958-366159cfdd27", + "331d730b-580a-4d92-a2fe-6a84c9d97da7" + ], + "columns": { + "331d730b-580a-4d92-a2fe-6a84c9d97da7": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Host Count", + "operationType": "unique_count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "host.id" + }, + "3406b6a3-14cc-43af-9f24-ac050dd0a821": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "TLS Supported Ciphers", + "operationType": "unique_count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "tls.supported_cipher_count" + }, + "434e93db-3c69-4dae-807b-d0719c662bac": { + "customLabel": true, + "dataType": "boolean", + "isBucketed": true, + "label": "Quantum Resilient", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "f998a85c-6b52-4d94-9644-c76256e90cc5", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 3 + }, + "scale": "ordinal", + "sourceField": "quantum_ready" + }, + "590cd120-8a6e-4be0-bd3b-0ba0026d28a6": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Primary Key Exchange", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": true, + "orderBy": { + "columnId": "f998a85c-6b52-4d94-9644-c76256e90cc5", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 8 + }, + "scale": "ordinal", + "sourceField": "omb.kex_primary" + }, + "5b34e39e-686f-462c-9121-c0695e10982f": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "TLS Weak Ciphers", + "operationType": "unique_count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "tls.weak_ciphers" + }, + "78f4e7ab-8d4a-44c8-a828-9c575851796c": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Cipher Suite", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": true, + "orderBy": { + "columnId": "f998a85c-6b52-4d94-9644-c76256e90cc5", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 3 + }, + "scale": "ordinal", + "sourceField": "tychon.crypto.cipher" + }, + "a5eeb316-c12c-4532-b3d7-60b8f2f06876": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Certificate", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": true, + "orderBy": { + "columnId": "f998a85c-6b52-4d94-9644-c76256e90cc5", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 3 + }, + "scale": "ordinal", + "sourceField": "tychon.crypto.certificate" + }, + "b5fce59b-3087-426d-aab0-9b9bbecb3ed8": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Process", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "f998a85c-6b52-4d94-9644-c76256e90cc5", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 100 + }, + "scale": "ordinal", + "sourceField": "process.name" + }, + "c01e7181-5ff6-4dcf-acab-76dda3f5a746": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Proto Version", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": true, + "orderBy": { + "columnId": "f998a85c-6b52-4d94-9644-c76256e90cc5", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "tychon.crypto.protocol_version" + }, + "d4469a63-4cf7-4e5f-bdcc-b9a494d4a232": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "TLS Insecure Ciphers", + "operationType": "unique_count", + "params": { + "emptyAsNull": false + }, + "scale": "ratio", + "sourceField": "tls.insecure_cipher_count" + }, + "d80e5fa1-371d-4474-b958-366159cfdd27": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Total OS", + "operationType": "unique_count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "observer.os.platform" + }, + "eae233bd-7ec6-46a2-8f6b-85fb3c94e9a2": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "MAC", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": true, + "orderBy": { + "columnId": "f998a85c-6b52-4d94-9644-c76256e90cc5", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 3 + }, + "scale": "ordinal", + "sourceField": "tychon.crypto.mac" + }, + "f998a85c-6b52-4d94-9644-c76256e90cc5": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Port Count ", + "operationType": "unique_count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "server.port" + }, + "f9d9e11f-6962-422b-b6da-2fd7558dd085": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Protocol", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": true, + "orderBy": { + "columnId": "f998a85c-6b52-4d94-9644-c76256e90cc5", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 3 + }, + "scale": "ordinal", + "sourceField": "tychon.crypto.protocol" + } + }, + "incompleteColumns": {}, + "indexPatternId": "0e56225a-3b03-4f4e-bdbc-2fd59f0ef78c", + "sampling": 1 + } + } + }, + "indexpattern": { + "currentIndexPatternId": "0e56225a-3b03-4f4e-bdbc-2fd59f0ef78c", + "layers": {} + }, + "textBased": { + "indexPatternRefs": [ + { + "id": "0e56225a-3b03-4f4e-bdbc-2fd59f0ef78c", + "timeField": "@timestamp", + "title": "tychon-pqc*" + } + ], + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "b5fce59b-3087-426d-aab0-9b9bbecb3ed8", + "oneClickFilter": true + }, + { + "alignment": "center", + "columnId": "590cd120-8a6e-4be0-bd3b-0ba0026d28a6", + "isMetric": false, + "isTransposed": false + }, + { + "alignment": "center", + "columnId": "78f4e7ab-8d4a-44c8-a828-9c575851796c", + "isMetric": false, + "isTransposed": false + }, + { + "alignment": "center", + "colorMapping": { + "assignments": [ + { + "color": { + "colorIndex": 0, + "paletteId": "eui_amsterdam_color_blind", + "type": "categorical" + }, + "rule": { + "type": "matchExactly", + "values": [ + "TLSv1.3" + ] + }, + "touched": false + }, + { + "color": { + "colorIndex": 5, + "paletteId": "eui_amsterdam_color_blind", + "type": "categorical" + }, + "rule": { + "type": "matchExactly", + "values": [ + "TLSv1.2" + ] + }, + "touched": true + }, + { + "color": { + "colorIndex": 2, + "paletteId": "eui_amsterdam_color_blind", + "type": "categorical" + }, + "rule": { + "type": "matchExactly", + "values": [ + "TLSv1.1" + ] + }, + "touched": true + }, + { + "color": { + "colorIndex": 2, + "paletteId": "eui_amsterdam_color_blind", + "type": "categorical" + }, + "rule": { + "type": "matchExactly", + "values": [ + "TLS1.0" + ] + }, + "touched": true + }, + { + "color": { + "colorIndex": 2, + "paletteId": "eui_amsterdam_color_blind", + "type": "categorical" + }, + "rule": { + "type": "matchExactly", + "values": [ + "TLS1" + ] + }, + "touched": true + } + ], + "colorMode": { + "type": "categorical" + }, + "paletteId": "eui_amsterdam_color_blind", + "specialAssignments": [ + { + "color": { + "type": "loop" + }, + "rule": { + "type": "other" + }, + "touched": false + } + ] + }, + "colorMode": "text", + "columnId": "f9d9e11f-6962-422b-b6da-2fd7558dd085", + "isMetric": false, + "isTransposed": false, + "palette": { + "name": "default", + "params": { + "stops": [ + { + "color": "#54B399", + "stop": 20 + }, + { + "color": "#6092C0", + "stop": 30 + }, + { + "color": "#D36086", + "stop": 40 + }, + { + "color": "#9170B8", + "stop": 50 + }, + { + "color": "#CA8EAE", + "stop": 60 + }, + { + "color": "#D6BF57", + "stop": 70 + }, + { + "color": "#B9A888", + "stop": 80 + }, + { + "color": "#DA8B45", + "stop": 90 + }, + { + "color": "#AA6556", + "stop": 100 + }, + { + "color": "#E7664C", + "stop": 110 + } + ] + }, + "type": "palette" + } + }, + { + "alignment": "center", + "colorMapping": { + "assignments": [ + { + "color": { + "colorIndex": 2, + "paletteId": "eui_amsterdam_color_blind", + "type": "categorical" + }, + "rule": { + "type": "matchExactly", + "values": [ + "0" + ] + }, + "touched": true + }, + { + "color": { + "colorIndex": 0, + "paletteId": "eui_amsterdam_color_blind", + "type": "categorical" + }, + "rule": { + "type": "matchExactly", + "values": [ + "1" + ] + }, + "touched": true + } + ], + "colorMode": { + "type": "categorical" + }, + "paletteId": "eui_amsterdam_color_blind", + "specialAssignments": [ + { + "color": { + "type": "loop" + }, + "rule": { + "type": "other" + }, + "touched": false + } + ] + }, + "colorMode": "cell", + "columnId": "434e93db-3c69-4dae-807b-d0719c662bac", + "isMetric": false, + "isTransposed": false, + "palette": { + "name": "default", + "params": { + "stops": [ + { + "color": "#54B399", + "stop": 20 + }, + { + "color": "#6092C0", + "stop": 30 + }, + { + "color": "#D36086", + "stop": 40 + }, + { + "color": "#9170B8", + "stop": 50 + }, + { + "color": "#CA8EAE", + "stop": 60 + }, + { + "color": "#D6BF57", + "stop": 70 + }, + { + "color": "#B9A888", + "stop": 80 + }, + { + "color": "#DA8B45", + "stop": 90 + }, + { + "color": "#AA6556", + "stop": 100 + }, + { + "color": "#E7664C", + "stop": 110 + } + ] + }, + "type": "palette" + } + }, + { + "alignment": "center", + "columnId": "f998a85c-6b52-4d94-9644-c76256e90cc5", + "isMetric": true, + "isTransposed": false + }, + { + "alignment": "center", + "columnId": "d80e5fa1-371d-4474-b958-366159cfdd27", + "isMetric": true, + "isTransposed": false + }, + { + "alignment": "center", + "columnId": "331d730b-580a-4d92-a2fe-6a84c9d97da7", + "isMetric": true, + "isTransposed": false + }, + { + "alignment": "center", + "columnId": "3406b6a3-14cc-43af-9f24-ac050dd0a821", + "isMetric": true, + "isTransposed": false + }, + { + "alignment": "center", + "columnId": "d4469a63-4cf7-4e5f-bdcc-b9a494d4a232", + "isMetric": true, + "isTransposed": false + }, + { + "alignment": "center", + "columnId": "5b34e39e-686f-462c-9121-c0695e10982f", + "isMetric": true, + "isTransposed": false + }, + { + "alignment": "center", + "columnId": "eae233bd-7ec6-46a2-8f6b-85fb3c94e9a2", + "isMetric": false, + "isTransposed": false + }, + { + "alignment": "center", + "colorMapping": { + "assignments": [ + { + "color": { + "colorIndex": 2, + "paletteId": "eui_amsterdam_color_blind", + "type": "categorical" + }, + "rule": { + "type": "matchExactly", + "values": [ + "1.0", + "1.1" + ] + }, + "touched": true + }, + { + "color": { + "colorIndex": 5, + "paletteId": "eui_amsterdam_color_blind", + "type": "categorical" + }, + "rule": { + "type": "matchExactly", + "values": [ + "1.2" + ] + }, + "touched": true + }, + { + "color": { + "colorIndex": 0, + "paletteId": "eui_amsterdam_color_blind", + "type": "categorical" + }, + "rule": { + "type": "matchExactly", + "values": [ + "1.3", + "2.0" + ] + }, + "touched": true + } + ], + "colorMode": { + "type": "categorical" + }, + "paletteId": "eui_amsterdam_color_blind", + "specialAssignments": [ + { + "color": { + "type": "loop" + }, + "rule": { + "type": "other" + }, + "touched": false + } + ] + }, + "colorMode": "cell", + "columnId": "c01e7181-5ff6-4dcf-acab-76dda3f5a746", + "isMetric": false, + "isTransposed": false, + "palette": { + "name": "default", + "params": { + "stops": [ + { + "color": "#54B399", + "stop": 20 + }, + { + "color": "#6092C0", + "stop": 30 + }, + { + "color": "#D36086", + "stop": 40 + }, + { + "color": "#9170B8", + "stop": 50 + }, + { + "color": "#CA8EAE", + "stop": 60 + }, + { + "color": "#D6BF57", + "stop": 70 + }, + { + "color": "#B9A888", + "stop": 80 + }, + { + "color": "#DA8B45", + "stop": 90 + }, + { + "color": "#AA6556", + "stop": 100 + }, + { + "color": "#E7664C", + "stop": 110 + } + ] + }, + "type": "palette" + } + }, + { + "alignment": "center", + "columnId": "a5eeb316-c12c-4532-b3d7-60b8f2f06876", + "isMetric": false, + "isTransposed": false + } + ], + "headerRowHeightLines": 2, + "layerId": "e75aaba0-a144-4cc0-a761-f8be87375cb4", + "layerType": "data", + "paging": { + "enabled": true, + "size": 30 + } + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": { + "dynamicActions": { + "events": [ + { + "action": { + "config": { + "openInNewTab": true, + "useCurrentDateRange": true, + "useCurrentFilters": false + }, + "factoryId": "DASHBOARD_TO_DASHBOARD_DRILLDOWN", + "name": "Application Detail" + }, + "eventId": "d0188d05-be4a-474b-8825-cf250d80d88f", + "triggers": [ + "FILTER_TRIGGER" + ] + } + ] + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" + }, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false + }, + "gridData": { + "h": 32, + "i": "07f49118-bcf0-44f7-875a-df393ce88c47", + "w": 48, + "x": 0, + "y": 59 + }, + "panelIndex": "07f49118-bcf0-44f7-875a-df393ce88c47", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "0e56225a-3b03-4f4e-bdbc-2fd59f0ef78c", + "name": "indexpattern-datasource-layer-76c0d382-132a-4232-b1ba-2928d86d36eb", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "currentIndexPatternId": "0e56225a-3b03-4f4e-bdbc-2fd59f0ef78c", + "layers": { + "76c0d382-132a-4232-b1ba-2928d86d36eb": { + "columnOrder": [ + "c452013b-c1a4-444a-9861-fd5f8283dbb8", + "72caa386-75a2-404d-996c-609cc9ce8705", + "c38c78d3-f83a-4b39-8766-fd169aa8f1cf", + "496f4a9c-c379-4dfc-8e74-df11f73cfa52", + "d60e63d5-11c7-4413-b41f-139d3870723e", + "64bc500b-17f2-4b63-99de-710ec63da6b9", + "f1c203be-6445-4ac0-8f8f-64797cb120ba", + "98a06023-cab2-4907-bc55-dbb722c5294a", + "66633750-7aab-4f60-82cb-63d6b4fb604e", + "98a06023-cab2-4907-bc55-dbb722c5294aX0", + "98a06023-cab2-4907-bc55-dbb722c5294aX1", + "98a06023-cab2-4907-bc55-dbb722c5294aX2" + ], + "columns": { + "496f4a9c-c379-4dfc-8e74-df11f73cfa52": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Algorithm", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "66633750-7aab-4f60-82cb-63d6b4fb604e", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 3 + }, + "scale": "ordinal", + "sourceField": "x509.public_key_algorithm" + }, + "64bc500b-17f2-4b63-99de-710ec63da6b9": { + "customLabel": true, + "dataType": "date", + "filter": { + "language": "kuery", + "query": "\"x509.validity.not_before\": *" + }, + "isBucketed": false, + "label": "Issued", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "x509.validity.not_before" + }, + "66633750-7aab-4f60-82cb-63d6b4fb604e": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "72caa386-75a2-404d-996c-609cc9ce8705": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Lifespan", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "66633750-7aab-4f60-82cb-63d6b4fb604e", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 3 + }, + "scale": "ordinal", + "sourceField": "tychon.certificate_leaf_details.validity.duration_days" + }, + "98a06023-cab2-4907-bc55-dbb722c5294a": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Time Left", + "operationType": "formula", + "params": { + "format": { + "id": "duration", + "params": { + "decimals": 0, + "fromUnit": "milliseconds" + } + }, + "formula": "last_value(x509.not_after) - now()", + "isFormulaBroken": false + }, + "references": [ + "98a06023-cab2-4907-bc55-dbb722c5294aX2" + ], + "scale": "ratio" + }, + "98a06023-cab2-4907-bc55-dbb722c5294aX0": { + "customLabel": true, + "dataType": "date", + "filter": { + "language": "kuery", + "query": "\"x509.not_after\": *" + }, + "isBucketed": false, + "label": "Part of Time Left", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "x509.not_after" + }, + "98a06023-cab2-4907-bc55-dbb722c5294aX1": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of Time Left", + "operationType": "now", + "references": [], + "scale": "ratio" + }, + "98a06023-cab2-4907-bc55-dbb722c5294aX2": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Part of Time Left", + "operationType": "math", + "params": { + "tinymathAst": { + "args": [ + "98a06023-cab2-4907-bc55-dbb722c5294aX0", + "98a06023-cab2-4907-bc55-dbb722c5294aX1" + ], + "location": { + "max": 34, + "min": 0 + }, + "name": "subtract", + "text": "last_value(x509.not_after) - now()", + "type": "function" + } + }, + "references": [ + "98a06023-cab2-4907-bc55-dbb722c5294aX0", + "98a06023-cab2-4907-bc55-dbb722c5294aX1" + ], + "scale": "ratio" + }, + "c38c78d3-f83a-4b39-8766-fd169aa8f1cf": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Curve", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "66633750-7aab-4f60-82cb-63d6b4fb604e", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 3 + }, + "scale": "ordinal", + "sourceField": "x509.public_key_curve" + }, + "c452013b-c1a4-444a-9861-fd5f8283dbb8": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Subject", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "66633750-7aab-4f60-82cb-63d6b4fb604e", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 100 + }, + "scale": "ordinal", + "sourceField": "x509.subject.distinguished_name" + }, + "d60e63d5-11c7-4413-b41f-139d3870723e": { + "customLabel": true, + "dataType": "number", + "filter": { + "language": "kuery", + "query": "\"x509.public_key_size\": *" + }, + "isBucketed": false, + "label": "Key Size", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "x509.public_key_size" + }, + "f1c203be-6445-4ac0-8f8f-64797cb120ba": { + "customLabel": true, + "dataType": "date", + "filter": { + "language": "kuery", + "query": "\"x509.validity.not_after\": *" + }, + "isBucketed": false, + "label": "Expires", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "x509.validity.not_after" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "indexPatternId": "0e56225a-3b03-4f4e-bdbc-2fd59f0ef78c", + "sampling": 1 + } + } + }, + "indexpattern": { + "currentIndexPatternId": "0e56225a-3b03-4f4e-bdbc-2fd59f0ef78c", + "layers": {} + }, + "textBased": { + "indexPatternRefs": [ + { + "id": "0e56225a-3b03-4f4e-bdbc-2fd59f0ef78c", + "timeField": "@timestamp", + "title": "tychon-pqc*" + } + ], + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "tychon.index: inventory" + }, + "visualization": { + "columns": [ + { + "columnId": "c452013b-c1a4-444a-9861-fd5f8283dbb8", + "isMetric": false, + "isTransposed": false + }, + { + "columnId": "66633750-7aab-4f60-82cb-63d6b4fb604e", + "isMetric": true, + "isTransposed": false + }, + { + "alignment": "center", + "columnId": "64bc500b-17f2-4b63-99de-710ec63da6b9", + "isMetric": true, + "isTransposed": false + }, + { + "columnId": "f1c203be-6445-4ac0-8f8f-64797cb120ba", + "isMetric": true, + "isTransposed": false + }, + { + "alignment": "center", + "columnId": "72caa386-75a2-404d-996c-609cc9ce8705", + "isMetric": false, + "isTransposed": false + }, + { + "columnId": "98a06023-cab2-4907-bc55-dbb722c5294a", + "isMetric": true, + "isTransposed": false + }, + { + "alignment": "center", + "columnId": "c38c78d3-f83a-4b39-8766-fd169aa8f1cf", + "isMetric": false, + "isTransposed": false + }, + { + "columnId": "496f4a9c-c379-4dfc-8e74-df11f73cfa52", + "isMetric": false, + "isTransposed": false + }, + { + "alignment": "center", + "columnId": "d60e63d5-11c7-4413-b41f-139d3870723e", + "isMetric": true, + "isTransposed": false + } + ], + "layerId": "76c0d382-132a-4232-b1ba-2928d86d36eb", + "layerType": "data" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": { + "dynamicActions": { + "events": [] + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "tychon.index: inventory" + }, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false + }, + "gridData": { + "h": 12, + "i": "316d40b0-635e-4969-bf7a-b5e03e2834b4", + "w": 48, + "x": 0, + "y": 91 + }, + "panelIndex": "316d40b0-635e-4969-bf7a-b5e03e2834b4", + "type": "lens" + }, + { + "embeddableConfig": { + "description": "OMB Report for the Department of Defense", + "enhancements": { + "dynamicActions": { + "events": [] + } + } + }, + "gridData": { + "h": 54, + "i": "dab055a8-39ea-4507-a004-7e78a229d7e7", + "w": 48, + "x": 0, + "y": 103 + }, + "panelIndex": "dab055a8-39ea-4507-a004-7e78a229d7e7", + "panelRefName": "panel_dab055a8-39ea-4507-a004-7e78a229d7e7", + "title": "DoD OMB Report", + "type": "search" + } + ], + "refreshInterval": { + "pause": true, + "value": 60000 + }, + "timeFrom": "now-1y/d", + "timeRestore": true, + "timeTo": "now", + "title": "[TYCHON Quantum Command] Application Report", + "version": 3 + }, + "coreMigrationVersion": "8.8.0", + "created_at": "2026-07-20T16:55:14.701Z", + "id": "tychon_quantum_command-443e5928-b1c4-4e07-b0b9-c675dd057e2f-application-report", + "references": [ + { + "id": "tychon_quantum_command-d0159137-9139-4a93-85bb-2ac9ddab3982-certificate-operations-dashboard", + "name": "01b3101c-246d-448d-a05d-3a05e7747926:drilldown:DASHBOARD_TO_DASHBOARD_DRILLDOWN:dfda3f15-fd80-541a-a930-8a72e988f26d:dashboardId", + "type": "dashboard" + }, + { + "id": "tychon_quantum_command-6dfff015-3cc9-48b6-9410-7d8c01ff0d9a-application-detail", + "name": "07f49118-bcf0-44f7-875a-df393ce88c47:drilldown:DASHBOARD_TO_DASHBOARD_DRILLDOWN:d0188d05-be4a-474b-8825-cf250d80d88f:dashboardId", + "type": "dashboard" + }, + { + "id": "tychon_quantum_command-6dfff015-3cc9-48b6-9410-7d8c01ff0d9a-application-detail", + "name": "2e9c8eb8-3234-44f1-aaf7-95b6832d1657:drilldown:DASHBOARD_TO_DASHBOARD_DRILLDOWN:9c6edb36-c71b-5cf1-8dcd-a37de6214334:dashboardId", + "type": "dashboard" + }, + { + "id": "tychon_quantum_command-6f3d60d5-b5fb-45a5-9298-acf3ceb3ea1b-application-connections-topology", + "name": "5a1a9fd8-a9e5-4333-ad15-e08a3b6cb091:drilldown:DASHBOARD_TO_DASHBOARD_DRILLDOWN:0ba322cf-440b-5ad3-a615-62aad7cf634c:dashboardId", + "type": "dashboard" + }, + { + "id": "tychon_quantum_command-6dfff015-3cc9-48b6-9410-7d8c01ff0d9a-application-detail", + "name": "ae78c400-d497-4d7f-9541-3e14fb724097:drilldown:DASHBOARD_TO_DASHBOARD_DRILLDOWN:b0c9f1de-0afd-5b7d-b3a1-fb28c055a10a:dashboardId", + "type": "dashboard" + }, + { + "id": "tychon_quantum_command-6dfff015-3cc9-48b6-9410-7d8c01ff0d9a-application-detail", + "name": "bd58f6e5-41a8-4bd7-9b5b-c8f2502833b1:drilldown:DASHBOARD_TO_DASHBOARD_DRILLDOWN:d46a3ff4-c28b-57a1-a225-f58957519288:dashboardId", + "type": "dashboard" + }, + { + "id": "tychon_quantum_command-6f3d60d5-b5fb-45a5-9298-acf3ceb3ea1b-application-connections-topology", + "name": "d2885626-4e44-41c7-b5ba-45c5b524280a:drilldown:DASHBOARD_TO_DASHBOARD_DRILLDOWN:e17bab29-a9ff-52fc-911c-0fbbde37ba9b:dashboardId", + "type": "dashboard" + }, + { + "id": "05179988-8b3d-4f26-9832-d83a1e769b2d", + "name": "01b3101c-246d-448d-a05d-3a05e7747926:indexpattern-datasource-layer-9110ccf0-1795-4d13-bab1-9a55f24a24a6", + "type": "index-pattern" + }, + { + "id": "05179988-8b3d-4f26-9832-d83a1e769b2d", + "name": "07f49118-bcf0-44f7-875a-df393ce88c47:indexpattern-datasource-layer-e75aaba0-a144-4cc0-a761-f8be87375cb4", + "type": "index-pattern" + }, + { + "id": "05179988-8b3d-4f26-9832-d83a1e769b2d", + "name": "2e9c8eb8-3234-44f1-aaf7-95b6832d1657:indexpattern-datasource-layer-9110ccf0-1795-4d13-bab1-9a55f24a24a6", + "type": "index-pattern" + }, + { + "id": "05179988-8b3d-4f26-9832-d83a1e769b2d", + "name": "316d40b0-635e-4969-bf7a-b5e03e2834b4:indexpattern-datasource-layer-76c0d382-132a-4232-b1ba-2928d86d36eb", + "type": "index-pattern" + }, + { + "id": "05179988-8b3d-4f26-9832-d83a1e769b2d", + "name": "5a1a9fd8-a9e5-4333-ad15-e08a3b6cb091:indexpattern-datasource-layer-8e8a2d62-de50-4140-91d5-4d323f4bfe51", + "type": "index-pattern" + }, + { + "id": "05179988-8b3d-4f26-9832-d83a1e769b2d", + "name": "ae78c400-d497-4d7f-9541-3e14fb724097:indexpattern-datasource-layer-9110ccf0-1795-4d13-bab1-9a55f24a24a6", + "type": "index-pattern" + }, + { + "id": "05179988-8b3d-4f26-9832-d83a1e769b2d", + "name": "bd58f6e5-41a8-4bd7-9b5b-c8f2502833b1:indexpattern-datasource-layer-9110ccf0-1795-4d13-bab1-9a55f24a24a6", + "type": "index-pattern" + }, + { + "id": "05179988-8b3d-4f26-9832-d83a1e769b2d", + "name": "d2885626-4e44-41c7-b5ba-45c5b524280a:indexpattern-datasource-layer-9110ccf0-1795-4d13-bab1-9a55f24a24a6", + "type": "index-pattern" + }, + { + "id": "tychon_quantum_command-662602a4-f820-4e80-9fe2-115c951fe43c-dod-omb-report", + "name": "dab055a8-39ea-4507-a004-7e78a229d7e7:panel_dab055a8-39ea-4507-a004-7e78a229d7e7", + "type": "search" + }, + { + "id": "tychon_quantum_command-e9b715ba-5f19-4f99-b837-2c1a24143212", + "name": "tag-ref-tychon_quantum_command-e9b715ba-5f19-4f99-b837-2c1a24143212", + "type": "tag" + }, + { + "id": "tychon_quantum_command-07b6a21f-5bba-413b-8d49-e8c246dde2ba", + "name": "tag-ref-tychon_quantum_command-07b6a21f-5bba-413b-8d49-e8c246dde2ba", + "type": "tag" + }, + { + "id": "tychon_quantum_command-dacb217e-57b4-4296-8545-cbf6b5739344", + "name": "tag-ref-tychon_quantum_command-dacb217e-57b4-4296-8545-cbf6b5739344", + "type": "tag" + } + ], + "type": "dashboard", + "typeMigrationVersion": "10.3.0" +} diff --git a/packages/tychon_quantum_command/kibana/dashboard/tychon_quantum_command-6dfff015-3cc9-48b6-9410-7d8c01ff0d9a-application-detail.json b/packages/tychon_quantum_command/kibana/dashboard/tychon_quantum_command-6dfff015-3cc9-48b6-9410-7d8c01ff0d9a-application-detail.json new file mode 100644 index 00000000000..610f352f268 --- /dev/null +++ b/packages/tychon_quantum_command/kibana/dashboard/tychon_quantum_command-6dfff015-3cc9-48b6-9410-7d8c01ff0d9a-application-detail.json @@ -0,0 +1,2235 @@ +{ + "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": { + "ignoreFilters": false, + "ignoreQuery": false, + "ignoreTimerange": false, + "ignoreValidations": false + }, + "panelsJSON": {}, + "showApplySelections": false + }, + "description": "Aligns to schema 2.0.3.", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "useMargins": true + }, + "panelsJSON": [ + { + "embeddableConfig": { + "enhancements": {}, + "hidePanelTitles": true, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "id": "", + "params": { + "fontSize": 12, + "markdown": "[Inventory](/app/dashboards#/view/tychon_quantum_command-32c01eb5-0d80-4a28-9de7-55b2046f7c45-inventory) | [Application Report](/app/dashboards#/view/tychon_quantum_command-443e5928-b1c4-4e07-b0b9-c675dd057e2f-application-report) | Application Detail | [Certificate Report](/app/dashboards#/view/tychon_quantum_command-d0159137-9139-4a93-85bb-2ac9ddab3982-certificate-operations-dashboard) | [Application Connections Topology](/app/dashboards#/view/tychon_quantum_command-6f3d60d5-b5fb-45a5-9298-acf3ceb3ea1b-application-connections-topology) | [Cost Analysis](/app/dashboards#/view/tychon_quantum_command-02366033-dee4-4ea4-8458-7c8a8b58987e-cost-analysis)", + "openLinksInNewTab": false + }, + "title": "", + "type": "markdown", + "uiState": {} + } + }, + "gridData": { + "h": 3, + "i": "tychon-quantum-command-nav", + "w": 48, + "x": 0, + "y": 0 + }, + "panelIndex": "tychon-quantum-command-nav", + "title": "", + "type": "visualization" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "7eee23b7-ddb2-4c12-ad44-a12d7e8301cf", + "name": "indexpattern-datasource-layer-341cf49e-257b-48f0-af62-9d0ae3420573", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "currentIndexPatternId": "7eee23b7-ddb2-4c12-ad44-a12d7e8301cf", + "layers": { + "341cf49e-257b-48f0-af62-9d0ae3420573": { + "columnOrder": [ + "babddc5e-7343-42a8-941a-4d81e5d985ae", + "53541012-c568-493f-87d8-0a4800cc6dab" + ], + "columns": { + "53541012-c568-493f-87d8-0a4800cc6dab": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "babddc5e-7343-42a8-941a-4d81e5d985ae": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Process Name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "53541012-c568-493f-87d8-0a4800cc6dab", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "process.name" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "indexPatternId": "7eee23b7-ddb2-4c12-ad44-a12d7e8301cf", + "sampling": 1 + } + } + }, + "indexpattern": { + "currentIndexPatternId": "7eee23b7-ddb2-4c12-ad44-a12d7e8301cf", + "layers": {} + }, + "textBased": { + "indexPatternRefs": [ + { + "id": "7eee23b7-ddb2-4c12-ad44-a12d7e8301cf", + "timeField": "@timestamp", + "title": "tychon-pqc-inventory*" + } + ], + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "babddc5e-7343-42a8-941a-4d81e5d985ae", + "isMetric": false, + "isTransposed": false + }, + { + "columnId": "53541012-c568-493f-87d8-0a4800cc6dab", + "isMetric": true, + "isTransposed": false + } + ], + "layerId": "341cf49e-257b-48f0-af62-9d0ae3420573", + "layerType": "data" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": { + "dynamicActions": { + "events": [] + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" + }, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false + }, + "gridData": { + "h": 7, + "i": "0f84ffed-4e62-4c1c-bedc-be51e098a775", + "w": 11, + "x": 0, + "y": 2 + }, + "panelIndex": "0f84ffed-4e62-4c1c-bedc-be51e098a775", + "type": "lens" + }, + { + "embeddableConfig": { + "enhancements": { + "dynamicActions": { + "events": [] + } + }, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "id": "", + "params": { + "spec": "{\"$schema\": \"https://vega.github.io/schema/vega/v5.json\", \"padding\": {\"top\": 0, \"bottom\": 0, \"left\": 0, \"right\": 0}, \"background\": \"#111111\", \"signals\": [{\"name\": \"sel\", \"value\": null, \"on\": [{\"events\": {\"type\": \"click\", \"markname\": \"bg\"}, \"update\": \"datum.t === sel ? null : datum.t\", \"force\": true}]}, {\"name\": \"_kf\", \"value\": null, \"on\": [{\"events\": {\"type\": \"click\", \"markname\": \"bg\"}, \"update\": \"datum.t === sel ? kibanaRemoveFilter({'match_phrase': {'omb.kex_tier': datum.t}}) : kibanaAddFilter({'match_phrase': {'omb.kex_tier': datum.t}})\", \"force\": true}]}], \"data\": [{\"name\": \"raw\", \"url\": {\"%context%\": true, \"%timefield%\": \"@timestamp\", \"index\": \"tychon-pqc-inventory*\", \"body\": {\"size\": 0, \"aggs\": {\"k\": {\"terms\": {\"field\": \"omb.kex_tier\", \"size\": 20}, \"aggs\": {\"u\": {\"cardinality\": {\"field\": \"process.executable\"}}}}}}}, \"format\": {\"property\": \"aggregations.k.buckets\"}, \"transform\": [{\"type\": \"formula\", \"as\": \"t\", \"expr\": \"datum.key\"}, {\"type\": \"formula\", \"as\": \"hcount\", \"expr\": \"datum.u ? datum.u.value : 0\"}]}, {\"name\": \"tc\", \"source\": \"raw\", \"transform\": [{\"type\": \"aggregate\", \"groupby\": [\"t\"], \"ops\": [\"sum\"], \"fields\": [\"hcount\"], \"as\": [\"n\"]}]}, {\"name\": \"mx\", \"source\": \"tc\", \"transform\": [{\"type\": \"aggregate\", \"ops\": [\"max\"], \"fields\": [\"n\"], \"as\": [\"v\"]}]}, {\"name\": \"rows\", \"values\": [{\"t\": \"PQC READY\", \"lbl\": \"ML-KEM / Kyber\", \"desc\": \"Post-quantum \\u2014 harvest-proof\", \"badge\": \"PQC READY\", \"clr\": \"#00c853\", \"bg\": \"#00c85318\", \"ord\": 0}, {\"t\": \"MODERN\", \"lbl\": \"X25519 / ECDHE\", \"desc\": \"Elliptic curve \\u2014 quantum-vulnerable\", \"badge\": \"MODERN\", \"clr\": \"#448aff\", \"bg\": \"#448aff18\", \"ord\": 1}, {\"t\": \"CLASSICAL\", \"lbl\": \"DHE / DH\", \"desc\": \"Finite-field DH \\u2014 quantum-vulnerable\", \"badge\": \"CLASSICAL\", \"clr\": \"#ffa726\", \"bg\": \"#ffa72618\", \"ord\": 2}, {\"t\": \"LEGACY\", \"lbl\": \"RSA Key Exchange\", \"desc\": \"No forward secrecy \\u2014 deprecated\", \"badge\": \"LEGACY\", \"clr\": \"#ef5350\", \"bg\": \"#ef535018\", \"ord\": 3}], \"transform\": [{\"type\": \"lookup\", \"from\": \"tc\", \"key\": \"t\", \"fields\": [\"t\"], \"values\": [\"n\"], \"as\": [\"n\"], \"default\": 0}, {\"type\": \"formula\", \"as\": \"y\", \"expr\": \"datum.ord * 72 + 60\"}]}], \"marks\": [{\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"value\": 16}, \"y\": {\"value\": 18}, \"text\": {\"value\": \"POST-QUANTUM CRYPTOGRAPHY READINESS\"}, \"fill\": {\"value\": \"#cccccc\"}, \"fontSize\": {\"value\": 10}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"letterSpacing\": {\"value\": 1.5}}}}, {\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"value\": 16}, \"y\": {\"value\": 38}, \"text\": {\"value\": \"KEY EXCHANGE \\u2014 click a tier to filter\"}, \"fill\": {\"value\": \"#555555\"}, \"fontSize\": {\"value\": 9}, \"font\": {\"value\": \"monospace\"}, \"letterSpacing\": {\"value\": 1}}}}, {\"type\": \"rule\", \"encode\": {\"enter\": {\"x\": {\"value\": 0}, \"x2\": {\"signal\": \"width\"}, \"y\": {\"value\": 48}, \"stroke\": {\"value\": \"#252525\"}, \"strokeWidth\": {\"value\": 1}}}}, {\"type\": \"rect\", \"name\": \"bg\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 0}, \"y\": {\"field\": \"y\"}, \"width\": {\"signal\": \"width\"}, \"height\": {\"value\": 66}, \"fill\": {\"signal\": \"datum.t===sel?'#1c1c2e':datum.n>0?'#161622':'#161616'\"}, \"cursor\": {\"value\": \"pointer\"}}}}, {\"type\": \"rect\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 0}, \"y\": {\"field\": \"y\"}, \"width\": {\"value\": 4}, \"height\": {\"value\": 66}, \"fill\": {\"signal\": \"datum.n>0?datum.clr:'#2a2a2a'\"}}}}, {\"type\": \"rule\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 0}, \"x2\": {\"signal\": \"width\"}, \"y\": {\"signal\": \"datum.y + 65\"}, \"stroke\": {\"value\": \"#222222\"}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 18}, \"y\": {\"signal\": \"datum.y + 24\"}, \"text\": {\"signal\": \"datum.lbl\"}, \"limit\": {\"signal\": \"width*0.62-18\"}, \"fill\": {\"signal\": \"datum.n>0?'#e8e8e8':'#444444'\"}, \"fontSize\": {\"value\": 13}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 18}, \"y\": {\"signal\": \"datum.y + 44\"}, \"text\": {\"signal\": \"datum.desc\"}, \"limit\": {\"signal\": \"width*0.62-18\"}, \"fill\": {\"value\": \"#555555\"}, \"fontSize\": {\"value\": 10}, \"font\": {\"value\": \"monospace\"}}}}, {\"type\": \"rect\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width*0.65\"}, \"y\": {\"signal\": \"datum.y + 8\"}, \"width\": {\"value\": 82}, \"height\": {\"value\": 17}, \"cornerRadius\": {\"value\": 2}, \"fill\": {\"signal\": \"datum.n>0?datum.bg:'#1a1a1a'\"}, \"stroke\": {\"signal\": \"datum.n>0?datum.clr:'#2a2a2a'\"}, \"strokeWidth\": {\"value\": 1}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width*0.65+41\"}, \"y\": {\"signal\": \"datum.y + 20\"}, \"text\": {\"signal\": \"datum.badge\"}, \"fill\": {\"signal\": \"datum.n>0?datum.clr:'#383838'\"}, \"fontSize\": {\"value\": 9}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"center\"}, \"letterSpacing\": {\"value\": 1}}}}, {\"type\": \"rect\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width*0.65\"}, \"y\": {\"signal\": \"datum.y + 31\"}, \"width\": {\"value\": 82}, \"height\": {\"value\": 17}, \"cornerRadius\": {\"value\": 2}, \"fill\": {\"signal\": \"'#1a1a1a'\"}, \"stroke\": {\"signal\": \"'#333333'\"}, \"strokeWidth\": {\"value\": 1}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width*0.65+41\"}, \"y\": {\"signal\": \"datum.y + 43\"}, \"text\": {\"signal\": \"datum.t===sel?'SELECTED':''\"}, \"fill\": {\"signal\": \"datum.t===sel?datum.clr:'#448aff'\"}, \"fontSize\": {\"value\": 9}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"center\"}, \"letterSpacing\": {\"value\": 1}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width-10\"}, \"y\": {\"signal\": \"datum.y + 36\"}, \"text\": {\"signal\": \"datum.n>0?(datum.n>=1000?format(datum.n,'.3~s'):format(datum.n,',')):'\\u2014'\"}, \"fill\": {\"signal\": \"datum.t===sel?datum.clr:datum.n>0?'#dddddd':'#333333'\"}, \"fontSize\": {\"value\": 20}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"right\"}}}}, {\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"signal\": \"width/2\"}, \"y\": {\"signal\": \"height-8\"}, \"text\": {\"value\": \"\\u2191 at the highest tier\"}, \"fill\": {\"value\": \"#2a2a2a\"}, \"fontSize\": {\"value\": 9}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"center\"}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width / 2\"}, \"y\": {\"signal\": \"height / 2 - 8\"}, \"text\": {\"signal\": \"length(data('raw')) === 0 ? 'NO DATA FOR CURRENT FILTERS / TIME RANGE' : ''\"}, \"fill\": {\"value\": \"#666666\"}, \"font\": {\"value\": \"monospace\"}, \"fontSize\": {\"value\": 11}, \"fontWeight\": {\"value\": \"bold\"}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"zindex\": {\"value\": 100}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width / 2\"}, \"y\": {\"signal\": \"height / 2 + 12\"}, \"text\": {\"signal\": \"length(data('raw')) === 0 ? 'Adjust dashboard filters or expand the selected time range.' : ''\"}, \"fill\": {\"value\": \"#444444\"}, \"font\": {\"value\": \"monospace\"}, \"fontSize\": {\"value\": 9}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"zindex\": {\"value\": 100}}}}]}" + }, + "title": "", + "type": "vega", + "uiState": {} + } + }, + "gridData": { + "h": 14, + "i": "5863cc6f-de20-4892-891f-069d5a9316f9", + "w": 11, + "x": 11, + "y": 2 + }, + "panelIndex": "5863cc6f-de20-4892-891f-069d5a9316f9", + "type": "visualization" + }, + { + "embeddableConfig": { + "enhancements": { + "dynamicActions": { + "events": [] + } + }, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "id": "", + "params": { + "spec": "{\"$schema\": \"https://vega.github.io/schema/vega/v5.json\", \"padding\": {\"top\": 0, \"bottom\": 0, \"left\": 0, \"right\": 0}, \"background\": \"#111111\", \"signals\": [{\"name\": \"sel\", \"value\": null, \"on\": [{\"events\": {\"type\": \"click\", \"markname\": \"bg\"}, \"update\": \"datum.t === sel ? null : datum.t\", \"force\": true}]}, {\"name\": \"_kf\", \"value\": null, \"on\": [{\"events\": {\"type\": \"click\", \"markname\": \"bg\"}, \"update\": \"datum.t === sel ? kibanaRemoveFilter({'match_phrase': {'omb.protocol_tier': datum.t}}) : kibanaAddFilter({'match_phrase': {'omb.protocol_tier': datum.t}})\", \"force\": true}]}], \"data\": [{\"name\": \"raw\", \"url\": {\"%context%\": true, \"%timefield%\": \"@timestamp\", \"index\": \"tychon-pqc-inventory*\", \"body\": {\"size\": 0, \"aggs\": {\"k\": {\"terms\": {\"field\": \"omb.protocol_tier\", \"size\": 50}}}}}, \"format\": {\"property\": \"aggregations.k.buckets\"}, \"transform\": [{\"type\": \"formula\", \"as\": \"t\", \"expr\": \"datum.key\"}]}, {\"name\": \"tc\", \"source\": \"raw\", \"transform\": [{\"type\": \"aggregate\", \"groupby\": [\"t\"], \"ops\": [\"sum\"], \"fields\": [\"doc_count\"], \"as\": [\"n\"]}]}, {\"name\": \"mx\", \"source\": \"tc\", \"transform\": [{\"type\": \"aggregate\", \"ops\": [\"max\"], \"fields\": [\"n\"], \"as\": [\"v\"]}]}, {\"name\": \"rows\", \"values\": [{\"t\": \"TLS 1.3\", \"lbl\": \"TLS 1.3\", \"desc\": \"Required for PQC key exchange \\u2014 carries ML-KEM key_share\", \"badge\": \"PQC READY\", \"clr\": \"#00c853\", \"bg\": \"#00c85318\", \"ord\": 0}, {\"t\": \"TLS 1.2\", \"lbl\": \"TLS 1.2\", \"desc\": \"Supports ECDHE/DHE forward secrecy but not ML-KEM key encapsulation\", \"badge\": \"NO KEM EXT\", \"clr\": \"#ffa726\", \"bg\": \"#ffa72618\", \"ord\": 1}, {\"t\": \"LEGACY\", \"lbl\": \"TLS 1.1 or below\", \"desc\": \"Deprecated \\u2014 contains known protocol vulnerabilities, should be disabled\", \"badge\": \"DEPRECATED\", \"clr\": \"#ef5350\", \"bg\": \"#ef535018\", \"ord\": 2}], \"transform\": [{\"type\": \"lookup\", \"from\": \"tc\", \"key\": \"t\", \"fields\": [\"t\"], \"values\": [\"n\"], \"as\": [\"n\"], \"default\": 0}, {\"type\": \"formula\", \"as\": \"y\", \"expr\": \"datum.ord * 72 + 60\"}]}], \"marks\": [{\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"value\": 16}, \"y\": {\"value\": 18}, \"text\": {\"value\": \"TLS PROTOCOL VERSION\"}, \"fill\": {\"value\": \"#cccccc\"}, \"fontSize\": {\"value\": 10}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"letterSpacing\": {\"value\": 1.5}}}}, {\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"value\": 16}, \"y\": {\"value\": 38}, \"text\": {\"value\": \"PREFERRED PROTOCOL \\u2014 click a tier to filter\"}, \"fill\": {\"value\": \"#555555\"}, \"fontSize\": {\"value\": 9}, \"font\": {\"value\": \"monospace\"}, \"letterSpacing\": {\"value\": 1}}}}, {\"type\": \"rule\", \"encode\": {\"enter\": {\"x\": {\"value\": 0}, \"x2\": {\"signal\": \"width\"}, \"y\": {\"value\": 48}, \"stroke\": {\"value\": \"#252525\"}, \"strokeWidth\": {\"value\": 1}}}}, {\"type\": \"rect\", \"name\": \"bg\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 0}, \"y\": {\"field\": \"y\"}, \"width\": {\"signal\": \"width\"}, \"height\": {\"value\": 66}, \"fill\": {\"signal\": \"datum.t===sel?'#1c1c2e':datum.n>0?'#161622':'#161616'\"}, \"cursor\": {\"value\": \"pointer\"}}}}, {\"type\": \"rect\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 0}, \"y\": {\"field\": \"y\"}, \"width\": {\"value\": 4}, \"height\": {\"value\": 66}, \"fill\": {\"signal\": \"datum.n>0?datum.clr:'#2a2a2a'\"}}}}, {\"type\": \"rule\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 0}, \"x2\": {\"signal\": \"width\"}, \"y\": {\"signal\": \"datum.y + 65\"}, \"stroke\": {\"value\": \"#222222\"}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 18}, \"y\": {\"signal\": \"datum.y + 24\"}, \"text\": {\"signal\": \"datum.lbl\"}, \"limit\": {\"signal\": \"width*0.62-18\"}, \"fill\": {\"signal\": \"datum.n>0?'#e8e8e8':'#444444'\"}, \"fontSize\": {\"value\": 13}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 18}, \"y\": {\"signal\": \"datum.y + 44\"}, \"text\": {\"signal\": \"datum.desc\"}, \"limit\": {\"signal\": \"width*0.62-18\"}, \"fill\": {\"value\": \"#555555\"}, \"fontSize\": {\"value\": 10}, \"font\": {\"value\": \"monospace\"}}}}, {\"type\": \"rect\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width*0.65\"}, \"y\": {\"signal\": \"datum.y + 8\"}, \"width\": {\"value\": 82}, \"height\": {\"value\": 17}, \"cornerRadius\": {\"value\": 2}, \"fill\": {\"signal\": \"datum.n>0?datum.bg:'#1a1a1a'\"}, \"stroke\": {\"signal\": \"datum.n>0?datum.clr:'#2a2a2a'\"}, \"strokeWidth\": {\"value\": 1}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width*0.65+41\"}, \"y\": {\"signal\": \"datum.y + 20\"}, \"text\": {\"signal\": \"datum.badge\"}, \"fill\": {\"signal\": \"datum.n>0?datum.clr:'#383838'\"}, \"fontSize\": {\"value\": 9}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"center\"}, \"letterSpacing\": {\"value\": 1}}}}, {\"type\": \"rect\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width*0.65\"}, \"y\": {\"signal\": \"datum.y + 31\"}, \"width\": {\"value\": 82}, \"height\": {\"value\": 17}, \"cornerRadius\": {\"value\": 2}, \"fill\": {\"signal\": \"'#1a1a1a'\"}, \"stroke\": {\"signal\": \"'#333333'\"}, \"strokeWidth\": {\"value\": 1}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width*0.65+41\"}, \"y\": {\"signal\": \"datum.y + 43\"}, \"text\": {\"signal\": \"datum.t===sel?'SELECTED':''\"}, \"fill\": {\"signal\": \"datum.t===sel?datum.clr:'#448aff'\"}, \"fontSize\": {\"value\": 9}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"center\"}, \"letterSpacing\": {\"value\": 1}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width-10\"}, \"y\": {\"signal\": \"datum.y + 36\"}, \"text\": {\"signal\": \"datum.n>0?(datum.n>=1000?format(datum.n,'.3~s'):format(datum.n,',')):'\\u2014'\"}, \"fill\": {\"signal\": \"datum.t===sel?datum.clr:datum.n>0?'#dddddd':'#333333'\"}, \"fontSize\": {\"value\": 20}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"right\"}}}}, {\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"signal\": \"width/2\"}, \"y\": {\"signal\": \"height-8\"}, \"text\": {\"value\": \"\\u2191 at the highest tier\"}, \"fill\": {\"value\": \"#2a2a2a\"}, \"fontSize\": {\"value\": 9}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"center\"}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width / 2\"}, \"y\": {\"signal\": \"height / 2 - 8\"}, \"text\": {\"signal\": \"length(data('raw')) === 0 ? 'NO DATA FOR CURRENT FILTERS / TIME RANGE' : ''\"}, \"fill\": {\"value\": \"#666666\"}, \"font\": {\"value\": \"monospace\"}, \"fontSize\": {\"value\": 11}, \"fontWeight\": {\"value\": \"bold\"}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"zindex\": {\"value\": 100}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width / 2\"}, \"y\": {\"signal\": \"height / 2 + 12\"}, \"text\": {\"signal\": \"length(data('raw')) === 0 ? 'Adjust dashboard filters or expand the selected time range.' : ''\"}, \"fill\": {\"value\": \"#444444\"}, \"font\": {\"value\": \"monospace\"}, \"fontSize\": {\"value\": 9}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"zindex\": {\"value\": 100}}}}]}" + }, + "title": "", + "type": "vega", + "uiState": {} + } + }, + "gridData": { + "h": 14, + "i": "a293b107-7762-4b76-a2f8-6497e1d52dbf", + "w": 12, + "x": 22, + "y": 2 + }, + "panelIndex": "a293b107-7762-4b76-a2f8-6497e1d52dbf", + "type": "visualization" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "0e56225a-3b03-4f4e-bdbc-2fd59f0ef78c", + "name": "indexpattern-datasource-layer-a3b23fce-41b6-41ac-bf8c-8434eafb70cd", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "currentIndexPatternId": "0e56225a-3b03-4f4e-bdbc-2fd59f0ef78c", + "layers": { + "a3b23fce-41b6-41ac-bf8c-8434eafb70cd": { + "columnOrder": [ + "3863f9f1-0deb-4fcd-bf1c-c344bc19f579", + "a506ec6b-bb03-4116-884b-04cea6bcb388" + ], + "columns": { + "3863f9f1-0deb-4fcd-bf1c-c344bc19f579": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Ports ", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "a506ec6b-bb03-4116-884b-04cea6bcb388", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 50 + }, + "scale": "ordinal", + "sourceField": "server.port" + }, + "a506ec6b-bb03-4116-884b-04cea6bcb388": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "indexPatternId": "0e56225a-3b03-4f4e-bdbc-2fd59f0ef78c", + "sampling": 1 + } + } + }, + "indexpattern": { + "currentIndexPatternId": "0e56225a-3b03-4f4e-bdbc-2fd59f0ef78c", + "layers": {} + }, + "textBased": { + "indexPatternRefs": [ + { + "id": "0e56225a-3b03-4f4e-bdbc-2fd59f0ef78c", + "timeField": "@timestamp", + "title": "tychon-pqc*" + } + ], + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "alignment": "center", + "columnId": "3863f9f1-0deb-4fcd-bf1c-c344bc19f579", + "isMetric": false, + "isTransposed": false + }, + { + "columnId": "a506ec6b-bb03-4116-884b-04cea6bcb388", + "isMetric": true, + "isTransposed": false + } + ], + "layerId": "a3b23fce-41b6-41ac-bf8c-8434eafb70cd", + "layerType": "data" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": { + "dynamicActions": { + "events": [ + { + "action": { + "config": { + "openInNewTab": false, + "useCurrentDateRange": true, + "useCurrentFilters": true + }, + "factoryId": "DASHBOARD_TO_DASHBOARD_DRILLDOWN", + "name": "Open Application Connections Topology" + }, + "eventId": "b5e53a68-24f0-5385-8498-35d2b3d898cc", + "triggers": [ + "FILTER_TRIGGER" + ] + } + ] + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" + }, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false + }, + "gridData": { + "h": 14, + "i": "716deebb-7717-49ad-b463-7f8880f050bf", + "w": 6, + "x": 34, + "y": 2 + }, + "panelIndex": "716deebb-7717-49ad-b463-7f8880f050bf", + "title": "Ports Identified", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "0e56225a-3b03-4f4e-bdbc-2fd59f0ef78c", + "name": "indexpattern-datasource-layer-a3b23fce-41b6-41ac-bf8c-8434eafb70cd", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "currentIndexPatternId": "0e56225a-3b03-4f4e-bdbc-2fd59f0ef78c", + "layers": { + "a3b23fce-41b6-41ac-bf8c-8434eafb70cd": { + "columnOrder": [ + "3863f9f1-0deb-4fcd-bf1c-c344bc19f579", + "a506ec6b-bb03-4116-884b-04cea6bcb388" + ], + "columns": { + "3863f9f1-0deb-4fcd-bf1c-c344bc19f579": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Version", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "a506ec6b-bb03-4116-884b-04cea6bcb388", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 50 + }, + "scale": "ordinal", + "sourceField": "omb.software_package_version" + }, + "a506ec6b-bb03-4116-884b-04cea6bcb388": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count of records ", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "indexPatternId": "0e56225a-3b03-4f4e-bdbc-2fd59f0ef78c", + "sampling": 1 + } + } + }, + "indexpattern": { + "currentIndexPatternId": "7eee23b7-ddb2-4c12-ad44-a12d7e8301cf", + "layers": {} + }, + "textBased": { + "indexPatternRefs": [ + { + "id": "7eee23b7-ddb2-4c12-ad44-a12d7e8301cf", + "timeField": "@timestamp", + "title": "tychon-pqc-inventory*" + } + ], + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "3863f9f1-0deb-4fcd-bf1c-c344bc19f579", + "isMetric": false, + "isTransposed": false + }, + { + "columnId": "a506ec6b-bb03-4116-884b-04cea6bcb388", + "isMetric": true, + "isTransposed": false + } + ], + "layerId": "a3b23fce-41b6-41ac-bf8c-8434eafb70cd", + "layerType": "data" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": { + "dynamicActions": { + "events": [] + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" + }, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false + }, + "gridData": { + "h": 14, + "i": "5b71a4a3-dde9-4d62-9791-475787c052df", + "w": 8, + "x": 40, + "y": 2 + }, + "panelIndex": "5b71a4a3-dde9-4d62-9791-475787c052df", + "title": "Versions Found", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "7eee23b7-ddb2-4c12-ad44-a12d7e8301cf", + "name": "indexpattern-datasource-layer-341cf49e-257b-48f0-af62-9d0ae3420573", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "currentIndexPatternId": "7eee23b7-ddb2-4c12-ad44-a12d7e8301cf", + "layers": { + "341cf49e-257b-48f0-af62-9d0ae3420573": { + "columnOrder": [ + "babddc5e-7343-42a8-941a-4d81e5d985ae", + "53541012-c568-493f-87d8-0a4800cc6dab" + ], + "columns": { + "53541012-c568-493f-87d8-0a4800cc6dab": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "babddc5e-7343-42a8-941a-4d81e5d985ae": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Directory Path", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "53541012-c568-493f-87d8-0a4800cc6dab", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 20 + }, + "scale": "ordinal", + "sourceField": "process.executable_directory" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "indexPatternId": "7eee23b7-ddb2-4c12-ad44-a12d7e8301cf", + "sampling": 1 + } + } + }, + "indexpattern": { + "currentIndexPatternId": "7eee23b7-ddb2-4c12-ad44-a12d7e8301cf", + "layers": {} + }, + "textBased": { + "indexPatternRefs": [ + { + "id": "7eee23b7-ddb2-4c12-ad44-a12d7e8301cf", + "timeField": "@timestamp", + "title": "tychon-pqc-inventory*" + } + ], + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "babddc5e-7343-42a8-941a-4d81e5d985ae", + "isMetric": false, + "isTransposed": false + }, + { + "columnId": "53541012-c568-493f-87d8-0a4800cc6dab", + "isMetric": true, + "isTransposed": false + } + ], + "layerId": "341cf49e-257b-48f0-af62-9d0ae3420573", + "layerType": "data" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": { + "dynamicActions": { + "events": [] + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" + }, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false + }, + "gridData": { + "h": 7, + "i": "541e6258-f438-4fd0-b039-adcdc944bb8a", + "w": 11, + "x": 0, + "y": 9 + }, + "panelIndex": "541e6258-f438-4fd0-b039-adcdc944bb8a", + "title": "", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "0e56225a-3b03-4f4e-bdbc-2fd59f0ef78c", + "name": "indexpattern-datasource-layer-978e2a9e-6e77-4b60-a432-ebb35f2ad6c1", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "currentIndexPatternId": "0e56225a-3b03-4f4e-bdbc-2fd59f0ef78c", + "layers": { + "978e2a9e-6e77-4b60-a432-ebb35f2ad6c1": { + "columnOrder": [ + "bacbe082-96df-43d0-9e2b-1a8a1740c574", + "14f48029-f56d-4db1-8a48-e990270bbb64", + "8902ba19-daec-484d-aea3-8b4ac1cce646", + "dd8a939b-f0f8-4a4b-9b34-56bde897441c", + "340cf762-1dc6-49b8-ade4-a9d707dd978d", + "690b2f8e-0eac-4633-bfa7-47ece118fe33", + "e2845484-f680-42cd-9636-e215edfe9f78", + "b4b643e9-ab88-4830-89c5-aa80ca3bdb7a", + "e4717f8a-c09e-407b-b9ea-673d108cec27" + ], + "columns": { + "14f48029-f56d-4db1-8a48-e990270bbb64": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Domain", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": true, + "orderBy": { + "columnId": "e4717f8a-c09e-407b-b9ea-673d108cec27", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 3 + }, + "scale": "ordinal", + "sourceField": "host.domain" + }, + "340cf762-1dc6-49b8-ade4-a9d707dd978d": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "OS Name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "e4717f8a-c09e-407b-b9ea-673d108cec27", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 3 + }, + "scale": "ordinal", + "sourceField": "host.os.name" + }, + "690b2f8e-0eac-4633-bfa7-47ece118fe33": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "OS Version ", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "e4717f8a-c09e-407b-b9ea-673d108cec27", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 3 + }, + "scale": "ordinal", + "sourceField": "host.os.version" + }, + "8902ba19-daec-484d-aea3-8b4ac1cce646": { + "customLabel": true, + "dataType": "ip", + "isBucketed": true, + "label": "IP", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "e4717f8a-c09e-407b-b9ea-673d108cec27", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 1 + }, + "scale": "ordinal", + "sourceField": "host.ip" + }, + "b4b643e9-ab88-4830-89c5-aa80ca3bdb7a": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Weak TLS Ciphers", + "operationType": "unique_count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "tls.weak_ciphers" + }, + "bacbe082-96df-43d0-9e2b-1a8a1740c574": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Hostname", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "e4717f8a-c09e-407b-b9ea-673d108cec27", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 500 + }, + "scale": "ordinal", + "sourceField": "host.hostname" + }, + "dd8a939b-f0f8-4a4b-9b34-56bde897441c": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "OS Platform", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "e4717f8a-c09e-407b-b9ea-673d108cec27", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 3 + }, + "scale": "ordinal", + "sourceField": "host.os.platform" + }, + "e2845484-f680-42cd-9636-e215edfe9f78": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Unique TLS Ciphers", + "operationType": "unique_count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "tls.insecure_cipher_count" + }, + "e4717f8a-c09e-407b-b9ea-673d108cec27": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Ports", + "operationType": "unique_count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "server.port" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "indexPatternId": "0e56225a-3b03-4f4e-bdbc-2fd59f0ef78c", + "sampling": 1 + } + } + }, + "indexpattern": { + "currentIndexPatternId": "0e56225a-3b03-4f4e-bdbc-2fd59f0ef78c", + "layers": {} + }, + "textBased": { + "indexPatternRefs": [ + { + "id": "0e56225a-3b03-4f4e-bdbc-2fd59f0ef78c", + "timeField": "@timestamp", + "title": "tychon-pqc*" + } + ], + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "bacbe082-96df-43d0-9e2b-1a8a1740c574", + "isMetric": false, + "isTransposed": false + }, + { + "columnId": "e4717f8a-c09e-407b-b9ea-673d108cec27", + "isMetric": true, + "isTransposed": false + }, + { + "alignment": "center", + "columnId": "14f48029-f56d-4db1-8a48-e990270bbb64", + "isMetric": false, + "isTransposed": false, + "oneClickFilter": true + }, + { + "alignment": "center", + "columnId": "8902ba19-daec-484d-aea3-8b4ac1cce646", + "isMetric": false, + "isTransposed": false + }, + { + "alignment": "center", + "columnId": "dd8a939b-f0f8-4a4b-9b34-56bde897441c", + "isMetric": false, + "isTransposed": false + }, + { + "alignment": "center", + "columnId": "340cf762-1dc6-49b8-ade4-a9d707dd978d", + "isMetric": false, + "isTransposed": false + }, + { + "alignment": "center", + "columnId": "690b2f8e-0eac-4633-bfa7-47ece118fe33", + "isMetric": false, + "isTransposed": false + }, + { + "alignment": "center", + "columnId": "b4b643e9-ab88-4830-89c5-aa80ca3bdb7a", + "isMetric": true, + "isTransposed": false + }, + { + "alignment": "center", + "columnId": "e2845484-f680-42cd-9636-e215edfe9f78", + "isMetric": true, + "isTransposed": false + } + ], + "layerId": "978e2a9e-6e77-4b60-a432-ebb35f2ad6c1", + "layerType": "data" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": { + "dynamicActions": { + "events": [ + { + "action": { + "config": { + "openInNewTab": false, + "useCurrentDateRange": true, + "useCurrentFilters": true + }, + "factoryId": "DASHBOARD_TO_DASHBOARD_DRILLDOWN", + "name": "Open Application Connections Topology" + }, + "eventId": "0b95bb86-15cd-5498-b469-92e6120e762b", + "triggers": [ + "FILTER_TRIGGER" + ] + } + ] + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" + }, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false + }, + "gridData": { + "h": 13, + "i": "c35ba11c-8005-4653-b5c4-0e658b426ef9", + "w": 48, + "x": 0, + "y": 16 + }, + "panelIndex": "c35ba11c-8005-4653-b5c4-0e658b426ef9", + "title": "Found On Assets", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "7eee23b7-ddb2-4c12-ad44-a12d7e8301cf", + "name": "indexpattern-datasource-layer-efd1c1c6-66da-400d-b474-d14414080249", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "currentIndexPatternId": "7eee23b7-ddb2-4c12-ad44-a12d7e8301cf", + "layers": { + "efd1c1c6-66da-400d-b474-d14414080249": { + "columnOrder": [ + "3b1be2af-eeaa-4415-8c4d-007b2881bb77", + "96808911-ee68-4654-9dad-f5ec6c1e4136", + "f3b310d9-1571-4d39-8e93-884fd27edcd7", + "e5bdf109-436f-4b84-bd6e-80c86e7c0db4", + "5a5b6100-a1f3-4104-a958-fd5e97733081", + "e9535d81-cde5-48f2-8b39-795b363dc5b3", + "5bf22b6b-946b-4fb0-b457-f3f292f546da", + "c5807b1d-23db-4d1a-8498-e89968ea63c7", + "2dbbc91f-11c4-4396-8a71-3bd2e20b1b19", + "8904b583-14e3-46d5-a978-46c337227a48", + "3243578e-4af0-438a-879e-94b256f1d9ee", + "8de5e4b3-d909-49c4-bb76-ec27660a8af6" + ], + "columns": { + "2dbbc91f-11c4-4396-8a71-3bd2e20b1b19": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "KX Count", + "operationType": "unique_count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "tls.supported_key_exchange_count" + }, + "3243578e-4af0-438a-879e-94b256f1d9ee": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Ciphers", + "operationType": "unique_count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "tls.supported_cipher_count" + }, + "3b1be2af-eeaa-4415-8c4d-007b2881bb77": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "App Process", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": true, + "orderBy": { + "columnId": "8de5e4b3-d909-49c4-bb76-ec27660a8af6", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 5 + }, + "scale": "ordinal", + "sourceField": "process.name" + }, + "5a5b6100-a1f3-4104-a958-fd5e97733081": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Resilient", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "8de5e4b3-d909-49c4-bb76-ec27660a8af6", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 3 + }, + "scale": "ordinal", + "sourceField": "omb.kex_primary_quantum_safe" + }, + "5bf22b6b-946b-4fb0-b457-f3f292f546da": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Cipher Suite", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "8de5e4b3-d909-49c4-bb76-ec27660a8af6", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 3 + }, + "scale": "ordinal", + "sourceField": "tls.preferred_cipher" + }, + "8904b583-14e3-46d5-a978-46c337227a48": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Protocols", + "operationType": "unique_count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "tls.supported_protocol_count" + }, + "8de5e4b3-d909-49c4-bb76-ec27660a8af6": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "96808911-ee68-4654-9dad-f5ec6c1e4136": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Path", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": true, + "orderBy": { + "columnId": "8de5e4b3-d909-49c4-bb76-ec27660a8af6", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 100 + }, + "scale": "ordinal", + "sourceField": "process.executable_directory" + }, + "c5807b1d-23db-4d1a-8498-e89968ea63c7": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Protocol", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "8de5e4b3-d909-49c4-bb76-ec27660a8af6", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 3 + }, + "scale": "ordinal", + "sourceField": "tls.preferred_protocol" + }, + "e5bdf109-436f-4b84-bd6e-80c86e7c0db4": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Package Name", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": true, + "orderBy": { + "columnId": "8de5e4b3-d909-49c4-bb76-ec27660a8af6", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 5 + }, + "scale": "ordinal", + "sourceField": "omb.software_package_name" + }, + "e9535d81-cde5-48f2-8b39-795b363dc5b3": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Key Exchange", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": true, + "orderBy": { + "columnId": "8de5e4b3-d909-49c4-bb76-ec27660a8af6", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 6 + }, + "scale": "ordinal", + "sourceField": "omb.kex_primary" + }, + "f3b310d9-1571-4d39-8e93-884fd27edcd7": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Listening On", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "8de5e4b3-d909-49c4-bb76-ec27660a8af6", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 10 + }, + "scale": "ordinal", + "sourceField": "server.port" + } + }, + "incompleteColumns": {}, + "indexPatternId": "7eee23b7-ddb2-4c12-ad44-a12d7e8301cf", + "sampling": 1 + } + } + }, + "indexpattern": { + "currentIndexPatternId": "7eee23b7-ddb2-4c12-ad44-a12d7e8301cf", + "layers": {} + }, + "textBased": { + "indexPatternRefs": [ + { + "id": "7eee23b7-ddb2-4c12-ad44-a12d7e8301cf", + "timeField": "@timestamp", + "title": "tychon-pqc-inventory*" + } + ], + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "3b1be2af-eeaa-4415-8c4d-007b2881bb77", + "isTransposed": false, + "oneClickFilter": true + }, + { + "columnId": "8de5e4b3-d909-49c4-bb76-ec27660a8af6", + "isMetric": true, + "isTransposed": false + }, + { + "alignment": "center", + "columnId": "f3b310d9-1571-4d39-8e93-884fd27edcd7", + "isMetric": false, + "isTransposed": false + }, + { + "alignment": "center", + "colorMapping": { + "assignments": [ + { + "color": { + "colorIndex": 9, + "paletteId": "eui_amsterdam_color_blind", + "type": "categorical" + }, + "rule": { + "type": "matchExactly", + "values": [ + "0" + ] + }, + "touched": true + }, + { + "color": { + "colorIndex": 0, + "paletteId": "eui_amsterdam_color_blind", + "type": "categorical" + }, + "rule": { + "type": "matchExactly", + "values": [ + "1" + ] + }, + "touched": false + } + ], + "colorMode": { + "type": "categorical" + }, + "paletteId": "eui_amsterdam_color_blind", + "specialAssignments": [ + { + "color": { + "type": "loop" + }, + "rule": { + "type": "other" + }, + "touched": false + } + ] + }, + "colorMode": "cell", + "columnId": "5a5b6100-a1f3-4104-a958-fd5e97733081", + "isMetric": false, + "isTransposed": false, + "palette": { + "name": "default", + "params": { + "stops": [ + { + "color": "#54B399", + "stop": 20 + }, + { + "color": "#6092C0", + "stop": 30 + }, + { + "color": "#D36086", + "stop": 40 + }, + { + "color": "#9170B8", + "stop": 50 + }, + { + "color": "#CA8EAE", + "stop": 60 + }, + { + "color": "#D6BF57", + "stop": 70 + }, + { + "color": "#B9A888", + "stop": 80 + }, + { + "color": "#DA8B45", + "stop": 90 + }, + { + "color": "#AA6556", + "stop": 100 + }, + { + "color": "#E7664C", + "stop": 110 + } + ] + }, + "type": "palette" + } + }, + { + "alignment": "center", + "colorMode": "none", + "columnId": "e9535d81-cde5-48f2-8b39-795b363dc5b3", + "isMetric": false, + "isTransposed": false, + "oneClickFilter": true + }, + { + "alignment": "center", + "columnId": "5bf22b6b-946b-4fb0-b457-f3f292f546da", + "isMetric": false, + "isTransposed": false, + "width": 213.33333333333334 + }, + { + "alignment": "center", + "colorMapping": { + "assignments": [ + { + "color": { + "colorIndex": 0, + "paletteId": "eui_amsterdam_color_blind", + "type": "categorical" + }, + "rule": { + "type": "matchExactly", + "values": [ + "TLSv1.3" + ] + }, + "touched": false + }, + { + "color": { + "colorIndex": 5, + "paletteId": "eui_amsterdam_color_blind", + "type": "categorical" + }, + "rule": { + "type": "matchExactly", + "values": [ + "TLSv1.2" + ] + }, + "touched": true + }, + { + "color": { + "colorIndex": 9, + "paletteId": "eui_amsterdam_color_blind", + "type": "categorical" + }, + "rule": { + "type": "matchExactly", + "values": [ + "TLSv1.1" + ] + }, + "touched": true + }, + { + "color": { + "colorIndex": 9, + "paletteId": "eui_amsterdam_color_blind", + "type": "categorical" + }, + "rule": { + "type": "matchExactly", + "values": [ + "TLSv1.0" + ] + }, + "touched": true + }, + { + "color": { + "colorIndex": 9, + "paletteId": "eui_amsterdam_color_blind", + "type": "categorical" + }, + "rule": { + "type": "matchExactly", + "values": [ + "TLS1" + ] + }, + "touched": true + } + ], + "colorMode": { + "type": "categorical" + }, + "paletteId": "eui_amsterdam_color_blind", + "specialAssignments": [ + { + "color": { + "type": "loop" + }, + "rule": { + "type": "other" + }, + "touched": false + } + ] + }, + "colorMode": "cell", + "columnId": "c5807b1d-23db-4d1a-8498-e89968ea63c7", + "isMetric": false, + "isTransposed": false, + "palette": { + "name": "default", + "params": { + "stops": [ + { + "color": "#54B399", + "stop": 20 + }, + { + "color": "#6092C0", + "stop": 30 + }, + { + "color": "#D36086", + "stop": 40 + }, + { + "color": "#9170B8", + "stop": 50 + }, + { + "color": "#CA8EAE", + "stop": 60 + }, + { + "color": "#D6BF57", + "stop": 70 + }, + { + "color": "#B9A888", + "stop": 80 + }, + { + "color": "#DA8B45", + "stop": 90 + }, + { + "color": "#AA6556", + "stop": 100 + }, + { + "color": "#E7664C", + "stop": 110 + } + ] + }, + "type": "palette" + } + }, + { + "columnId": "e5bdf109-436f-4b84-bd6e-80c86e7c0db4", + "isMetric": false, + "isTransposed": false + }, + { + "columnId": "96808911-ee68-4654-9dad-f5ec6c1e4136", + "isMetric": false, + "isTransposed": false, + "oneClickFilter": true + }, + { + "alignment": "center", + "columnId": "2dbbc91f-11c4-4396-8a71-3bd2e20b1b19", + "isMetric": true, + "isTransposed": false + }, + { + "alignment": "center", + "columnId": "8904b583-14e3-46d5-a978-46c337227a48", + "isMetric": true, + "isTransposed": false + }, + { + "alignment": "center", + "columnId": "3243578e-4af0-438a-879e-94b256f1d9ee", + "isMetric": true, + "isTransposed": false + } + ], + "layerId": "efd1c1c6-66da-400d-b474-d14414080249", + "layerType": "data" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": { + "dynamicActions": { + "events": [] + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" + }, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false + }, + "gridData": { + "h": 15, + "i": "fb740713-8d4d-4114-8816-739a35cf7b68", + "w": 48, + "x": 0, + "y": 29 + }, + "panelIndex": "fb740713-8d4d-4114-8816-739a35cf7b68", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "0e56225a-3b03-4f4e-bdbc-2fd59f0ef78c", + "name": "indexpattern-datasource-layer-bd94c8fb-80f3-4090-b11f-5c3c6b7ce3b1", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "currentIndexPatternId": "0e56225a-3b03-4f4e-bdbc-2fd59f0ef78c", + "layers": { + "bd94c8fb-80f3-4090-b11f-5c3c6b7ce3b1": { + "columnOrder": [ + "fccc8673-7024-4075-bd07-b717a834dfbf", + "76043fbd-8e84-4b5d-83da-3712770265b8" + ], + "columns": { + "76043fbd-8e84-4b5d-83da-3712770265b8": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "fccc8673-7024-4075-bd07-b717a834dfbf": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Weak Ciphers ", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "76043fbd-8e84-4b5d-83da-3712770265b8", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 50 + }, + "scale": "ordinal", + "sourceField": "tls.weak_ciphers" + } + }, + "incompleteColumns": {}, + "indexPatternId": "0e56225a-3b03-4f4e-bdbc-2fd59f0ef78c", + "sampling": 1 + } + } + }, + "indexpattern": { + "currentIndexPatternId": "7eee23b7-ddb2-4c12-ad44-a12d7e8301cf", + "layers": {} + }, + "textBased": { + "indexPatternRefs": [ + { + "id": "7eee23b7-ddb2-4c12-ad44-a12d7e8301cf", + "timeField": "@timestamp", + "title": "tychon-pqc-inventory*" + } + ], + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "fccc8673-7024-4075-bd07-b717a834dfbf", + "isTransposed": false + }, + { + "columnId": "76043fbd-8e84-4b5d-83da-3712770265b8", + "isTransposed": false + } + ], + "layerId": "bd94c8fb-80f3-4090-b11f-5c3c6b7ce3b1", + "layerType": "data" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": { + "dynamicActions": { + "events": [ + { + "action": { + "config": { + "openInNewTab": false, + "useCurrentDateRange": true, + "useCurrentFilters": true + }, + "factoryId": "DASHBOARD_TO_DASHBOARD_DRILLDOWN", + "name": "Open Application Report" + }, + "eventId": "a8bb1dca-9e7f-55bc-b777-050d845c3d7a", + "triggers": [ + "FILTER_TRIGGER" + ] + } + ] + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" + }, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false + }, + "gridData": { + "h": 18, + "i": "686a9532-a314-4685-b25c-7de7c957f361", + "w": 16, + "x": 0, + "y": 44 + }, + "panelIndex": "686a9532-a314-4685-b25c-7de7c957f361", + "title": "Supported Weak Ciphers", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "0e56225a-3b03-4f4e-bdbc-2fd59f0ef78c", + "name": "indexpattern-datasource-layer-bd94c8fb-80f3-4090-b11f-5c3c6b7ce3b1", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "currentIndexPatternId": "0e56225a-3b03-4f4e-bdbc-2fd59f0ef78c", + "layers": { + "bd94c8fb-80f3-4090-b11f-5c3c6b7ce3b1": { + "columnOrder": [ + "fccc8673-7024-4075-bd07-b717a834dfbf", + "76043fbd-8e84-4b5d-83da-3712770265b8" + ], + "columns": { + "76043fbd-8e84-4b5d-83da-3712770265b8": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "fccc8673-7024-4075-bd07-b717a834dfbf": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Insecure Ciphers ", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "76043fbd-8e84-4b5d-83da-3712770265b8", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 50 + }, + "scale": "ordinal", + "sourceField": "tls.insecure_ciphers" + } + }, + "incompleteColumns": {}, + "indexPatternId": "0e56225a-3b03-4f4e-bdbc-2fd59f0ef78c", + "sampling": 1 + } + } + }, + "indexpattern": { + "currentIndexPatternId": "7eee23b7-ddb2-4c12-ad44-a12d7e8301cf", + "layers": {} + }, + "textBased": { + "indexPatternRefs": [ + { + "id": "7eee23b7-ddb2-4c12-ad44-a12d7e8301cf", + "timeField": "@timestamp", + "title": "tychon-pqc-inventory*" + } + ], + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "fccc8673-7024-4075-bd07-b717a834dfbf", + "isTransposed": false + }, + { + "columnId": "76043fbd-8e84-4b5d-83da-3712770265b8", + "isTransposed": false + } + ], + "layerId": "bd94c8fb-80f3-4090-b11f-5c3c6b7ce3b1", + "layerType": "data" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": { + "dynamicActions": { + "events": [ + { + "action": { + "config": { + "openInNewTab": false, + "useCurrentDateRange": true, + "useCurrentFilters": true + }, + "factoryId": "DASHBOARD_TO_DASHBOARD_DRILLDOWN", + "name": "Open Application Report" + }, + "eventId": "08ff1cd0-f8eb-53f9-9be5-24cff120f036", + "triggers": [ + "FILTER_TRIGGER" + ] + } + ] + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" + }, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false + }, + "gridData": { + "h": 18, + "i": "511cf538-0abc-44f0-a54c-3ccc2a58ba7f", + "w": 16, + "x": 16, + "y": 44 + }, + "panelIndex": "511cf538-0abc-44f0-a54c-3ccc2a58ba7f", + "title": "Supported Insecure Ciphers", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "0e56225a-3b03-4f4e-bdbc-2fd59f0ef78c", + "name": "indexpattern-datasource-layer-bd94c8fb-80f3-4090-b11f-5c3c6b7ce3b1", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "currentIndexPatternId": "0e56225a-3b03-4f4e-bdbc-2fd59f0ef78c", + "layers": { + "bd94c8fb-80f3-4090-b11f-5c3c6b7ce3b1": { + "columnOrder": [ + "fccc8673-7024-4075-bd07-b717a834dfbf", + "76043fbd-8e84-4b5d-83da-3712770265b8" + ], + "columns": { + "76043fbd-8e84-4b5d-83da-3712770265b8": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count of records ", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + }, + "fccc8673-7024-4075-bd07-b717a834dfbf": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Supported Ciphers", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "76043fbd-8e84-4b5d-83da-3712770265b8", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": true, + "parentFormat": { + "id": "terms" + }, + "size": 50 + }, + "scale": "ordinal", + "sourceField": "tls.supported_ciphers" + } + }, + "incompleteColumns": {}, + "indexPatternId": "0e56225a-3b03-4f4e-bdbc-2fd59f0ef78c", + "sampling": 1 + } + } + }, + "indexpattern": { + "currentIndexPatternId": "7eee23b7-ddb2-4c12-ad44-a12d7e8301cf", + "layers": {} + }, + "textBased": { + "indexPatternRefs": [ + { + "id": "7eee23b7-ddb2-4c12-ad44-a12d7e8301cf", + "timeField": "@timestamp", + "title": "tychon-pqc-inventory*" + } + ], + "layers": {} + } + }, + "filters": [], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "fccc8673-7024-4075-bd07-b717a834dfbf", + "isTransposed": false + }, + { + "columnId": "76043fbd-8e84-4b5d-83da-3712770265b8", + "isTransposed": false + } + ], + "layerId": "bd94c8fb-80f3-4090-b11f-5c3c6b7ce3b1", + "layerType": "data" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": { + "dynamicActions": { + "events": [] + } + }, + "filters": [], + "query": { + "language": "kuery", + "query": "" + }, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false + }, + "gridData": { + "h": 18, + "i": "fe8e72b0-98d0-4252-bec5-c56732ed1f12", + "w": 16, + "x": 32, + "y": 44 + }, + "panelIndex": "fe8e72b0-98d0-4252-bec5-c56732ed1f12", + "type": "lens" + } + ], + "timeRestore": false, + "title": "[TYCHON Quantum Command] Application Detail", + "version": 3 + }, + "coreMigrationVersion": "8.8.0", + "created_at": "2026-07-20T16:55:14.701Z", + "id": "tychon_quantum_command-6dfff015-3cc9-48b6-9410-7d8c01ff0d9a-application-detail", + "references": [ + { + "id": "tychon_quantum_command-443e5928-b1c4-4e07-b0b9-c675dd057e2f-application-report", + "name": "511cf538-0abc-44f0-a54c-3ccc2a58ba7f:drilldown:DASHBOARD_TO_DASHBOARD_DRILLDOWN:08ff1cd0-f8eb-53f9-9be5-24cff120f036:dashboardId", + "type": "dashboard" + }, + { + "id": "tychon_quantum_command-443e5928-b1c4-4e07-b0b9-c675dd057e2f-application-report", + "name": "686a9532-a314-4685-b25c-7de7c957f361:drilldown:DASHBOARD_TO_DASHBOARD_DRILLDOWN:a8bb1dca-9e7f-55bc-b777-050d845c3d7a:dashboardId", + "type": "dashboard" + }, + { + "id": "tychon_quantum_command-6f3d60d5-b5fb-45a5-9298-acf3ceb3ea1b-application-connections-topology", + "name": "716deebb-7717-49ad-b463-7f8880f050bf:drilldown:DASHBOARD_TO_DASHBOARD_DRILLDOWN:b5e53a68-24f0-5385-8498-35d2b3d898cc:dashboardId", + "type": "dashboard" + }, + { + "id": "tychon_quantum_command-6f3d60d5-b5fb-45a5-9298-acf3ceb3ea1b-application-connections-topology", + "name": "c35ba11c-8005-4653-b5c4-0e658b426ef9:drilldown:DASHBOARD_TO_DASHBOARD_DRILLDOWN:0b95bb86-15cd-5498-b469-92e6120e762b:dashboardId", + "type": "dashboard" + }, + { + "id": "852a2806-9a09-4c17-bcea-b54e7b69f3bc", + "name": "0f84ffed-4e62-4c1c-bedc-be51e098a775:indexpattern-datasource-layer-341cf49e-257b-48f0-af62-9d0ae3420573", + "type": "index-pattern" + }, + { + "id": "05179988-8b3d-4f26-9832-d83a1e769b2d", + "name": "511cf538-0abc-44f0-a54c-3ccc2a58ba7f:indexpattern-datasource-layer-bd94c8fb-80f3-4090-b11f-5c3c6b7ce3b1", + "type": "index-pattern" + }, + { + "id": "852a2806-9a09-4c17-bcea-b54e7b69f3bc", + "name": "541e6258-f438-4fd0-b039-adcdc944bb8a:indexpattern-datasource-layer-341cf49e-257b-48f0-af62-9d0ae3420573", + "type": "index-pattern" + }, + { + "id": "05179988-8b3d-4f26-9832-d83a1e769b2d", + "name": "5b71a4a3-dde9-4d62-9791-475787c052df:indexpattern-datasource-layer-a3b23fce-41b6-41ac-bf8c-8434eafb70cd", + "type": "index-pattern" + }, + { + "id": "05179988-8b3d-4f26-9832-d83a1e769b2d", + "name": "686a9532-a314-4685-b25c-7de7c957f361:indexpattern-datasource-layer-bd94c8fb-80f3-4090-b11f-5c3c6b7ce3b1", + "type": "index-pattern" + }, + { + "id": "05179988-8b3d-4f26-9832-d83a1e769b2d", + "name": "716deebb-7717-49ad-b463-7f8880f050bf:indexpattern-datasource-layer-a3b23fce-41b6-41ac-bf8c-8434eafb70cd", + "type": "index-pattern" + }, + { + "id": "05179988-8b3d-4f26-9832-d83a1e769b2d", + "name": "c35ba11c-8005-4653-b5c4-0e658b426ef9:indexpattern-datasource-layer-978e2a9e-6e77-4b60-a432-ebb35f2ad6c1", + "type": "index-pattern" + }, + { + "id": "852a2806-9a09-4c17-bcea-b54e7b69f3bc", + "name": "fb740713-8d4d-4114-8816-739a35cf7b68:indexpattern-datasource-layer-efd1c1c6-66da-400d-b474-d14414080249", + "type": "index-pattern" + }, + { + "id": "05179988-8b3d-4f26-9832-d83a1e769b2d", + "name": "fe8e72b0-98d0-4252-bec5-c56732ed1f12:indexpattern-datasource-layer-bd94c8fb-80f3-4090-b11f-5c3c6b7ce3b1", + "type": "index-pattern" + }, + { + "id": "tychon_quantum_command-e9b715ba-5f19-4f99-b837-2c1a24143212", + "name": "tag-ref-tychon_quantum_command-e9b715ba-5f19-4f99-b837-2c1a24143212", + "type": "tag" + }, + { + "id": "tychon_quantum_command-07b6a21f-5bba-413b-8d49-e8c246dde2ba", + "name": "tag-ref-tychon_quantum_command-07b6a21f-5bba-413b-8d49-e8c246dde2ba", + "type": "tag" + }, + { + "id": "tychon_quantum_command-dacb217e-57b4-4296-8545-cbf6b5739344", + "name": "tag-ref-tychon_quantum_command-dacb217e-57b4-4296-8545-cbf6b5739344", + "type": "tag" + } + ], + "type": "dashboard", + "typeMigrationVersion": "10.3.0" +} diff --git a/packages/tychon_quantum_command/kibana/dashboard/tychon_quantum_command-6f3d60d5-b5fb-45a5-9298-acf3ceb3ea1b-application-connections-topology.json b/packages/tychon_quantum_command/kibana/dashboard/tychon_quantum_command-6f3d60d5-b5fb-45a5-9298-acf3ceb3ea1b-application-connections-topology.json new file mode 100644 index 00000000000..8367d66a43d --- /dev/null +++ b/packages/tychon_quantum_command/kibana/dashboard/tychon_quantum_command-6f3d60d5-b5fb-45a5-9298-acf3ceb3ea1b-application-connections-topology.json @@ -0,0 +1,386 @@ +{ + "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": { + "ignoreFilters": false, + "ignoreQuery": false, + "ignoreTimerange": false, + "ignoreValidations": false + }, + "panelsJSON": {}, + "showApplySelections": false + }, + "description": "Aligns to schema 2.0.3", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "useMargins": true + }, + "panelsJSON": [ + { + "embeddableConfig": { + "enhancements": {}, + "hidePanelTitles": true, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "id": "", + "params": { + "fontSize": 12, + "markdown": "[Inventory](/app/dashboards#/view/tychon_quantum_command-32c01eb5-0d80-4a28-9de7-55b2046f7c45-inventory) | [Application Report](/app/dashboards#/view/tychon_quantum_command-443e5928-b1c4-4e07-b0b9-c675dd057e2f-application-report) | [Application Detail](/app/dashboards#/view/tychon_quantum_command-6dfff015-3cc9-48b6-9410-7d8c01ff0d9a-application-detail) | [Certificate Report](/app/dashboards#/view/tychon_quantum_command-d0159137-9139-4a93-85bb-2ac9ddab3982-certificate-operations-dashboard) | Application Connections Topology | [Cost Analysis](/app/dashboards#/view/tychon_quantum_command-02366033-dee4-4ea4-8458-7c8a8b58987e-cost-analysis)", + "openLinksInNewTab": false + }, + "title": "", + "type": "markdown", + "uiState": {} + } + }, + "gridData": { + "h": 3, + "i": "tychon-quantum-command-nav", + "w": 48, + "x": 0, + "y": 0 + }, + "panelIndex": "tychon-quantum-command-nav", + "title": "", + "type": "visualization" + }, + { + "embeddableConfig": { + "description": "", + "enhancements": { + "dynamicActions": { + "events": [ + { + "action": { + "config": { + "openInNewTab": false, + "useCurrentDateRange": true, + "useCurrentFilters": true + }, + "factoryId": "DASHBOARD_TO_DASHBOARD_DRILLDOWN", + "name": "Open Application Detail" + }, + "eventId": "754afa08-289f-5a39-bc46-04d2b9e6e76a", + "triggers": [ + "FILTER_TRIGGER" + ] + } + ] + } + }, + "hidePanelTitles": true, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "id": "", + "params": { + "spec": "{\"$schema\": \"https://vega.github.io/schema/vega/v5.json\", \"description\": \"Application filter list panel (multi-select) with dashboard filter integration.\", \"autosize\": \"fit\", \"padding\": 10, \"background\": \"#000000\", \"signals\": [{\"name\": \"selectedApps\", \"value\": \"|\", \"on\": [{\"events\": \"@appRowBg:click\", \"update\": \"indexof(selectedApps, '|' + datum.app + '|') >= 0 ? replace(selectedApps, '|' + datum.app + '|', '|') : selectedApps + datum.app + '|'\"}]}, {\"name\": \"selectedAppsArray\", \"update\": \"selectedApps == '|' ? [] : split(slice(selectedApps, 1, length(selectedApps)-1), '|')\"}, {\"name\": \"activeFilter\", \"update\": \"length(selectedAppsArray) > 0 ? {'bool': {'filter': [{'term': {'event.dataset': 'tychon.application'}}, {'terms': {'tychon.application.name': selectedAppsArray}}]}} : {'term': {'event.dataset': 'tychon.application'}}\"}, {\"name\": \"_applyAppFilter\", \"value\": 0, \"on\": [{\"events\": \"@applyBtn:click\", \"update\": \"kibanaAddFilter(activeFilter)\", \"force\": true}]}], \"data\": [{\"name\": \"apps\", \"url\": {\"%context%\": true, \"%timefield%\": \"@timestamp\", \"index\": \"tychon-pqc-applications\", \"body\": {\"size\": 0, \"aggs\": {\"app_only\": {\"filter\": {\"term\": {\"event.dataset\": \"tychon.application\"}}, \"aggs\": {\"app_names\": {\"terms\": {\"field\": \"tychon.application.name\", \"size\": 200, \"order\": {\"_count\": \"desc\"}}}}}}}}, \"format\": {\"property\": \"aggregations.app_only.app_names.buckets\"}, \"transform\": [{\"type\": \"formula\", \"as\": \"app\", \"expr\": \"datum.key\"}, {\"type\": \"formula\", \"as\": \"count\", \"expr\": \"datum.doc_count\"}, {\"type\": \"window\", \"ops\": [\"row_number\"], \"as\": [\"rn\"]}, {\"type\": \"formula\", \"as\": \"y\", \"expr\": \"72 + (datum.rn - 1) * 26\"}, {\"type\": \"filter\", \"expr\": \"datum.rn <= 15\"}]}], \"marks\": [{\"type\": \"rect\", \"encode\": {\"update\": {\"x\": {\"value\": 10}, \"y\": {\"value\": 10}, \"x2\": {\"signal\": \"width - 10\"}, \"y2\": {\"signal\": \"height - 10\"}, \"fill\": {\"value\": \"#0f1115\"}, \"fillOpacity\": {\"value\": 0.96}, \"stroke\": {\"value\": \"#2b3440\"}, \"strokeWidth\": {\"value\": 1.2}, \"cornerRadius\": {\"value\": 8}}}}, {\"type\": \"rect\", \"encode\": {\"update\": {\"x\": {\"value\": 10}, \"y\": {\"value\": 10}, \"x2\": {\"signal\": \"width - 10\"}, \"y2\": {\"value\": 42}, \"fill\": {\"value\": \"#17324a\"}, \"fillOpacity\": {\"value\": 0.92}, \"cornerRadiusTopLeft\": {\"value\": 8}, \"cornerRadiusTopRight\": {\"value\": 8}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"value\": 24}, \"y\": {\"value\": 30}, \"text\": {\"value\": \"APPLICATION FILTER\"}, \"font\": {\"value\": \"monospace\"}, \"fontSize\": {\"value\": 12}, \"fontWeight\": {\"value\": \"bold\"}, \"fill\": {\"value\": \"#e8f3ff\"}, \"baseline\": {\"value\": \"middle\"}}}}, {\"type\": \"rect\", \"name\": \"applyBtn\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width - 92\"}, \"y\": {\"value\": 16}, \"width\": {\"value\": 76}, \"height\": {\"value\": 20}, \"cornerRadius\": {\"value\": 10}, \"fill\": {\"value\": \"#17324a\"}, \"stroke\": {\"value\": \"#9fd7ff\"}, \"strokeWidth\": {\"value\": 1}, \"cursor\": {\"value\": \"pointer\"}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width - 54\"}, \"y\": {\"value\": 26}, \"text\": {\"value\": \"APPLY\"}, \"font\": {\"value\": \"monospace\"}, \"fontSize\": {\"value\": 10}, \"fontWeight\": {\"value\": \"bold\"}, \"fill\": {\"value\": \"#dff0ff\"}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}}}}, {\"type\": \"rect\", \"from\": {\"data\": \"apps\"}, \"name\": \"appRowBg\", \"encode\": {\"update\": {\"x\": {\"value\": 18}, \"y\": {\"signal\": \"datum.y - 10\"}, \"x2\": {\"signal\": \"width - 18\"}, \"y2\": {\"signal\": \"datum.y + 10\"}, \"cornerRadius\": {\"value\": 6}, \"fill\": {\"signal\": \"indexof(selectedApps, '|' + datum.app + '|') >= 0 ? '#1f4d74' : '#0f1115'\"}, \"stroke\": {\"signal\": \"indexof(selectedApps, '|' + datum.app + '|') >= 0 ? '#9fd7ff' : '#253241'\"}, \"strokeWidth\": {\"value\": 1}, \"cursor\": {\"value\": \"pointer\"}}}}, {\"type\": \"text\", \"from\": {\"data\": \"apps\"}, \"encode\": {\"update\": {\"x\": {\"value\": 30}, \"y\": {\"field\": \"y\"}, \"text\": {\"field\": \"app\"}, \"font\": {\"value\": \"monospace\"}, \"fontSize\": {\"value\": 10}, \"fill\": {\"signal\": \"indexof(selectedApps, '|' + datum.app + '|') >= 0 ? '#e8f3ff' : '#c9d7e5'\"}, \"baseline\": {\"value\": \"middle\"}, \"limit\": {\"signal\": \"width - 110\"}}}}, {\"type\": \"text\", \"from\": {\"data\": \"apps\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width - 30\"}, \"y\": {\"field\": \"y\"}, \"text\": {\"signal\": \"format(datum.count, ',')\"}, \"font\": {\"value\": \"monospace\"}, \"fontSize\": {\"value\": 10}, \"fill\": {\"signal\": \"indexof(selectedApps, '|' + datum.app + '|') >= 0 ? '#d9eeff' : '#8ea3b8'\"}, \"align\": {\"value\": \"right\"}, \"baseline\": {\"value\": \"middle\"}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width / 2\"}, \"y\": {\"signal\": \"height / 2 - 8\"}, \"text\": {\"signal\": \"length(data('apps')) === 0 ? 'NO DATA FOR CURRENT FILTERS / TIME RANGE' : ''\"}, \"fill\": {\"value\": \"#666666\"}, \"font\": {\"value\": \"monospace\"}, \"fontSize\": {\"value\": 11}, \"fontWeight\": {\"value\": \"bold\"}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"zindex\": {\"value\": 100}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width / 2\"}, \"y\": {\"signal\": \"height / 2 + 12\"}, \"text\": {\"signal\": \"length(data('apps')) === 0 ? 'Adjust dashboard filters or expand the selected time range.' : ''\"}, \"fill\": {\"value\": \"#444444\"}, \"font\": {\"value\": \"monospace\"}, \"fontSize\": {\"value\": 9}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"zindex\": {\"value\": 100}}}}]}" + }, + "title": "QuantumApplicationList", + "type": "vega", + "uiState": {} + } + }, + "gridData": { + "h": 19, + "i": "5de2ae04-5993-4e9b-9c32-674ec15c23cb", + "w": 8, + "x": 0, + "y": 2 + }, + "panelIndex": "5de2ae04-5993-4e9b-9c32-674ec15c23cb", + "title": "QuantumApplicationList", + "type": "visualization" + }, + { + "embeddableConfig": { + "description": "", + "enhancements": { + "dynamicActions": { + "events": [] + } + }, + "hidePanelTitles": true, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "id": "", + "params": { + "spec": "{\"$schema\": \"https://vega.github.io/schema/vega/v5.json\", \"autosize\": \"fit\", \"padding\": 8, \"background\": \"#000000\", \"signals\": [{\"name\": \"zoom\", \"value\": 0.55, \"on\": [{\"events\": {\"type\": \"wheel\"}, \"update\": \"clamp(zoom * pow(1.0015, -event.deltaY), 0.55, 2.6)\"}]}, {\"name\": \"panX\", \"value\": 0, \"on\": [{\"events\": {\"type\": \"wheel\"}, \"update\": \"((panX - (width/2)) * (clamp(zoom * pow(1.0015, -event.deltaY), 0.55, 2.6) / zoom)) + (width/2)\"}, {\"events\": {\"source\": \"window\", \"type\": \"mousemove\", \"between\": [{\"source\": \"view\", \"type\": \"mousedown\"}, {\"source\": \"window\", \"type\": \"mouseup\"}]}, \"update\": \"panX + event.movementX\"}]}, {\"name\": \"panY\", \"value\": 0, \"on\": [{\"events\": {\"type\": \"wheel\"}, \"update\": \"((panY - (height/2)) * (clamp(zoom * pow(1.0015, -event.deltaY), 0.55, 2.6) / zoom)) + (height/2)\"}, {\"events\": {\"source\": \"window\", \"type\": \"mousemove\", \"between\": [{\"source\": \"view\", \"type\": \"mousedown\"}, {\"source\": \"window\", \"type\": \"mouseup\"}]}, \"update\": \"panY + event.movementY\"}]}, {\"name\": \"selectedNode\", \"value\": null, \"on\": [{\"events\": \"@nodeMark:click\", \"update\": \"datum && isValid(datum.id) ? (selectedNode && selectedNode.id===datum.id ? null : datum) : selectedNode\"}]}, {\"name\": \"_applyNodeFilter\", \"value\": 0, \"on\": [{\"events\": \"@nodeMark:dblclick\", \"update\": \"datum && isValid(datum.id) ? kibanaAddFilter((datum.nodeType === 'application' ? {'bool': {'filter': [{'term': {'event.dataset': 'tychon.application'}}, {'term': {'tychon.application.name': toString(datum.id)}}]}} : {'bool': {'filter': [{'term': {'event.dataset': 'tychon.application'}}, {'term': {'host.hostname': toString(datum.id)}}]}})) : 0\", \"force\": true}]}, {\"name\": \"adjPeerIds\", \"update\": \"isArray(data('adjacency')) ? pluck(data('adjacency'), 'peer') : []\"}, {\"name\": \"adjPeer2Ids\", \"update\": \"isArray(data('adjacency2')) ? pluck(data('adjacency2'), 'peer') : []\"}, {\"name\": \"highlightNodeIdsCsv\", \"update\": \"selectedNode ? (',' + toString(selectedNode.id) + ',' + join(adjPeerIds, ',') + ',' + join(adjPeer2Ids, ',') + ',') : ''\"}, {\"name\": \"autoPanX\", \"update\": \"length(data('layout_center')) > 0 && isFinite(data('layout_center')[0].cx) ? (width * 0.5) - (data('layout_center')[0].cx * zoom) : (width * (1 - zoom) * 0.5)\"}, {\"name\": \"autoPanY\", \"update\": \"length(data('layout_center')) > 0 && isFinite(data('layout_center')[0].cy) ? (height * 0.52) - (data('layout_center')[0].cy * zoom) : (height * (1 - zoom) * 0.5)\"}, {\"name\": \"rawBucketLimitReached\", \"update\": \"length(data('raw')) >= 500\"}], \"data\": [{\"name\": \"raw\", \"url\": {\"%context%\": true, \"%timefield%\": \"@timestamp\", \"index\": \"tychon-pqc-applications\", \"body\": {\"size\": 0, \"aggs\": {\"pairs\": {\"filter\": {\"bool\": {\"must\": [{\"exists\": {\"field\": \"host.hostname\"}}, {\"exists\": {\"field\": \"tychon.application.name\"}}, {\"term\": {\"event.dataset\": \"tychon.application\"}}]}}, \"aggs\": {\"links\": {\"composite\": {\"size\": 500, \"sources\": [{\"src\": {\"terms\": {\"field\": \"host.hostname\"}}}, {\"dst\": {\"terms\": {\"field\": \"tychon.application.name\"}}}]}}}}}}}, \"format\": {\"property\": \"aggregations.pairs.links.buckets\"}, \"transform\": [{\"type\": \"formula\", \"as\": \"source\", \"expr\": \"datum.key.src\"}, {\"type\": \"formula\", \"as\": \"target\", \"expr\": \"datum.key.dst\"}, {\"type\": \"formula\", \"as\": \"count\", \"expr\": \"toNumber(datum.doc_count)\"}, {\"type\": \"filter\", \"expr\": \"isValid(datum.source) && isValid(datum.target) && datum.source!='' && datum.target!=''\"}]}, {\"name\": \"nodes\", \"source\": \"raw\", \"transform\": [{\"type\": \"fold\", \"fields\": [\"source\", \"target\"], \"as\": [\"side\", \"id\"]}, {\"type\": \"aggregate\", \"groupby\": [\"id\", \"side\"], \"fields\": [\"count\"], \"ops\": [\"sum\"], \"as\": [\"traffic\"]}, {\"type\": \"formula\", \"as\": \"nodeType\", \"expr\": \"datum.side==='source' ? 'host' : 'application'\"}]}, {\"name\": \"edges\", \"source\": \"raw\", \"transform\": [{\"type\": \"formula\", \"as\": \"source\", \"expr\": \"toString(datum.source)\"}, {\"type\": \"formula\", \"as\": \"target\", \"expr\": \"toString(datum.target)\"}, {\"type\": \"formula\", \"as\": \"count\", \"expr\": \"toNumber(datum.count)\"}, {\"type\": \"filter\", \"expr\": \"datum.source != '' && datum.target != ''\"}]}, {\"name\": \"layout\", \"source\": \"nodes\", \"transform\": [{\"type\": \"force\", \"iterations\": 300, \"static\": true, \"forces\": [{\"force\": \"center\", \"x\": {\"signal\": \"width * 0.5\"}, \"y\": {\"signal\": \"height * 0.52\"}}, {\"force\": \"collide\", \"radius\": 20}, {\"force\": \"nbody\", \"strength\": -180}, {\"force\": \"link\", \"links\": \"edges\", \"id\": \"id\", \"distance\": 130}]}]}, {\"name\": \"layout_center\", \"source\": \"layout\", \"transform\": [{\"type\": \"aggregate\", \"ops\": [\"median\", \"median\"], \"fields\": [\"x\", \"y\"], \"as\": [\"cx\", \"cy\"]}, {\"type\": \"formula\", \"as\": \"cx\", \"expr\": \"isFinite(datum.cx) ? datum.cx : 0\"}, {\"type\": \"formula\", \"as\": \"cy\", \"expr\": \"isFinite(datum.cy) ? datum.cy : 0\"}]}, {\"name\": \"edges_draw\", \"source\": \"edges\", \"transform\": [{\"type\": \"formula\", \"as\": \"srcId\", \"expr\": \"isValid(datum.source) && isValid(datum.source.id) ? toString(datum.source.id) : toString(datum.source)\"}, {\"type\": \"formula\", \"as\": \"dstId\", \"expr\": \"isValid(datum.target) && isValid(datum.target.id) ? toString(datum.target.id) : toString(datum.target)\"}, {\"type\": \"formula\", \"as\": \"sx\", \"expr\": \"isValid(datum.source) && isValid(datum.source.x) ? datum.source.x * zoom + autoPanX + panX : null\"}, {\"type\": \"formula\", \"as\": \"sy\", \"expr\": \"isValid(datum.source) && isValid(datum.source.y) ? datum.source.y * zoom + autoPanY + panY : null\"}, {\"type\": \"formula\", \"as\": \"tx\", \"expr\": \"isValid(datum.target) && isValid(datum.target.x) ? datum.target.x * zoom + autoPanX + panX : null\"}, {\"type\": \"formula\", \"as\": \"ty\", \"expr\": \"isValid(datum.target) && isValid(datum.target.y) ? datum.target.y * zoom + autoPanY + panY : null\"}, {\"type\": \"filter\", \"expr\": \"isValid(datum.sx) && isValid(datum.sy) && isValid(datum.tx) && isValid(datum.ty)\"}]}, {\"name\": \"adjacency\", \"source\": \"edges\", \"transform\": [{\"type\": \"formula\", \"as\": \"srcId\", \"expr\": \"isValid(datum.source) && isValid(datum.source.id) ? toString(datum.source.id) : toString(datum.source)\"}, {\"type\": \"formula\", \"as\": \"dstId\", \"expr\": \"isValid(datum.target) && isValid(datum.target.id) ? toString(datum.target.id) : toString(datum.target)\"}, {\"type\": \"filter\", \"expr\": \"selectedNode && (datum.srcId===toString(selectedNode.id) || datum.dstId===toString(selectedNode.id))\"}, {\"type\": \"fold\", \"fields\": [\"srcId\", \"dstId\"], \"as\": [\"side\", \"peer\"]}, {\"type\": \"filter\", \"expr\": \"datum.peer !== toString(selectedNode.id)\"}, {\"type\": \"aggregate\", \"groupby\": [\"peer\"], \"fields\": [\"count\"], \"ops\": [\"sum\"], \"as\": [\"traffic\"]}]}, {\"name\": \"adjacency2\", \"source\": \"edges\", \"transform\": [{\"type\": \"formula\", \"as\": \"srcId\", \"expr\": \"isValid(datum.source) && isValid(datum.source.id) ? toString(datum.source.id) : toString(datum.source)\"}, {\"type\": \"formula\", \"as\": \"dstId\", \"expr\": \"isValid(datum.target) && isValid(datum.target.id) ? toString(datum.target.id) : toString(datum.target)\"}, {\"type\": \"filter\", \"expr\": \"selectedNode && (indexof(adjPeerIds, datum.srcId) >= 0 || indexof(adjPeerIds, datum.dstId) >= 0)\"}, {\"type\": \"fold\", \"fields\": [\"srcId\", \"dstId\"], \"as\": [\"side\", \"peer\"]}, {\"type\": \"filter\", \"expr\": \"datum.peer !== toString(selectedNode.id) && indexof(adjPeerIds, datum.peer) < 0\"}, {\"type\": \"aggregate\", \"groupby\": [\"peer\"], \"fields\": [\"count\"], \"ops\": [\"sum\"], \"as\": [\"traffic\"]}]}], \"marks\": [{\"type\": \"rect\", \"encode\": {\"enter\": {\"x\": {\"value\": 0}, \"y\": {\"value\": 0}, \"x2\": {\"signal\": \"width\"}, \"y2\": {\"signal\": \"height\"}, \"fill\": {\"value\": \"#000000\"}}}}, {\"type\": \"rule\", \"from\": {\"data\": \"edges_draw\"}, \"encode\": {\"update\": {\"x\": {\"field\": \"sx\"}, \"y\": {\"field\": \"sy\"}, \"x2\": {\"field\": \"tx\"}, \"y2\": {\"field\": \"ty\"}, \"stroke\": {\"signal\": \"!selectedNode ? '#4fc3f7' : ((indexof(highlightNodeIdsCsv, ',' + datum.srcId + ',') >= 0 && indexof(highlightNodeIdsCsv, ',' + datum.dstId + ',') >= 0) ? '#7fe8ff' : '#213240')\"}, \"strokeOpacity\": {\"signal\": \"!selectedNode ? 0.42 : ((indexof(highlightNodeIdsCsv, ',' + datum.srcId + ',') >= 0 && indexof(highlightNodeIdsCsv, ',' + datum.dstId + ',') >= 0) ? 0.75 : 0.08)\"}, \"strokeWidth\": {\"value\": 0.9}}}}, {\"type\": \"symbol\", \"from\": {\"data\": \"layout\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"datum.x * zoom + autoPanX + panX\"}, \"y\": {\"signal\": \"datum.y * zoom + autoPanY + panY\"}, \"size\": {\"value\": 980}, \"fill\": {\"signal\": \"datum.nodeType==='application' ? '#3b2b1a' : '#1a2c3b'\"}, \"fillOpacity\": {\"value\": 0.9}, \"stroke\": {\"signal\": \"datum.nodeType==='application' ? '#ffd7a2' : '#a9dbff'\"}, \"strokeWidth\": {\"value\": 1.2}, \"opacity\": {\"signal\": \"!selectedNode ? 1 : (indexof(highlightNodeIdsCsv, ',' + toString(datum.id) + ',') >= 0 ? 1 : 0.2)\"}}}}, {\"type\": \"symbol\", \"name\": \"nodeMark\", \"from\": {\"data\": \"layout\"}, \"encode\": {\"enter\": {\"size\": {\"value\": 980}, \"fill\": {\"value\": \"#000000\"}, \"fillOpacity\": {\"value\": 0.001}, \"stroke\": {\"value\": \"#000000\"}, \"strokeOpacity\": {\"value\": 0.001}, \"cursor\": {\"value\": \"pointer\"}}, \"update\": {\"x\": {\"signal\": \"datum.x * zoom + autoPanX + panX\"}, \"y\": {\"signal\": \"datum.y * zoom + autoPanY + panY\"}, \"size\": {\"value\": 980}}}}, {\"type\": \"text\", \"from\": {\"data\": \"layout\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"datum.x * zoom + autoPanX + panX\"}, \"y\": {\"signal\": \"datum.y * zoom + autoPanY + panY - 14\"}, \"text\": {\"field\": \"id\"}, \"fill\": {\"signal\": \"!selectedNode ? '#e0e0e0' : (indexof(highlightNodeIdsCsv, ',' + toString(datum.id) + ',') >= 0 ? '#f2f7ff' : '#4f5f6f')\"}, \"font\": {\"value\": \"monospace\"}, \"fontSize\": {\"value\": 9}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"bottom\"}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width / 2\"}, \"y\": {\"signal\": \"height / 2 - 8\"}, \"text\": {\"signal\": \"length(data('raw')) === 0 ? 'NO DATA FOR CURRENT FILTERS / TIME RANGE' : ''\"}, \"fill\": {\"value\": \"#666666\"}, \"font\": {\"value\": \"monospace\"}, \"fontSize\": {\"value\": 11}, \"fontWeight\": {\"value\": \"bold\"}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"zindex\": {\"value\": 100}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width / 2\"}, \"y\": {\"signal\": \"height / 2 + 12\"}, \"text\": {\"signal\": \"length(data('raw')) === 0 ? 'Adjust dashboard filters or expand the selected time range.' : ''\"}, \"fill\": {\"value\": \"#444444\"}, \"font\": {\"value\": \"monospace\"}, \"fontSize\": {\"value\": 9}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"zindex\": {\"value\": 100}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width - 12\"}, \"y\": {\"value\": 14}, \"text\": {\"signal\": \"rawBucketLimitReached ? 'Topology may be truncated at 500 relationships; add pagination to show the complete graph.' : ''\"}, \"fill\": {\"value\": \"#fbbf24\"}, \"font\": {\"value\": \"monospace\"}, \"fontSize\": {\"value\": 9}, \"align\": {\"value\": \"right\"}, \"baseline\": {\"value\": \"top\"}, \"zindex\": {\"value\": 100}}}}]}" + }, + "title": "PQC Connections Topology", + "type": "vega", + "uiState": {} + } + }, + "gridData": { + "h": 36, + "i": "b07160f8-34a0-4c9c-b8e0-40c7841c9f86", + "w": 30, + "x": 8, + "y": 2 + }, + "panelIndex": "b07160f8-34a0-4c9c-b8e0-40c7841c9f86", + "title": "PQC Connections Topology", + "type": "visualization" + }, + { + "embeddableConfig": { + "description": "", + "enhancements": { + "dynamicActions": { + "events": [ + { + "action": { + "config": { + "openInNewTab": false, + "useCurrentDateRange": true, + "useCurrentFilters": true + }, + "factoryId": "DASHBOARD_TO_DASHBOARD_DRILLDOWN", + "name": "Open Application Detail" + }, + "eventId": "28bdb45d-bec5-5991-b0c4-e7c31df068c4", + "triggers": [ + "FILTER_TRIGGER" + ] + } + ] + } + }, + "hidePanelTitles": true, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "id": "", + "params": { + "spec": "{\"$schema\": \"https://vega.github.io/schema/vega/v5.json\", \"description\": \"Selection details panel for host/application context using dashboard filters.\", \"autosize\": \"fit\", \"padding\": 10, \"background\": \"#000000\", \"signals\": [{\"name\": \"panelW\", \"update\": \"width - 20\"}, {\"name\": \"labelX\", \"value\": 26}, {\"name\": \"valueX\", \"update\": \"width * 0.42\"}, {\"name\": \"row0\", \"value\": 74}, {\"name\": \"rowH\", \"value\": 24}], \"data\": [{\"name\": \"context\", \"url\": {\"%context%\": true, \"%timefield%\": \"@timestamp\", \"index\": \"tychon-pqc*\", \"body\": {\"size\": 0, \"aggs\": {\"host\": {\"terms\": {\"field\": \"observer.hostname\", \"size\": 1}}, \"app\": {\"terms\": {\"field\": \"tychon.application.name.keyword\", \"size\": 1}}, \"dst\": {\"terms\": {\"field\": \"server.address\", \"size\": 1}}, \"proto\": {\"terms\": {\"field\": \"network.protocol\", \"size\": 1}}, \"tls_ver\": {\"terms\": {\"field\": \"tls.preferred_protocol\", \"size\": 1}}, \"cipher\": {\"terms\": {\"field\": \"tls.preferred_cipher\", \"size\": 1}}, \"events\": {\"value_count\": {\"field\": \"@timestamp\"}}, \"first_seen\": {\"min\": {\"field\": \"@timestamp\"}}, \"last_seen\": {\"max\": {\"field\": \"@timestamp\"}}}}}, \"format\": {\"property\": \"aggregations\"}, \"transform\": [{\"type\": \"formula\", \"as\": \"host\", \"expr\": \"datum.host && datum.host.buckets && length(datum.host.buckets)>0 ? datum.host.buckets[0].key : ''\"}, {\"type\": \"formula\", \"as\": \"app\", \"expr\": \"datum.app && datum.app.buckets && length(datum.app.buckets)>0 ? datum.app.buckets[0].key : ''\"}, {\"type\": \"formula\", \"as\": \"dst\", \"expr\": \"datum.dst && datum.dst.buckets && length(datum.dst.buckets)>0 ? datum.dst.buckets[0].key : ''\"}, {\"type\": \"formula\", \"as\": \"proto\", \"expr\": \"datum.proto && datum.proto.buckets && length(datum.proto.buckets)>0 ? datum.proto.buckets[0].key : ''\"}, {\"type\": \"formula\", \"as\": \"tlsVer\", \"expr\": \"datum.tls_ver && datum.tls_ver.buckets && length(datum.tls_ver.buckets)>0 ? datum.tls_ver.buckets[0].key : ''\"}, {\"type\": \"formula\", \"as\": \"cipher\", \"expr\": \"datum.cipher && datum.cipher.buckets && length(datum.cipher.buckets)>0 ? datum.cipher.buckets[0].key : ''\"}, {\"type\": \"formula\", \"as\": \"events\", \"expr\": \"datum.events ? datum.events.value : 0\"}, {\"type\": \"formula\", \"as\": \"firstSeen\", \"expr\": \"datum.first_seen && isValid(datum.first_seen.value_as_string) ? datum.first_seen.value_as_string : ''\"}, {\"type\": \"formula\", \"as\": \"lastSeen\", \"expr\": \"datum.last_seen && isValid(datum.last_seen.value_as_string) ? datum.last_seen.value_as_string : ''\"}, {\"type\": \"formula\", \"as\": \"selectionType\", \"expr\": \"datum.app != '' ? 'APPLICATION CONTEXT' : (datum.host != '' ? 'HOST CONTEXT' : 'NO SELECTION')\"}, {\"type\": \"formula\", \"as\": \"selectionId\", \"expr\": \"datum.app != '' ? datum.app : (datum.host != '' ? datum.host : 'Select a host/app in the graph')\"}]}, {\"name\": \"rows\", \"source\": \"context\", \"transform\": [{\"type\": \"project\", \"fields\": [\"selectionType\", \"selectionId\", \"host\", \"app\", \"dst\", \"proto\", \"tlsVer\", \"cipher\", \"events\", \"firstSeen\", \"lastSeen\"], \"as\": [\"selectionType\", \"selectionId\", \"host\", \"app\", \"dst\", \"proto\", \"tlsVer\", \"cipher\", \"events\", \"firstSeen\", \"lastSeen\"]}, {\"type\": \"formula\", \"as\": \"kv\", \"expr\": \"[{k:'Context',v:datum.selectionType},{k:'Selection',v:datum.selectionId},{k:'Source Host',v:datum.host},{k:'Application',v:datum.app},{k:'Destination',v:datum.dst},{k:'Protocol',v:datum.proto},{k:'TLS Version',v:datum.tlsVer},{k:'Cipher',v:datum.cipher},{k:'Event Count',v:format(datum.events, ',')},{k:'First Seen',v:datum.firstSeen},{k:'Last Seen',v:datum.lastSeen}]\"}, {\"type\": \"flatten\", \"fields\": [\"kv\"], \"as\": [\"row\"]}, {\"type\": \"window\", \"ops\": [\"row_number\"], \"as\": [\"rn\"]}, {\"type\": \"formula\", \"as\": \"y\", \"expr\": \"row0 + (datum.rn - 1) * rowH\"}]}], \"marks\": [{\"type\": \"rect\", \"encode\": {\"update\": {\"x\": {\"value\": 10}, \"y\": {\"value\": 10}, \"x2\": {\"signal\": \"width - 10\"}, \"y2\": {\"signal\": \"height - 10\"}, \"fill\": {\"value\": \"#0f1115\"}, \"fillOpacity\": {\"value\": 0.96}, \"stroke\": {\"value\": \"#2b3440\"}, \"strokeWidth\": {\"value\": 1.2}, \"cornerRadius\": {\"value\": 8}}}}, {\"type\": \"rect\", \"encode\": {\"update\": {\"x\": {\"value\": 10}, \"y\": {\"value\": 10}, \"x2\": {\"signal\": \"width - 10\"}, \"y2\": {\"value\": 42}, \"fill\": {\"value\": \"#17324a\"}, \"fillOpacity\": {\"value\": 0.92}, \"cornerRadiusTopLeft\": {\"value\": 8}, \"cornerRadiusTopRight\": {\"value\": 8}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"value\": 24}, \"y\": {\"value\": 30}, \"font\": {\"value\": \"monospace\"}, \"fontSize\": {\"value\": 12}, \"fontWeight\": {\"value\": \"bold\"}, \"fill\": {\"value\": \"#e8f3ff\"}, \"text\": {\"value\": \"SELECTION DETAILS\"}, \"baseline\": {\"value\": \"middle\"}}}}, {\"type\": \"rule\", \"encode\": {\"update\": {\"x\": {\"signal\": \"valueX - 10\"}, \"y\": {\"value\": 54}, \"y2\": {\"signal\": \"height - 20\"}, \"stroke\": {\"value\": \"#1f2a36\"}, \"strokeWidth\": {\"value\": 1}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"labelX\"}, \"y\": {\"field\": \"y\"}, \"text\": {\"signal\": \"datum.row.k\"}, \"font\": {\"value\": \"monospace\"}, \"fontSize\": {\"value\": 10}, \"fontWeight\": {\"value\": \"bold\"}, \"fill\": {\"value\": \"#9fc4e0\"}, \"baseline\": {\"value\": \"middle\"}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"valueX\"}, \"y\": {\"field\": \"y\"}, \"text\": {\"signal\": \"datum.row.v == '' ? '\\u2014' : datum.row.v\"}, \"font\": {\"value\": \"monospace\"}, \"fontSize\": {\"value\": 10}, \"fill\": {\"value\": \"#e8eef5\"}, \"baseline\": {\"value\": \"middle\"}, \"limit\": {\"signal\": \"width - valueX - 18\"}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width / 2\"}, \"y\": {\"signal\": \"height / 2 - 8\"}, \"text\": {\"signal\": \"length(data('context')) === 0 ? 'NO DATA FOR CURRENT FILTERS / TIME RANGE' : ''\"}, \"fill\": {\"value\": \"#666666\"}, \"font\": {\"value\": \"monospace\"}, \"fontSize\": {\"value\": 11}, \"fontWeight\": {\"value\": \"bold\"}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"zindex\": {\"value\": 100}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width / 2\"}, \"y\": {\"signal\": \"height / 2 + 12\"}, \"text\": {\"signal\": \"length(data('context')) === 0 ? 'Adjust dashboard filters or expand the selected time range.' : ''\"}, \"fill\": {\"value\": \"#444444\"}, \"font\": {\"value\": \"monospace\"}, \"fontSize\": {\"value\": 9}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"zindex\": {\"value\": 100}}}}]}" + }, + "title": "Connections Selection Details", + "type": "vega", + "uiState": {} + } + }, + "gridData": { + "h": 15, + "i": "903af92d-f9ab-4b97-8f31-4f46b66f7b49", + "w": 10, + "x": 38, + "y": 2 + }, + "panelIndex": "903af92d-f9ab-4b97-8f31-4f46b66f7b49", + "title": "Connections Selection Details", + "type": "visualization" + }, + { + "embeddableConfig": { + "description": "", + "enhancements": { + "dynamicActions": { + "events": [ + { + "action": { + "config": { + "openInNewTab": false, + "useCurrentDateRange": true, + "useCurrentFilters": true + }, + "factoryId": "DASHBOARD_TO_DASHBOARD_DRILLDOWN", + "name": "Open Application Report" + }, + "eventId": "9ee0be55-05bd-533b-b46b-ac541ed779ff", + "triggers": [ + "FILTER_TRIGGER" + ] + } + ] + } + }, + "hidePanelTitles": true, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "id": "", + "params": { + "spec": "{\"$schema\": \"https://vega.github.io/schema/vega/v5.json\", \"padding\": {\"top\": 0, \"bottom\": 0, \"left\": 0, \"right\": 0}, \"background\": \"#000000\", \"signals\": [{\"name\": \"totalApps\", \"update\": \"length(data('apps_total'))>0 ? data('apps_total')[0].n : 0\"}, {\"name\": \"kexReady\", \"update\": \"length(data('kex_pqc'))>0 ? data('kex_pqc')[0].n : 0\"}, {\"name\": \"kexPct\", \"update\": \"totalApps > 0 ? round(kexReady / totalApps * 100) : 0\"}, {\"name\": \"kexClr\", \"update\": \"kexPct>=90 ? '#00c853' : kexPct>=60 ? '#448aff' : kexPct>=30 ? '#ffa726' : '#ef5350'\"}, {\"name\": \"protoReady\", \"update\": \"length(data('proto_pqc'))>0 ? data('proto_pqc')[0].n : 0\"}, {\"name\": \"protoPct\", \"update\": \"totalApps > 0 ? round(protoReady / totalApps * 100) : 0\"}, {\"name\": \"protoClr\", \"update\": \"protoPct>=90 ? '#00c853' : protoPct>=60 ? '#448aff' : protoPct>=30 ? '#ffa726' : '#ef5350'\"}, {\"name\": \"sigReady\", \"update\": \"length(data('sig_pqc'))>0 ? data('sig_pqc')[0].n : 0\"}, {\"name\": \"sigPct\", \"update\": \"totalApps > 0 ? round(sigReady / totalApps * 100) : 0\"}, {\"name\": \"sigClr\", \"update\": \"sigPct>=90 ? '#00c853' : sigPct>=60 ? '#448aff' : sigPct>=30 ? '#ffa726' : '#ef5350'\"}, {\"name\": \"barW\", \"update\": \"width * 0.62 - 18\"}], \"data\": [{\"name\": \"apps_raw\", \"url\": {\"%context%\": true, \"%timefield%\": \"@timestamp\", \"index\": \"tychon-pqc-inventory*\", \"body\": {\"size\": 0, \"aggs\": {\"v\": {\"cardinality\": {\"field\": \"process.executable\"}}}}}, \"format\": {\"property\": \"aggregations.v\"}, \"transform\": [{\"type\": \"formula\", \"as\": \"n\", \"expr\": \"datum.value\"}]}, {\"name\": \"apps_total\", \"source\": \"apps_raw\"}, {\"name\": \"kex_pqc_raw\", \"url\": {\"%context%\": true, \"%timefield%\": \"@timestamp\", \"index\": \"tychon-pqc-inventory*\", \"body\": {\"size\": 0, \"aggs\": {\"f\": {\"filter\": {\"term\": {\"omb.kex_tier\": \"PQC READY\"}}, \"aggs\": {\"u\": {\"cardinality\": {\"field\": \"process.executable\"}}}}}}}, \"format\": {\"property\": \"aggregations.f.u\"}, \"transform\": [{\"type\": \"formula\", \"as\": \"n\", \"expr\": \"datum.value\"}]}, {\"name\": \"kex_pqc\", \"source\": \"kex_pqc_raw\"}, {\"name\": \"proto_pqc_raw\", \"url\": {\"%context%\": true, \"%timefield%\": \"@timestamp\", \"index\": \"tychon-pqc-inventory*\", \"body\": {\"size\": 0, \"aggs\": {\"f\": {\"filter\": {\"term\": {\"omb.protocol_tier\": \"TLS 1.3\"}}, \"aggs\": {\"u\": {\"cardinality\": {\"field\": \"process.executable\"}}}}}}}, \"format\": {\"property\": \"aggregations.f.u\"}, \"transform\": [{\"type\": \"formula\", \"as\": \"n\", \"expr\": \"datum.value\"}]}, {\"name\": \"proto_pqc\", \"source\": \"proto_pqc_raw\"}, {\"name\": \"sig_pqc_raw\", \"url\": {\"%context%\": true, \"%timefield%\": \"@timestamp\", \"index\": \"tychon-pqc-inventory*\", \"body\": {\"size\": 0, \"aggs\": {\"f\": {\"filter\": {\"term\": {\"omb.sig_tier\": \"PQC READY\"}}, \"aggs\": {\"u\": {\"cardinality\": {\"field\": \"process.executable\"}}}}}}}, \"format\": {\"property\": \"aggregations.f.u\"}, \"transform\": [{\"type\": \"formula\", \"as\": \"n\", \"expr\": \"datum.value\"}]}, {\"name\": \"sig_pqc\", \"source\": \"sig_pqc_raw\"}], \"marks\": [{\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"value\": 16}, \"y\": {\"value\": 22}, \"text\": {\"value\": \"APPLICATION PQC DASHBOARD\"}, \"fill\": {\"value\": \"#cccccc\"}, \"fontSize\": {\"value\": 11}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"letterSpacing\": {\"value\": 1.5}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"value\": 16}, \"y\": {\"value\": 40}, \"text\": {\"signal\": \"'PQC COMPLIANCE PROGRESS \\u2014 ' + (totalApps>=1000?format(totalApps,'.3~s'):format(totalApps,',')) + ' unique applications'\"}, \"fill\": {\"value\": \"#555555\"}, \"fontSize\": {\"value\": 9}, \"font\": {\"value\": \"monospace\"}, \"letterSpacing\": {\"value\": 1}}}}, {\"type\": \"rule\", \"encode\": {\"enter\": {\"x\": {\"value\": 0}, \"x2\": {\"signal\": \"width\"}, \"y\": {\"value\": 48}, \"stroke\": {\"value\": \"#252525\"}, \"strokeWidth\": {\"value\": 1}}}}, {\"type\": \"rect\", \"encode\": {\"update\": {\"x\": {\"value\": 0}, \"y\": {\"value\": 60}, \"width\": {\"signal\": \"width\"}, \"height\": {\"value\": 78}, \"fill\": {\"value\": \"#161616\"}}}}, {\"type\": \"rect\", \"encode\": {\"update\": {\"x\": {\"value\": 0}, \"y\": {\"value\": 60}, \"width\": {\"value\": 4}, \"height\": {\"value\": 78}, \"fill\": {\"signal\": \"kexClr\"}}}}, {\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"value\": 18}, \"y\": {\"value\": 78}, \"text\": {\"value\": \"KEX COMPLIANCE\"}, \"fill\": {\"value\": \"#888888\"}, \"fontSize\": {\"value\": 9}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"letterSpacing\": {\"value\": 1}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"value\": 18}, \"y\": {\"value\": 93}, \"text\": {\"signal\": \"(kexReady>=1000?format(kexReady,'.3~s'):format(kexReady,',')) + ' of ' + (totalApps>=1000?format(totalApps,'.3~s'):format(totalApps,',')) + ' applications \\u2014 PQC READY key exchange'\"}, \"fill\": {\"value\": \"#444444\"}, \"fontSize\": {\"value\": 9}, \"font\": {\"value\": \"monospace\"}}}}, {\"type\": \"rect\", \"encode\": {\"update\": {\"x\": {\"value\": 18}, \"y\": {\"value\": 106}, \"width\": {\"signal\": \"barW\"}, \"height\": {\"value\": 8}, \"cornerRadius\": {\"value\": 4}, \"fill\": {\"value\": \"#1e1e1e\"}, \"stroke\": {\"value\": \"#2a2a2a\"}, \"strokeWidth\": {\"value\": 1}}}}, {\"type\": \"rect\", \"encode\": {\"update\": {\"x\": {\"value\": 18}, \"y\": {\"value\": 106}, \"width\": {\"signal\": \"max(0, barW * kexPct / 100)\"}, \"height\": {\"value\": 8}, \"cornerRadius\": {\"value\": 4}, \"fill\": {\"signal\": \"kexClr\"}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width - 10\"}, \"y\": {\"value\": 122}, \"text\": {\"signal\": \"kexPct + '%'\"}, \"fill\": {\"signal\": \"kexClr\"}, \"fontSize\": {\"value\": 24}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"right\"}}}}, {\"type\": \"rule\", \"encode\": {\"enter\": {\"x\": {\"value\": 0}, \"x2\": {\"signal\": \"width\"}, \"y\": {\"value\": 138}, \"stroke\": {\"value\": \"#222222\"}, \"strokeWidth\": {\"value\": 1}}}}, {\"type\": \"rect\", \"encode\": {\"update\": {\"x\": {\"value\": 0}, \"y\": {\"value\": 140}, \"width\": {\"signal\": \"width\"}, \"height\": {\"value\": 78}, \"fill\": {\"value\": \"#161616\"}}}}, {\"type\": \"rect\", \"encode\": {\"update\": {\"x\": {\"value\": 0}, \"y\": {\"value\": 140}, \"width\": {\"value\": 4}, \"height\": {\"value\": 78}, \"fill\": {\"signal\": \"protoClr\"}}}}, {\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"value\": 18}, \"y\": {\"value\": 158}, \"text\": {\"value\": \"PROTOCOL COMPLIANCE\"}, \"fill\": {\"value\": \"#888888\"}, \"fontSize\": {\"value\": 9}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"letterSpacing\": {\"value\": 1}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"value\": 18}, \"y\": {\"value\": 173}, \"text\": {\"signal\": \"(protoReady>=1000?format(protoReady,'.3~s'):format(protoReady,',')) + ' of ' + (totalApps>=1000?format(totalApps,'.3~s'):format(totalApps,',')) + ' applications \\u2014 TLS 1.3 capable'\"}, \"fill\": {\"value\": \"#444444\"}, \"fontSize\": {\"value\": 9}, \"font\": {\"value\": \"monospace\"}}}}, {\"type\": \"rect\", \"encode\": {\"update\": {\"x\": {\"value\": 18}, \"y\": {\"value\": 186}, \"width\": {\"signal\": \"barW\"}, \"height\": {\"value\": 8}, \"cornerRadius\": {\"value\": 4}, \"fill\": {\"value\": \"#1e1e1e\"}, \"stroke\": {\"value\": \"#2a2a2a\"}, \"strokeWidth\": {\"value\": 1}}}}, {\"type\": \"rect\", \"encode\": {\"update\": {\"x\": {\"value\": 18}, \"y\": {\"value\": 186}, \"width\": {\"signal\": \"max(0, barW * protoPct / 100)\"}, \"height\": {\"value\": 8}, \"cornerRadius\": {\"value\": 4}, \"fill\": {\"signal\": \"protoClr\"}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width - 10\"}, \"y\": {\"value\": 202}, \"text\": {\"signal\": \"protoPct + '%'\"}, \"fill\": {\"signal\": \"protoClr\"}, \"fontSize\": {\"value\": 24}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"right\"}}}}, {\"type\": \"rule\", \"encode\": {\"enter\": {\"x\": {\"value\": 0}, \"x2\": {\"signal\": \"width\"}, \"y\": {\"value\": 218}, \"stroke\": {\"value\": \"#222222\"}, \"strokeWidth\": {\"value\": 1}}}}, {\"type\": \"rect\", \"encode\": {\"update\": {\"x\": {\"value\": 0}, \"y\": {\"value\": 220}, \"width\": {\"signal\": \"width\"}, \"height\": {\"value\": 78}, \"fill\": {\"value\": \"#161616\"}}}}, {\"type\": \"rect\", \"encode\": {\"update\": {\"x\": {\"value\": 0}, \"y\": {\"value\": 220}, \"width\": {\"value\": 4}, \"height\": {\"value\": 78}, \"fill\": {\"signal\": \"sigClr\"}}}}, {\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"value\": 18}, \"y\": {\"value\": 238}, \"text\": {\"value\": \"CERT SIGNATURE\"}, \"fill\": {\"value\": \"#888888\"}, \"fontSize\": {\"value\": 9}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"letterSpacing\": {\"value\": 1}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"value\": 18}, \"y\": {\"value\": 253}, \"text\": {\"signal\": \"(sigReady>=1000?format(sigReady,'.3~s'):format(sigReady,',')) + ' of ' + (totalApps>=1000?format(totalApps,'.3~s'):format(totalApps,',')) + ' applications \\u2014 PQC READY signature'\"}, \"fill\": {\"value\": \"#444444\"}, \"fontSize\": {\"value\": 9}, \"font\": {\"value\": \"monospace\"}}}}, {\"type\": \"rect\", \"encode\": {\"update\": {\"x\": {\"value\": 18}, \"y\": {\"value\": 266}, \"width\": {\"signal\": \"barW\"}, \"height\": {\"value\": 8}, \"cornerRadius\": {\"value\": 4}, \"fill\": {\"value\": \"#1e1e1e\"}, \"stroke\": {\"value\": \"#2a2a2a\"}, \"strokeWidth\": {\"value\": 1}}}}, {\"type\": \"rect\", \"encode\": {\"update\": {\"x\": {\"value\": 18}, \"y\": {\"value\": 266}, \"width\": {\"signal\": \"max(0, barW * sigPct / 100)\"}, \"height\": {\"value\": 8}, \"cornerRadius\": {\"value\": 4}, \"fill\": {\"signal\": \"sigClr\"}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width - 10\"}, \"y\": {\"value\": 282}, \"text\": {\"signal\": \"sigPct + '%'\"}, \"fill\": {\"signal\": \"sigClr\"}, \"fontSize\": {\"value\": 24}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"right\"}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width / 2\"}, \"y\": {\"signal\": \"height / 2 - 8\"}, \"text\": {\"signal\": \"length(data('apps_raw')) === 0 ? 'NO DATA FOR CURRENT FILTERS / TIME RANGE' : ''\"}, \"fill\": {\"value\": \"#666666\"}, \"font\": {\"value\": \"monospace\"}, \"fontSize\": {\"value\": 11}, \"fontWeight\": {\"value\": \"bold\"}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"zindex\": {\"value\": 100}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width / 2\"}, \"y\": {\"signal\": \"height / 2 + 12\"}, \"text\": {\"signal\": \"length(data('apps_raw')) === 0 ? 'Adjust dashboard filters or expand the selected time range.' : ''\"}, \"fill\": {\"value\": \"#444444\"}, \"font\": {\"value\": \"monospace\"}, \"fontSize\": {\"value\": 9}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"zindex\": {\"value\": 100}}}}]}" + }, + "title": "Application PQC Dashboard Risk", + "type": "vega", + "uiState": {} + } + }, + "gridData": { + "h": 12, + "i": "6f785f49-4d43-42cb-92f3-c80b2c06f45d", + "w": 10, + "x": 38, + "y": 17 + }, + "panelIndex": "6f785f49-4d43-42cb-92f3-c80b2c06f45d", + "title": "Application PQC Dashboard Risk", + "type": "visualization" + }, + { + "embeddableConfig": { + "description": "", + "enhancements": { + "dynamicActions": { + "events": [ + { + "action": { + "config": { + "openInNewTab": false, + "useCurrentDateRange": true, + "useCurrentFilters": true + }, + "factoryId": "DASHBOARD_TO_DASHBOARD_DRILLDOWN", + "name": "Open Cost Analysis" + }, + "eventId": "6e39195a-0cb6-50af-9f4c-94de184a31c3", + "triggers": [ + "FILTER_TRIGGER" + ] + } + ] + } + }, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "id": "", + "params": { + "spec": "{\"$schema\": \"https://vega.github.io/schema/vega/v5.json\", \"description\": \"Selection risk dial aligned to inventory OMB readiness tiers.\", \"autosize\": \"fit\", \"padding\": 10, \"background\": \"#000000\", \"signals\": [{\"name\": \"cx\", \"update\": \"width/2\"}, {\"name\": \"cy\", \"update\": \"height*0.56\"}, {\"name\": \"r\", \"update\": \"min(width, height) * 0.34\"}], \"data\": [{\"name\": \"risk\", \"url\": {\"%context%\": true, \"%timefield%\": \"@timestamp\", \"index\": \"tychon-pqc-inventory*\", \"body\": {\"size\": 0, \"aggs\": {\"apps_total\": {\"cardinality\": {\"field\": \"process.executable\"}}, \"kex_ready\": {\"filter\": {\"term\": {\"omb.kex_tier\": \"PQC READY\"}}, \"aggs\": {\"u\": {\"cardinality\": {\"field\": \"process.executable\"}}}}, \"proto_ready\": {\"filter\": {\"term\": {\"omb.protocol_tier\": \"TLS 1.3\"}}, \"aggs\": {\"u\": {\"cardinality\": {\"field\": \"process.executable\"}}}}, \"sig_ready\": {\"filter\": {\"term\": {\"omb.sig_tier\": \"PQC READY\"}}, \"aggs\": {\"u\": {\"cardinality\": {\"field\": \"process.executable\"}}}}}}}, \"format\": {\"property\": \"aggregations\"}, \"transform\": [{\"type\": \"formula\", \"as\": \"n\", \"expr\": \"isValid(datum.apps_total) && isValid(datum.apps_total.value) ? max(1, datum.apps_total.value) : 1\"}, {\"type\": \"formula\", \"as\": \"kex_ready_n\", \"expr\": \"isValid(datum.kex_ready) && isValid(datum.kex_ready.u) && isValid(datum.kex_ready.u.value) ? datum.kex_ready.u.value : 0\"}, {\"type\": \"formula\", \"as\": \"proto_ready_n\", \"expr\": \"isValid(datum.proto_ready) && isValid(datum.proto_ready.u) && isValid(datum.proto_ready.u.value) ? datum.proto_ready.u.value : 0\"}, {\"type\": \"formula\", \"as\": \"sig_ready_n\", \"expr\": \"isValid(datum.sig_ready) && isValid(datum.sig_ready.u) && isValid(datum.sig_ready.u.value) ? datum.sig_ready.u.value : 0\"}, {\"type\": \"formula\", \"as\": \"p_kex_ready\", \"expr\": \"100 * datum.kex_ready_n / datum.n\"}, {\"type\": \"formula\", \"as\": \"p_proto_ready\", \"expr\": \"100 * datum.proto_ready_n / datum.n\"}, {\"type\": \"formula\", \"as\": \"p_sig_ready\", \"expr\": \"100 * datum.sig_ready_n / datum.n\"}, {\"type\": \"formula\", \"as\": \"readiness\", \"expr\": \"clamp(round((datum.p_kex_ready + datum.p_proto_ready + datum.p_sig_ready) / 3), 0, 100)\"}, {\"type\": \"formula\", \"as\": \"score\", \"expr\": \"clamp(100 - datum.readiness, 0, 100)\"}, {\"type\": \"formula\", \"as\": \"tier\", \"expr\": \"datum.readiness >= 90 ? 'LOW' : datum.readiness >= 60 ? 'MEDIUM' : 'HIGH'\"}, {\"type\": \"formula\", \"as\": \"color\", \"expr\": \"datum.readiness >= 90 ? '#22c55e' : datum.readiness >= 60 ? '#f59e0b' : '#ef4444'\"}, {\"type\": \"formula\", \"as\": \"angle\", \"expr\": \"-3.1415926 + (datum.score/100) * 3.1415926 * 2\"}]}], \"marks\": [{\"type\": \"arc\", \"from\": {\"data\": \"risk\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"cx\"}, \"y\": {\"signal\": \"cy\"}, \"innerRadius\": {\"signal\": \"r-18\"}, \"outerRadius\": {\"signal\": \"r\"}, \"startAngle\": {\"value\": -3.1415926}, \"endAngle\": {\"value\": 3.1415926}, \"fill\": {\"value\": \"#1f2937\"}}}}, {\"type\": \"arc\", \"from\": {\"data\": \"risk\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"cx\"}, \"y\": {\"signal\": \"cy\"}, \"innerRadius\": {\"signal\": \"r-18\"}, \"outerRadius\": {\"signal\": \"r\"}, \"startAngle\": {\"value\": -3.1415926}, \"endAngle\": {\"field\": \"angle\"}, \"fill\": {\"field\": \"color\"}}}}, {\"type\": \"text\", \"from\": {\"data\": \"risk\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"cx\"}, \"y\": {\"signal\": \"cy - 6\"}, \"align\": {\"value\": \"center\"}, \"text\": {\"signal\": \"format(datum.score, 'd') + '/100'\"}, \"font\": {\"value\": \"monospace\"}, \"fontSize\": {\"value\": 28}, \"fontWeight\": {\"value\": \"bold\"}, \"fill\": {\"field\": \"color\"}}}}, {\"type\": \"text\", \"from\": {\"data\": \"risk\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"cx\"}, \"y\": {\"signal\": \"cy + 24\"}, \"align\": {\"value\": \"center\"}, \"text\": {\"signal\": \"datum.tier + ' RISK'\"}, \"font\": {\"value\": \"monospace\"}, \"fontSize\": {\"value\": 12}, \"fontWeight\": {\"value\": \"bold\"}, \"fill\": {\"value\": \"#cfe3f7\"}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width / 2\"}, \"y\": {\"signal\": \"height / 2 - 8\"}, \"text\": {\"signal\": \"length(data('risk')) === 0 ? 'NO DATA FOR CURRENT FILTERS / TIME RANGE' : ''\"}, \"fill\": {\"value\": \"#666666\"}, \"font\": {\"value\": \"monospace\"}, \"fontSize\": {\"value\": 11}, \"fontWeight\": {\"value\": \"bold\"}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"zindex\": {\"value\": 100}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width / 2\"}, \"y\": {\"signal\": \"height / 2 + 12\"}, \"text\": {\"signal\": \"length(data('risk')) === 0 ? 'Adjust dashboard filters or expand the selected time range.' : ''\"}, \"fill\": {\"value\": \"#444444\"}, \"font\": {\"value\": \"monospace\"}, \"fontSize\": {\"value\": 9}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"zindex\": {\"value\": 100}}}}]}" + }, + "title": "QuantumRiskRadial", + "type": "vega", + "uiState": {} + } + }, + "gridData": { + "h": 11, + "i": "7bb23bb3-53f1-48c8-914c-4108cf26dc05", + "w": 8, + "x": 0, + "y": 21 + }, + "panelIndex": "7bb23bb3-53f1-48c8-914c-4108cf26dc05", + "title": "Aggregate Risk Determination", + "type": "visualization" + } + ], + "timeRestore": false, + "title": "[TYCHON Quantum Command] Application Connections Topology", + "version": 3 + }, + "coreMigrationVersion": "8.8.0", + "created_at": "2026-07-20T16:55:14.701Z", + "id": "tychon_quantum_command-6f3d60d5-b5fb-45a5-9298-acf3ceb3ea1b-application-connections-topology", + "references": [ + { + "id": "tychon_quantum_command-6dfff015-3cc9-48b6-9410-7d8c01ff0d9a-application-detail", + "name": "5de2ae04-5993-4e9b-9c32-674ec15c23cb:drilldown:DASHBOARD_TO_DASHBOARD_DRILLDOWN:754afa08-289f-5a39-bc46-04d2b9e6e76a:dashboardId", + "type": "dashboard" + }, + { + "id": "tychon_quantum_command-443e5928-b1c4-4e07-b0b9-c675dd057e2f-application-report", + "name": "6f785f49-4d43-42cb-92f3-c80b2c06f45d:drilldown:DASHBOARD_TO_DASHBOARD_DRILLDOWN:9ee0be55-05bd-533b-b46b-ac541ed779ff:dashboardId", + "type": "dashboard" + }, + { + "id": "tychon_quantum_command-02366033-dee4-4ea4-8458-7c8a8b58987e-cost-analysis", + "name": "7bb23bb3-53f1-48c8-914c-4108cf26dc05:drilldown:DASHBOARD_TO_DASHBOARD_DRILLDOWN:6e39195a-0cb6-50af-9f4c-94de184a31c3:dashboardId", + "type": "dashboard" + }, + { + "id": "tychon_quantum_command-6dfff015-3cc9-48b6-9410-7d8c01ff0d9a-application-detail", + "name": "903af92d-f9ab-4b97-8f31-4f46b66f7b49:drilldown:DASHBOARD_TO_DASHBOARD_DRILLDOWN:28bdb45d-bec5-5991-b0c4-e7c31df068c4:dashboardId", + "type": "dashboard" + }, + { + "id": "tychon_quantum_command-e9b715ba-5f19-4f99-b837-2c1a24143212", + "name": "tag-ref-tychon_quantum_command-e9b715ba-5f19-4f99-b837-2c1a24143212", + "type": "tag" + }, + { + "id": "tychon_quantum_command-07b6a21f-5bba-413b-8d49-e8c246dde2ba", + "name": "tag-ref-tychon_quantum_command-07b6a21f-5bba-413b-8d49-e8c246dde2ba", + "type": "tag" + }, + { + "id": "tychon_quantum_command-dacb217e-57b4-4296-8545-cbf6b5739344", + "name": "tag-ref-tychon_quantum_command-dacb217e-57b4-4296-8545-cbf6b5739344", + "type": "tag" + } + ], + "type": "dashboard", + "typeMigrationVersion": "10.3.0" +} diff --git a/packages/tychon_quantum_command/kibana/dashboard/tychon_quantum_command-d0159137-9139-4a93-85bb-2ac9ddab3982-certificate-operations-dashboard.json b/packages/tychon_quantum_command/kibana/dashboard/tychon_quantum_command-d0159137-9139-4a93-85bb-2ac9ddab3982-certificate-operations-dashboard.json new file mode 100644 index 00000000000..ba097456e3c --- /dev/null +++ b/packages/tychon_quantum_command/kibana/dashboard/tychon_quantum_command-d0159137-9139-4a93-85bb-2ac9ddab3982-certificate-operations-dashboard.json @@ -0,0 +1,653 @@ +{ + "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": { + "ignoreFilters": false, + "ignoreQuery": false, + "ignoreTimerange": false, + "ignoreValidations": false + }, + "panelsJSON": {}, + "showApplySelections": false + }, + "description": "Operational view of all discovered certificates — quantum readiness, hygiene, key algorithms, and issuer coverage", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "optionsJSON": { + "hidePanelTitles": true, + "syncColors": false, + "syncCursor": true, + "syncTooltips": true, + "useMargins": false + }, + "panelsJSON": [ + { + "embeddableConfig": { + "enhancements": {}, + "hidePanelTitles": true, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "id": "", + "params": { + "fontSize": 12, + "markdown": "[Inventory](/app/dashboards#/view/tychon_quantum_command-32c01eb5-0d80-4a28-9de7-55b2046f7c45-inventory) | [Application Report](/app/dashboards#/view/tychon_quantum_command-443e5928-b1c4-4e07-b0b9-c675dd057e2f-application-report) | [Application Detail](/app/dashboards#/view/tychon_quantum_command-6dfff015-3cc9-48b6-9410-7d8c01ff0d9a-application-detail) | Certificate Report | [Application Connections Topology](/app/dashboards#/view/tychon_quantum_command-6f3d60d5-b5fb-45a5-9298-acf3ceb3ea1b-application-connections-topology) | [Cost Analysis](/app/dashboards#/view/tychon_quantum_command-02366033-dee4-4ea4-8458-7c8a8b58987e-cost-analysis)", + "openLinksInNewTab": false + }, + "title": "", + "type": "markdown", + "uiState": {} + } + }, + "gridData": { + "h": 3, + "i": "tychon-quantum-command-nav", + "w": 48, + "x": 0, + "y": 0 + }, + "panelIndex": "tychon-quantum-command-nav", + "title": "", + "type": "visualization" + }, + { + "embeddableConfig": { + "description": "", + "enhancements": { + "dynamicActions": { + "events": [] + } + }, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "id": "", + "params": { + "spec": "{\"$schema\": \"https://vega.github.io/schema/vega/v5.json\", \"padding\": {\"top\": 0, \"bottom\": 0, \"left\": 0, \"right\": 0}, \"background\": \"#111111\", \"signals\": [{\"name\": \"total\", \"update\": \"length(data('d_total'))>0 ? data('d_total')[0].n : 0\"}, {\"name\": \"expired\", \"update\": \"length(data('d_expired'))>0 ? data('d_expired')[0].n : 0\"}, {\"name\": \"exp30\", \"update\": \"length(data('d_exp30'))>0 ? data('d_exp30')[0].n : 0\"}, {\"name\": \"self\", \"update\": \"length(data('d_self'))>0 ? data('d_self')[0].n : 0\"}, {\"name\": \"legacy\", \"update\": \"length(data('d_legacy'))>0 ? data('d_legacy')[0].n : 0\"}, {\"name\": \"pqcvuln\", \"update\": \"length(data('d_pqcvuln'))>0 ? data('d_pqcvuln')[0].n : 0\"}, {\"name\": \"bw\", \"update\": \"floor((width - 10) / 6) - 4\"}, {\"name\": \"sel\", \"value\": null, \"on\": [{\"events\": {\"type\": \"click\", \"markname\": \"tile\"}, \"update\": \"datum.filt ? (datum.k === sel ? null : datum.k) : sel\", \"force\": true}]}, {\"name\": \"_kf\", \"value\": null, \"on\": [{\"events\": {\"type\": \"click\", \"markname\": \"tile\"}, \"update\": \"datum.filt ? (datum.k === sel ? kibanaRemoveFilter(datum.filt) : kibanaAddFilter(datum.filt)) : null\", \"force\": true}]}], \"data\": [{\"name\": \"d_total\", \"url\": {\"%context%\": true, \"index\": \"tychon-pqc-certificates*\", \"body\": {\"size\": 0, \"aggs\": {\"v\": {\"value_count\": {\"field\": \"tychon.type\"}}}}, \"%timefield%\": \"@timestamp\"}, \"format\": {\"property\": \"aggregations.v\"}, \"transform\": [{\"type\": \"formula\", \"as\": \"n\", \"expr\": \"datum.value\"}]}, {\"name\": \"d_expired\", \"url\": {\"%context%\": true, \"index\": \"tychon-pqc-certificates*\", \"body\": {\"size\": 0, \"aggs\": {\"f\": {\"filter\": {\"range\": {\"certificate.not_after\": {\"lt\": \"now\"}}}}}}, \"%timefield%\": \"@timestamp\"}, \"format\": {\"property\": \"aggregations.f\"}, \"transform\": [{\"type\": \"formula\", \"as\": \"n\", \"expr\": \"datum.doc_count\"}]}, {\"name\": \"d_exp30\", \"url\": {\"%context%\": true, \"index\": \"tychon-pqc-certificates*\", \"body\": {\"size\": 0, \"aggs\": {\"f\": {\"filter\": {\"range\": {\"certificate.not_after\": {\"gte\": \"now\", \"lt\": \"now+30d\"}}}}}}, \"%timefield%\": \"@timestamp\"}, \"format\": {\"property\": \"aggregations.f\"}, \"transform\": [{\"type\": \"formula\", \"as\": \"n\", \"expr\": \"datum.doc_count\"}]}, {\"name\": \"d_self\", \"url\": {\"%context%\": true, \"index\": \"tychon-pqc-certificates*\", \"body\": {\"size\": 0, \"aggs\": {\"f\": {\"filter\": {\"term\": {\"certificate.is_self_signed\": true}}}}}, \"%timefield%\": \"@timestamp\"}, \"format\": {\"property\": \"aggregations.f\"}, \"transform\": [{\"type\": \"formula\", \"as\": \"n\", \"expr\": \"datum.doc_count\"}]}, {\"name\": \"d_legacy\", \"url\": {\"%context%\": true, \"index\": \"tychon-pqc-certificates*\", \"body\": {\"size\": 0, \"aggs\": {\"f\": {\"filter\": {\"term\": {\"omb.sig_tier\": \"LEGACY\"}}}}}, \"%timefield%\": \"@timestamp\"}, \"format\": {\"property\": \"aggregations.f\"}, \"transform\": [{\"type\": \"formula\", \"as\": \"n\", \"expr\": \"datum.doc_count\"}]}, {\"name\": \"d_pqcvuln\", \"url\": {\"%context%\": true, \"index\": \"tychon-pqc-certificates*\", \"body\": {\"size\": 0, \"aggs\": {\"f\": {\"filter\": {\"terms\": {\"omb.sig_tier\": [\"CLASSICAL\", \"MODERN\", \"LEGACY\"]}}}}}, \"%timefield%\": \"@timestamp\"}, \"format\": {\"property\": \"aggregations.f\"}, \"transform\": [{\"type\": \"formula\", \"as\": \"n\", \"expr\": \"datum.doc_count\"}]}, {\"name\": \"tiles\", \"values\": [{\"k\": \"TOTAL\", \"ord\": 0, \"clr\": \"#448aff\", \"bg\": \"#448aff18\", \"sig\": \"total\", \"filt\": null}, {\"k\": \"EXPIRED\", \"ord\": 1, \"clr\": \"#ef5350\", \"bg\": \"#ef535018\", \"sig\": \"expired\", \"filt\": {\"range\": {\"certificate.not_after\": {\"lt\": \"now\"}}}}, {\"k\": \"EXP 30D\", \"ord\": 2, \"clr\": \"#ff7043\", \"bg\": \"#ff704318\", \"sig\": \"exp30\", \"filt\": {\"range\": {\"certificate.not_after\": {\"gte\": \"now\", \"lt\": \"now+30d\"}}}}, {\"k\": \"SELF-SIGNED\", \"ord\": 3, \"clr\": \"#ffa726\", \"bg\": \"#ffa72618\", \"sig\": \"self\", \"filt\": {\"term\": {\"certificate.is_self_signed\": true}}}, {\"k\": \"LEGACY\", \"ord\": 4, \"clr\": \"#ef5350\", \"bg\": \"#ef535018\", \"sig\": \"legacy\", \"filt\": {\"term\": {\"omb.sig_tier\": \"LEGACY\"}}}, {\"k\": \"PQC VULN\", \"ord\": 5, \"clr\": \"#ab47bc\", \"bg\": \"#ab47bc18\", \"sig\": \"pqcvuln\", \"filt\": {\"terms\": {\"omb.sig_tier\": [\"CLASSICAL\", \"MODERN\", \"LEGACY\"]}}}], \"transform\": [{\"type\": \"formula\", \"as\": \"x\", \"expr\": \"datum.ord * (bw + 4) + 8\"}, {\"type\": \"formula\", \"as\": \"val\", \"expr\": \"datum.sig === 'total' ? total : datum.sig === 'expired' ? expired : datum.sig === 'exp30' ? exp30 : datum.sig === 'self' ? self : datum.sig === 'legacy' ? legacy : pqcvuln\"}]}], \"marks\": [{\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"value\": 14}, \"y\": {\"value\": 18}, \"text\": {\"value\": \"CERTIFICATE INVENTORY\"}, \"fill\": {\"value\": \"#cccccc\"}, \"fontSize\": {\"value\": 10}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"letterSpacing\": {\"value\": 1.5}}}}, {\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"value\": 14}, \"y\": {\"value\": 34}, \"text\": {\"value\": \"OPERATIONAL OVERVIEW \\u2014 click a tile to filter the dashboard\"}, \"fill\": {\"value\": \"#555555\"}, \"fontSize\": {\"value\": 9}, \"font\": {\"value\": \"monospace\"}, \"letterSpacing\": {\"value\": 1}}}}, {\"type\": \"rule\", \"encode\": {\"enter\": {\"x\": {\"value\": 0}, \"x2\": {\"signal\": \"width\"}, \"y\": {\"value\": 42}, \"stroke\": {\"value\": \"#252525\"}, \"strokeWidth\": {\"value\": 1}}}}, {\"type\": \"rect\", \"name\": \"tile\", \"from\": {\"data\": \"tiles\"}, \"encode\": {\"update\": {\"x\": {\"field\": \"x\"}, \"y\": {\"value\": 52}, \"width\": {\"signal\": \"bw\"}, \"height\": {\"value\": 72}, \"fill\": {\"signal\": \"datum.k === sel ? datum.bg : '#161616'\"}, \"cornerRadius\": {\"value\": 3}, \"stroke\": {\"signal\": \"datum.k === sel ? datum.clr : (datum.val > 0 && datum.filt ? '#2a2a3a' : '#222222')\"}, \"strokeWidth\": {\"signal\": \"datum.k === sel ? 2 : 1\"}}}}, {\"type\": \"text\", \"from\": {\"data\": \"tiles\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"datum.x + bw/2\"}, \"y\": {\"value\": 88}, \"text\": {\"signal\": \"datum.val >= 1000 ? format(datum.val,'.3~s') : format(datum.val,',')\"}, \"fill\": {\"signal\": \"datum.k === sel ? datum.clr : (datum.val > 0 ? datum.clr : '#3a3a3a')\"}, \"fontSize\": {\"value\": 22}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"center\"}}}}, {\"type\": \"text\", \"from\": {\"data\": \"tiles\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"datum.x + bw/2\"}, \"y\": {\"value\": 108}, \"text\": {\"field\": \"k\"}, \"fill\": {\"signal\": \"datum.k === sel ? datum.clr : '#666666'\"}, \"fontSize\": {\"value\": 9}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"center\"}, \"letterSpacing\": {\"value\": 1}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width / 2\"}, \"y\": {\"signal\": \"height / 2 - 8\"}, \"text\": {\"signal\": \"length(data('d_total')) === 0 ? 'NO DATA FOR CURRENT FILTERS / TIME RANGE' : ''\"}, \"fill\": {\"value\": \"#666666\"}, \"font\": {\"value\": \"monospace\"}, \"fontSize\": {\"value\": 11}, \"fontWeight\": {\"value\": \"bold\"}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"zindex\": {\"value\": 100}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width / 2\"}, \"y\": {\"signal\": \"height / 2 + 12\"}, \"text\": {\"signal\": \"length(data('d_total')) === 0 ? 'Adjust dashboard filters or expand the selected time range.' : ''\"}, \"fill\": {\"value\": \"#444444\"}, \"font\": {\"value\": \"monospace\"}, \"fontSize\": {\"value\": 9}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"zindex\": {\"value\": 100}}}}]}" + }, + "title": "CERT OPS — Inventory Header", + "type": "vega", + "uiState": {} + } + }, + "gridData": { + "h": 8, + "i": "74b385d6-da5a-438e-a0af-f1a77dab28db", + "w": 48, + "x": 0, + "y": 2 + }, + "panelIndex": "74b385d6-da5a-438e-a0af-f1a77dab28db", + "title": "CERT OPS — Inventory Header", + "type": "visualization" + }, + { + "embeddableConfig": { + "description": "", + "enhancements": { + "dynamicActions": { + "events": [ + { + "action": { + "config": { + "openInNewTab": false, + "useCurrentDateRange": true, + "useCurrentFilters": true + }, + "factoryId": "DASHBOARD_TO_DASHBOARD_DRILLDOWN", + "name": "Open Inventory" + }, + "eventId": "f676853f-014e-5857-89ba-97b22fb271af", + "triggers": [ + "FILTER_TRIGGER" + ] + } + ] + } + }, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "id": "", + "params": { + "spec": "{\"$schema\": \"https://vega.github.io/schema/vega/v5.json\", \"padding\": {\"top\": 0, \"bottom\": 0, \"left\": 0, \"right\": 0}, \"background\": \"#111111\", \"signals\": [{\"name\": \"sel\", \"value\": null, \"on\": [{\"events\": {\"type\": \"click\", \"markname\": \"bg\"}, \"update\": \"datum.t === sel ? null : datum.t\", \"force\": true}]}, {\"name\": \"_kf\", \"value\": null, \"on\": [{\"events\": {\"type\": \"click\", \"markname\": \"bg\"}, \"update\": \"datum.t === sel ? kibanaRemoveFilter({'match_phrase': {'omb.sig_tier': datum.t}}) : kibanaAddFilter({'match_phrase': {'omb.sig_tier': datum.t}})\", \"force\": true}]}], \"data\": [{\"name\": \"raw\", \"url\": {\"%context%\": true, \"index\": \"tychon-pqc-certificates*\", \"body\": {\"size\": 0, \"aggs\": {\"k\": {\"terms\": {\"field\": \"omb.sig_tier\", \"size\": 10}}}}, \"%timefield%\": \"@timestamp\"}, \"format\": {\"property\": \"aggregations.k.buckets\"}, \"transform\": [{\"type\": \"formula\", \"as\": \"t\", \"expr\": \"datum.key\"}, {\"type\": \"formula\", \"as\": \"n\", \"expr\": \"datum.doc_count\"}]}, {\"name\": \"tc\", \"source\": \"raw\", \"transform\": [{\"type\": \"aggregate\", \"groupby\": [\"t\"], \"ops\": [\"sum\"], \"fields\": [\"n\"], \"as\": [\"n\"]}]}, {\"name\": \"mx\", \"source\": \"tc\", \"transform\": [{\"type\": \"aggregate\", \"ops\": [\"max\"], \"fields\": [\"n\"], \"as\": [\"v\"]}]}, {\"name\": \"rows\", \"values\": [{\"t\": \"PQC READY\", \"lbl\": \"ML-DSA / Dilithium\", \"desc\": \"Post-quantum lattice signature \\u2014 quantum-resistant, CNSA 2.0 approved\", \"badge\": \"PQC READY\", \"clr\": \"#00c853\", \"bg\": \"#00c85318\", \"ord\": 0}, {\"t\": \"MODERN\", \"lbl\": \"ECDSA (P-256 / P-384)\", \"desc\": \"Elliptic curve \\u2014 quantum-vulnerable via Shor's algorithm, must be replaced pre-2035\", \"badge\": \"QUANTUM VULN\", \"clr\": \"#ffa726\", \"bg\": \"#ffa72618\", \"ord\": 1}, {\"t\": \"CLASSICAL\", \"lbl\": \"RSA / SHA-256 RSA\", \"desc\": \"RSA \\u2014 quantum-vulnerable via Shor's algorithm, harvest-now-decrypt-later risk today\", \"badge\": \"QUANTUM VULN\", \"clr\": \"#ef5350\", \"bg\": \"#ef535018\", \"ord\": 2}, {\"t\": \"LEGACY\", \"lbl\": \"MD5 / SHA-1 RSA\", \"desc\": \"SHA-1/MD5 hash \\u2014 classically broken and quantum-vulnerable, replace immediately\", \"badge\": \"QUANTUM VULN\", \"clr\": \"#b71c1c\", \"bg\": \"#b71c1c22\", \"ord\": 3}], \"transform\": [{\"type\": \"lookup\", \"from\": \"tc\", \"key\": \"t\", \"fields\": [\"t\"], \"values\": [\"n\"], \"as\": [\"n\"], \"default\": 0}, {\"type\": \"formula\", \"as\": \"y\", \"expr\": \"datum.ord * 72 + 60\"}]}], \"marks\": [{\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"value\": 16}, \"y\": {\"value\": 18}, \"text\": {\"value\": \"CERTIFICATE SIGNATURE\"}, \"fill\": {\"value\": \"#cccccc\"}, \"fontSize\": {\"value\": 10}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"letterSpacing\": {\"value\": 1.5}}}}, {\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"value\": 16}, \"y\": {\"value\": 38}, \"text\": {\"value\": \"SIGNATURE ALGORITHM \\u2014 click a tier to filter\"}, \"fill\": {\"value\": \"#555555\"}, \"fontSize\": {\"value\": 9}, \"font\": {\"value\": \"monospace\"}, \"letterSpacing\": {\"value\": 1}}}}, {\"type\": \"rule\", \"encode\": {\"enter\": {\"x\": {\"value\": 0}, \"x2\": {\"signal\": \"width\"}, \"y\": {\"value\": 48}, \"stroke\": {\"value\": \"#252525\"}, \"strokeWidth\": {\"value\": 1}}}}, {\"type\": \"rect\", \"name\": \"bg\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 0}, \"y\": {\"field\": \"y\"}, \"width\": {\"signal\": \"width\"}, \"height\": {\"value\": 66}, \"fill\": {\"signal\": \"datum.t===sel?'#1c1c2e':datum.n>0?'#161622':'#161616'\"}, \"cursor\": {\"value\": \"pointer\"}}}}, {\"type\": \"rect\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 0}, \"y\": {\"field\": \"y\"}, \"width\": {\"value\": 4}, \"height\": {\"value\": 66}, \"fill\": {\"signal\": \"datum.n>0?datum.clr:'#2a2a2a'\"}}}}, {\"type\": \"rule\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 0}, \"x2\": {\"signal\": \"width\"}, \"y\": {\"signal\": \"datum.y + 65\"}, \"stroke\": {\"value\": \"#222222\"}}}}, {\"type\": \"rect\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 14}, \"y\": {\"signal\": \"datum.y + 8\"}, \"width\": {\"value\": 82}, \"height\": {\"value\": 16}, \"cornerRadius\": {\"value\": 2}, \"fill\": {\"signal\": \"datum.n>0 ? datum.bg : '#1a1a1a'\"}, \"stroke\": {\"signal\": \"datum.n>0 ? datum.clr : '#2a2a2a'\"}, \"strokeWidth\": {\"value\": 1}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 55}, \"y\": {\"signal\": \"datum.y + 20\"}, \"text\": {\"field\": \"badge\"}, \"fill\": {\"signal\": \"datum.n>0 ? datum.clr : '#383838'\"}, \"fontSize\": {\"value\": 8}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"center\"}, \"letterSpacing\": {\"value\": 0.8}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 106}, \"y\": {\"signal\": \"datum.y + 24\"}, \"text\": {\"field\": \"lbl\"}, \"limit\": {\"signal\": \"width * 0.5\"}, \"fill\": {\"signal\": \"datum.n>0?'#e8e8e8':'#444444'\"}, \"fontSize\": {\"value\": 13}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 106}, \"y\": {\"signal\": \"datum.y + 44\"}, \"text\": {\"field\": \"desc\"}, \"limit\": {\"signal\": \"width * 0.56\"}, \"fill\": {\"value\": \"#555555\"}, \"fontSize\": {\"value\": 9}, \"font\": {\"value\": \"monospace\"}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width - 10\"}, \"y\": {\"signal\": \"datum.y + 38\"}, \"text\": {\"signal\": \"datum.n >= 1000 ? format(datum.n,'.3~s') : format(datum.n,',')\"}, \"fill\": {\"signal\": \"datum.t===sel ? datum.clr : datum.n>0 ? '#dddddd' : '#333333'\"}, \"fontSize\": {\"value\": 20}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"right\"}}}}, {\"type\": \"rect\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width * 0.62\"}, \"y\": {\"signal\": \"datum.y + 50\"}, \"width\": {\"signal\": \"length(data('mx'))>0 && data('mx')[0].v > 0 ? (datum.n / data('mx')[0].v) * (width * 0.30) : 0\"}, \"height\": {\"value\": 6}, \"cornerRadius\": {\"value\": 2}, \"fill\": {\"signal\": \"datum.clr + '55'\"}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width / 2\"}, \"y\": {\"signal\": \"height / 2 - 8\"}, \"text\": {\"signal\": \"length(data('raw')) === 0 ? 'NO DATA FOR CURRENT FILTERS / TIME RANGE' : ''\"}, \"fill\": {\"value\": \"#666666\"}, \"font\": {\"value\": \"monospace\"}, \"fontSize\": {\"value\": 11}, \"fontWeight\": {\"value\": \"bold\"}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"zindex\": {\"value\": 100}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width / 2\"}, \"y\": {\"signal\": \"height / 2 + 12\"}, \"text\": {\"signal\": \"length(data('raw')) === 0 ? 'Adjust dashboard filters or expand the selected time range.' : ''\"}, \"fill\": {\"value\": \"#444444\"}, \"font\": {\"value\": \"monospace\"}, \"fontSize\": {\"value\": 9}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"zindex\": {\"value\": 100}}}}]}" + }, + "title": "CERT OPS — Quantum Tier", + "type": "vega", + "uiState": {} + } + }, + "gridData": { + "h": 29, + "i": "187d7c49-96d6-43fe-a3d7-ee51f605e0f5", + "w": 16, + "x": 0, + "y": 10 + }, + "panelIndex": "187d7c49-96d6-43fe-a3d7-ee51f605e0f5", + "title": "CERT OPS — Quantum Tier", + "type": "visualization" + }, + { + "embeddableConfig": { + "description": "", + "enhancements": { + "dynamicActions": { + "events": [ + { + "action": { + "config": { + "openInNewTab": false, + "useCurrentDateRange": true, + "useCurrentFilters": true + }, + "factoryId": "DASHBOARD_TO_DASHBOARD_DRILLDOWN", + "name": "Open Cost Analysis" + }, + "eventId": "c9ef7c09-bbcf-57c7-bcbc-d3fae0140da2", + "triggers": [ + "FILTER_TRIGGER" + ] + } + ] + } + }, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "id": "", + "params": { + "spec": "{\"$schema\": \"https://vega.github.io/schema/vega/v5.json\", \"padding\": {\"top\": 0, \"bottom\": 0, \"left\": 0, \"right\": 0}, \"background\": \"#111111\", \"signals\": [{\"name\": \"sel\", \"value\": null, \"on\": [{\"events\": {\"type\": \"click\", \"markname\": \"bg\"}, \"update\": \"datum.k === sel ? null : datum.k\", \"force\": true}]}, {\"name\": \"_kf\", \"value\": null, \"on\": [{\"events\": {\"type\": \"click\", \"markname\": \"bg\"}, \"update\": \"datum.n > 0 ? (datum.k === sel ? kibanaRemoveFilter(datum.filt) : kibanaAddFilter(datum.filt)) : null\", \"force\": true}]}], \"data\": [{\"name\": \"raw\", \"url\": {\"%context%\": true, \"%timefield%\": \"@timestamp\", \"index\": \"tychon-pqc-certificates*\", \"body\": {\"size\": 0, \"aggs\": {\"expired\": {\"filter\": {\"range\": {\"certificate.not_after\": {\"lt\": \"now\"}}}}, \"exp30\": {\"filter\": {\"range\": {\"certificate.not_after\": {\"gte\": \"now\", \"lt\": \"now+30d\"}}}}, \"exp90\": {\"filter\": {\"range\": {\"certificate.not_after\": {\"gte\": \"now+30d\", \"lt\": \"now+90d\"}}}}, \"selfsign\": {\"filter\": {\"term\": {\"certificate.is_self_signed\": true}}}, \"weakkey\": {\"filter\": {\"terms\": {\"certificate.subject_public_key_info.bit_size\": [512, 1024]}}}, \"total\": {\"value_count\": {\"field\": \"certificate.not_after\"}}}}}, \"format\": {\"property\": \"aggregations\"}, \"transform\": [{\"type\": \"formula\", \"as\": \"expired\", \"expr\": \"datum.expired ? datum.expired.doc_count : 0\"}, {\"type\": \"formula\", \"as\": \"exp30\", \"expr\": \"datum.exp30 ? datum.exp30.doc_count : 0\"}, {\"type\": \"formula\", \"as\": \"exp90\", \"expr\": \"datum.exp90 ? datum.exp90.doc_count : 0\"}, {\"type\": \"formula\", \"as\": \"selfsign\", \"expr\": \"datum.selfsign ? datum.selfsign.doc_count : 0\"}, {\"type\": \"formula\", \"as\": \"weakkey\", \"expr\": \"datum.weakkey ? datum.weakkey.doc_count : 0\"}, {\"type\": \"formula\", \"as\": \"total\", \"expr\": \"datum.total ? datum.total.value : 0\"}]}, {\"name\": \"rows\", \"values\": [{\"k\": \"EXPIRED\", \"lbl\": \"Expired\", \"desc\": \"certificate.not_after < now \\u2014 no longer trusted by any client\", \"sev\": \"critical\", \"clr\": \"#ef5350\", \"bg\": \"#ef535018\", \"ord\": 0, \"field\": \"expired\", \"filt\": {\"range\": {\"certificate.not_after\": {\"lt\": \"now\"}}}}, {\"k\": \"EXP 30D\", \"lbl\": \"Expiring in 30 days\", \"desc\": \"certificate.not_after within 30 days \\u2014 immediate renewal required\", \"sev\": \"high\", \"clr\": \"#ff7043\", \"bg\": \"#ff704318\", \"ord\": 1, \"field\": \"exp30\", \"filt\": {\"range\": {\"certificate.not_after\": {\"gte\": \"now\", \"lt\": \"now+30d\"}}}}, {\"k\": \"EXP 90D\", \"lbl\": \"Expiring in 90 days\", \"desc\": \"certificate.not_after within 90 days \\u2014 plan renewal now\", \"sev\": \"medium\", \"clr\": \"#ffa726\", \"bg\": \"#ffa72618\", \"ord\": 2, \"field\": \"exp90\", \"filt\": {\"range\": {\"certificate.not_after\": {\"gte\": \"now+30d\", \"lt\": \"now+90d\"}}}}, {\"k\": \"SELF-SIGNED\", \"lbl\": \"Self-Signed\", \"desc\": \"certificate.is_self_signed = true \\u2014 no CA trust chain, browser errors\", \"sev\": \"medium\", \"clr\": \"#ffa726\", \"bg\": \"#ffa72618\", \"ord\": 3, \"field\": \"selfsign\", \"filt\": {\"term\": {\"certificate.is_self_signed\": true}}}, {\"k\": \"WEAK KEY\", \"lbl\": \"Weak Key \\u22641024-bit\", \"desc\": \"RSA/DSA key \\u22641024 bits \\u2014 computationally breakable, must be replaced\", \"sev\": \"critical\", \"clr\": \"#ef5350\", \"bg\": \"#ef535018\", \"ord\": 4, \"field\": \"weakkey\", \"filt\": {\"terms\": {\"certificate.subject_public_key_info.bit_size\": [512, 1024]}}}], \"transform\": [{\"type\": \"lookup\", \"from\": \"raw\", \"key\": \"total\", \"fields\": [\"ord\"], \"values\": [\"expired\", \"exp30\", \"exp90\", \"selfsign\", \"weakkey\", \"total\"], \"as\": [\"v_expired\", \"v_exp30\", \"v_exp90\", \"v_selfsign\", \"v_weakkey\", \"v_total\"], \"default\": 0}, {\"type\": \"formula\", \"as\": \"n\", \"expr\": \"datum.field==='expired' ? (length(data('raw'))>0?data('raw')[0].expired:0) : datum.field==='exp30' ? (length(data('raw'))>0?data('raw')[0].exp30:0) : datum.field==='exp90' ? (length(data('raw'))>0?data('raw')[0].exp90:0) : datum.field==='selfsign' ? (length(data('raw'))>0?data('raw')[0].selfsign:0) : (length(data('raw'))>0?data('raw')[0].weakkey:0)\"}, {\"type\": \"formula\", \"as\": \"tot\", \"expr\": \"length(data('raw'))>0 ? data('raw')[0].total : 1\"}, {\"type\": \"formula\", \"as\": \"pct\", \"expr\": \"datum.tot > 0 ? datum.n / datum.tot : 0\"}, {\"type\": \"formula\", \"as\": \"y\", \"expr\": \"datum.ord * 68 + 52\"}]}], \"marks\": [{\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"value\": 14}, \"y\": {\"value\": 18}, \"text\": {\"value\": \"CERTIFICATE HYGIENE\"}, \"fill\": {\"value\": \"#cccccc\"}, \"fontSize\": {\"value\": 10}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"letterSpacing\": {\"value\": 1.5}}}}, {\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"value\": 14}, \"y\": {\"value\": 34}, \"text\": {\"value\": \"OPERATIONAL ISSUES \\u2014 expiry \\u00b7 trust \\u00b7 key strength\"}, \"fill\": {\"value\": \"#555555\"}, \"fontSize\": {\"value\": 9}, \"font\": {\"value\": \"monospace\"}, \"letterSpacing\": {\"value\": 1}}}}, {\"type\": \"rule\", \"encode\": {\"enter\": {\"x\": {\"value\": 0}, \"x2\": {\"signal\": \"width\"}, \"y\": {\"value\": 42}, \"stroke\": {\"value\": \"#252525\"}, \"strokeWidth\": {\"value\": 1}}}}, {\"type\": \"rect\", \"name\": \"bg\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 0}, \"y\": {\"field\": \"y\"}, \"width\": {\"signal\": \"width\"}, \"height\": {\"value\": 62}, \"fill\": {\"signal\": \"datum.k===sel ? '#1c1c2e' : datum.n>0 ? datum.bg : '#161616'\"}, \"cursor\": {\"value\": \"pointer\"}}}}, {\"type\": \"rect\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 0}, \"y\": {\"field\": \"y\"}, \"width\": {\"value\": 4}, \"height\": {\"value\": 62}, \"fill\": {\"signal\": \"datum.n>0 ? datum.clr : '#2a2a2a'\"}}}}, {\"type\": \"rule\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 0}, \"x2\": {\"signal\": \"width\"}, \"y\": {\"signal\": \"datum.y + 61\"}, \"stroke\": {\"value\": \"#1e1e1e\"}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 16}, \"y\": {\"signal\": \"datum.y + 22\"}, \"text\": {\"field\": \"lbl\"}, \"limit\": {\"signal\": \"width * 0.55\"}, \"fill\": {\"signal\": \"datum.n>0 ? '#e8e8e8' : '#444444'\"}, \"fontSize\": {\"value\": 13}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 16}, \"y\": {\"signal\": \"datum.y + 40\"}, \"text\": {\"field\": \"desc\"}, \"limit\": {\"signal\": \"width * 0.55\"}, \"fill\": {\"value\": \"#555555\"}, \"fontSize\": {\"value\": 9}, \"font\": {\"value\": \"monospace\"}}}}, {\"type\": \"rect\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width * 0.62\"}, \"y\": {\"signal\": \"datum.y + 7\"}, \"width\": {\"value\": 72}, \"height\": {\"value\": 16}, \"cornerRadius\": {\"value\": 2}, \"fill\": {\"signal\": \"datum.n>0 ? datum.bg : '#1a1a1a'\"}, \"stroke\": {\"signal\": \"datum.n>0 ? datum.clr : '#2a2a2a'\"}, \"strokeWidth\": {\"value\": 1}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width * 0.62 + 36\"}, \"y\": {\"signal\": \"datum.y + 19\"}, \"text\": {\"field\": \"sev\"}, \"fill\": {\"signal\": \"datum.n>0 ? datum.clr : '#383838'\"}, \"fontSize\": {\"value\": 8}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"center\"}, \"letterSpacing\": {\"value\": 1}}}}, {\"type\": \"rect\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width * 0.62\"}, \"y\": {\"signal\": \"datum.y + 29\"}, \"width\": {\"value\": 72}, \"height\": {\"value\": 14}, \"cornerRadius\": {\"value\": 2}, \"fill\": {\"value\": \"#1a1a1a\"}, \"stroke\": {\"signal\": \"datum.n > 0 ? '#333333' : '#222222'\"}, \"strokeWidth\": {\"value\": 1}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width * 0.62 + 36\"}, \"y\": {\"signal\": \"datum.y + 40\"}, \"text\": {\"signal\": \"datum.tot > 0 ? format(datum.pct * 100, '.1f') + '%' : '\\u2014'\"}, \"fill\": {\"value\": \"#666666\"}, \"fontSize\": {\"value\": 8}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"center\"}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width - 10\"}, \"y\": {\"signal\": \"datum.y + 36\"}, \"text\": {\"signal\": \"datum.n > 0 ? (datum.n >= 1000 ? format(datum.n,'.3~s') : format(datum.n,',')) : '\\u2014'\"}, \"fill\": {\"signal\": \"datum.k===sel ? datum.clr : datum.n>0 ? '#dddddd' : '#333333'\"}, \"fontSize\": {\"value\": 20}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"right\"}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width / 2\"}, \"y\": {\"signal\": \"height / 2 - 8\"}, \"text\": {\"signal\": \"length(data('raw')) === 0 ? 'NO DATA FOR CURRENT FILTERS / TIME RANGE' : ''\"}, \"fill\": {\"value\": \"#666666\"}, \"font\": {\"value\": \"monospace\"}, \"fontSize\": {\"value\": 11}, \"fontWeight\": {\"value\": \"bold\"}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"zindex\": {\"value\": 100}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width / 2\"}, \"y\": {\"signal\": \"height / 2 + 12\"}, \"text\": {\"signal\": \"length(data('raw')) === 0 ? 'Adjust dashboard filters or expand the selected time range.' : ''\"}, \"fill\": {\"value\": \"#444444\"}, \"font\": {\"value\": \"monospace\"}, \"fontSize\": {\"value\": 9}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"zindex\": {\"value\": 100}}}}]}" + }, + "title": "Certificate Hygiene", + "type": "vega", + "uiState": {} + } + }, + "gridData": { + "h": 29, + "i": "48d7d98f-27df-4c04-a736-8e772da0b028", + "w": 16, + "x": 16, + "y": 10 + }, + "panelIndex": "48d7d98f-27df-4c04-a736-8e772da0b028", + "title": "Certificate Hygiene", + "type": "visualization" + }, + { + "embeddableConfig": { + "description": "", + "enhancements": { + "dynamicActions": { + "events": [ + { + "action": { + "config": { + "openInNewTab": false, + "useCurrentDateRange": true, + "useCurrentFilters": true + }, + "factoryId": "DASHBOARD_TO_DASHBOARD_DRILLDOWN", + "name": "Open Inventory" + }, + "eventId": "5a19f6d5-01ea-5a0d-9469-870400433156", + "triggers": [ + "FILTER_TRIGGER" + ] + } + ] + } + }, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "id": "", + "params": { + "spec": "{\"$schema\": \"https://vega.github.io/schema/vega/v5.json\", \"padding\": {\"top\": 0, \"bottom\": 0, \"left\": 0, \"right\": 0}, \"background\": \"#111111\", \"signals\": [{\"name\": \"sel\", \"value\": null, \"on\": [{\"events\": {\"type\": \"click\", \"markname\": \"bg\"}, \"update\": \"datum.k === sel ? null : datum.k\", \"force\": true}]}, {\"name\": \"_kf\", \"value\": null, \"on\": [{\"events\": {\"type\": \"click\", \"markname\": \"bg\"}, \"update\": \"datum.k === sel ? kibanaRemoveFilter({'match_phrase': {'certificate.issuer_organization': datum.k}}) : kibanaAddFilter({'match_phrase': {'certificate.issuer_organization': datum.k}})\", \"force\": true}]}], \"data\": [{\"name\": \"raw\", \"url\": {\"%context%\": true, \"%timefield%\": \"@timestamp\", \"index\": \"tychon-pqc-certificates*\", \"body\": {\"size\": 0, \"aggs\": {\"by_issuer\": {\"terms\": {\"field\": \"certificate.issuer_organization\", \"size\": 10, \"order\": {\"_count\": \"desc\"}}}}}}, \"format\": {\"property\": \"aggregations.by_issuer.buckets\"}, \"transform\": [{\"type\": \"formula\", \"as\": \"k\", \"expr\": \"datum.key\"}, {\"type\": \"formula\", \"as\": \"n\", \"expr\": \"datum.doc_count\"}, {\"type\": \"collect\", \"sort\": {\"field\": \"n\", \"order\": \"descending\"}}, {\"type\": \"window\", \"ops\": [\"rank\"], \"as\": [\"rnk\"]}, {\"type\": \"formula\", \"as\": \"y\", \"expr\": \"(datum.rnk - 1) * 52 + 52\"}, {\"type\": \"formula\", \"as\": \"clr\", \"expr\": \"datum.rnk === 1 ? '#448aff' : datum.rnk === 2 ? '#4db6ac' : datum.rnk <= 5 ? '#546e7a' : '#37474f'\"}]}, {\"name\": \"mx\", \"source\": \"raw\", \"transform\": [{\"type\": \"aggregate\", \"ops\": [\"max\"], \"fields\": [\"n\"], \"as\": [\"v\"]}]}], \"marks\": [{\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"value\": 14}, \"y\": {\"value\": 18}, \"text\": {\"value\": \"TOP ISSUING CAs\"}, \"fill\": {\"value\": \"#cccccc\"}, \"fontSize\": {\"value\": 10}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"letterSpacing\": {\"value\": 1.5}}}}, {\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"value\": 14}, \"y\": {\"value\": 34}, \"text\": {\"value\": \"CERTIFICATE AUTHORITY \\u2014 who issued your certificates \\u00b7 click to filter\"}, \"fill\": {\"value\": \"#555555\"}, \"fontSize\": {\"value\": 9}, \"font\": {\"value\": \"monospace\"}, \"letterSpacing\": {\"value\": 1}}}}, {\"type\": \"rule\", \"encode\": {\"enter\": {\"x\": {\"value\": 0}, \"x2\": {\"signal\": \"width\"}, \"y\": {\"value\": 42}, \"stroke\": {\"value\": \"#252525\"}, \"strokeWidth\": {\"value\": 1}}}}, {\"type\": \"rect\", \"name\": \"bg\", \"from\": {\"data\": \"raw\"}, \"encode\": {\"update\": {\"x\": {\"value\": 0}, \"y\": {\"field\": \"y\"}, \"width\": {\"signal\": \"width\"}, \"height\": {\"value\": 46}, \"fill\": {\"signal\": \"datum.k===sel ? '#1c1c2e' : '#161616'\"}, \"cursor\": {\"value\": \"pointer\"}}}}, {\"type\": \"rect\", \"from\": {\"data\": \"raw\"}, \"encode\": {\"update\": {\"x\": {\"value\": 0}, \"y\": {\"field\": \"y\"}, \"width\": {\"value\": 3}, \"height\": {\"value\": 46}, \"fill\": {\"field\": \"clr\"}}}}, {\"type\": \"text\", \"from\": {\"data\": \"raw\"}, \"encode\": {\"update\": {\"x\": {\"value\": 30}, \"y\": {\"signal\": \"datum.y + 17\"}, \"text\": {\"signal\": \"format(datum.rnk, 'd') + '.'\"}, \"fill\": {\"value\": \"#444444\"}, \"fontSize\": {\"value\": 10}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"right\"}}}}, {\"type\": \"text\", \"from\": {\"data\": \"raw\"}, \"encode\": {\"update\": {\"x\": {\"value\": 36}, \"y\": {\"signal\": \"datum.y + 17\"}, \"text\": {\"field\": \"k\"}, \"limit\": {\"signal\": \"width * 0.62\"}, \"fill\": {\"signal\": \"datum.k===sel ? datum.clr : '#dddddd'\"}, \"fontSize\": {\"value\": 12}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}}}}, {\"type\": \"rect\", \"from\": {\"data\": \"raw\"}, \"encode\": {\"update\": {\"x\": {\"value\": 36}, \"y\": {\"signal\": \"datum.y + 24\"}, \"width\": {\"signal\": \"length(data('mx'))>0 && data('mx')[0].v > 0 ? (datum.n / data('mx')[0].v) * (width * 0.62) : 0\"}, \"height\": {\"value\": 5}, \"cornerRadius\": {\"value\": 2}, \"fill\": {\"signal\": \"datum.k===sel ? datum.clr : datum.clr + '66'\"}}}}, {\"type\": \"rule\", \"from\": {\"data\": \"raw\"}, \"encode\": {\"update\": {\"x\": {\"value\": 0}, \"x2\": {\"signal\": \"width\"}, \"y\": {\"signal\": \"datum.y + 45\"}, \"stroke\": {\"value\": \"#1e1e1e\"}}}}, {\"type\": \"text\", \"from\": {\"data\": \"raw\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width - 10\"}, \"y\": {\"signal\": \"datum.y + 20\"}, \"text\": {\"signal\": \"datum.n >= 1000 ? format(datum.n,'.3~s') : format(datum.n,',')\"}, \"fill\": {\"signal\": \"datum.k===sel ? datum.clr : '#888888'\"}, \"fontSize\": {\"value\": 14}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"right\"}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width / 2\"}, \"y\": {\"signal\": \"height / 2 - 8\"}, \"text\": {\"signal\": \"length(data('raw')) === 0 ? 'NO DATA FOR CURRENT FILTERS / TIME RANGE' : ''\"}, \"fill\": {\"value\": \"#666666\"}, \"font\": {\"value\": \"monospace\"}, \"fontSize\": {\"value\": 11}, \"fontWeight\": {\"value\": \"bold\"}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"zindex\": {\"value\": 100}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width / 2\"}, \"y\": {\"signal\": \"height / 2 + 12\"}, \"text\": {\"signal\": \"length(data('raw')) === 0 ? 'Adjust dashboard filters or expand the selected time range.' : ''\"}, \"fill\": {\"value\": \"#444444\"}, \"font\": {\"value\": \"monospace\"}, \"fontSize\": {\"value\": 9}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"zindex\": {\"value\": 100}}}}]}" + }, + "title": "CERT OPS — Top Issuing CAs", + "type": "vega", + "uiState": {} + } + }, + "gridData": { + "h": 29, + "i": "df2ef032-250b-40c9-93de-3f6211bddac5", + "w": 16, + "x": 32, + "y": 10 + }, + "panelIndex": "df2ef032-250b-40c9-93de-3f6211bddac5", + "title": "CERT OPS — Top Issuing CAs", + "type": "visualization" + }, + { + "embeddableConfig": { + "description": "", + "enhancements": { + "dynamicActions": { + "events": [ + { + "action": { + "config": { + "openInNewTab": false, + "useCurrentDateRange": true, + "useCurrentFilters": true + }, + "factoryId": "DASHBOARD_TO_DASHBOARD_DRILLDOWN", + "name": "Open Application Report" + }, + "eventId": "195b2262-1d5d-50e1-86d2-f404cd493030", + "triggers": [ + "FILTER_TRIGGER" + ] + } + ] + } + }, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "id": "", + "params": { + "spec": "{\"$schema\": \"https://vega.github.io/schema/vega/v5.json\", \"padding\": {\"top\": 0, \"bottom\": 0, \"left\": 0, \"right\": 0}, \"background\": \"#111111\", \"signals\": [{\"name\": \"sel\", \"value\": null, \"on\": [{\"events\": {\"type\": \"click\", \"markname\": \"bg\"}, \"update\": \"datum.k === sel ? null : datum.k\", \"force\": true}]}, {\"name\": \"_kf\", \"value\": null, \"on\": [{\"events\": {\"type\": \"click\", \"markname\": \"bg\"}, \"update\": \"datum.k === sel ? kibanaRemoveFilter({'match_phrase': {'certificate.subject_public_key_info.algorithm': datum.k}}) : kibanaAddFilter({'match_phrase': {'certificate.subject_public_key_info.algorithm': datum.k}})\", \"force\": true}]}], \"data\": [{\"name\": \"raw\", \"url\": {\"%context%\": true, \"%timefield%\": \"@timestamp\", \"index\": \"tychon-pqc-certificates*\", \"body\": {\"size\": 0, \"aggs\": {\"by_algo\": {\"terms\": {\"field\": \"certificate.subject_public_key_info.algorithm\", \"size\": 10}}, \"total\": {\"value_count\": {\"field\": \"id\"}}}}}, \"format\": {\"property\": \"aggregations.by_algo.buckets\"}, \"transform\": [{\"type\": \"formula\", \"as\": \"k\", \"expr\": \"datum.key\"}, {\"type\": \"formula\", \"as\": \"n\", \"expr\": \"datum.doc_count\"}]}, {\"name\": \"tot\", \"url\": {\"%context%\": true, \"%timefield%\": \"@timestamp\", \"index\": \"tychon-pqc-certificates*\", \"body\": {\"size\": 0, \"aggs\": {\"v\": {\"value_count\": {\"field\": \"id\"}}}}}, \"format\": {\"property\": \"aggregations.v\"}, \"transform\": [{\"type\": \"formula\", \"as\": \"n\", \"expr\": \"datum.value\"}]}, {\"name\": \"palette\", \"values\": [{\"k\": \"RSA\", \"clr\": \"#ffa726\", \"bg\": \"#ffa72618\", \"lbl\": \"RSA\", \"desc\": \"Rivest\\u2013Shamir\\u2013Adleman \\u2014 quantum-vulnerable via Shor's algorithm\"}, {\"k\": \"ECDSA\", \"clr\": \"#448aff\", \"bg\": \"#448aff18\", \"lbl\": \"ECDSA\", \"desc\": \"Elliptic curve \\u2014 quantum-vulnerable, efficient on classical hardware\"}, {\"k\": \"DSA\", \"clr\": \"#ef5350\", \"bg\": \"#ef535018\", \"lbl\": \"DSA\", \"desc\": \"Digital Signature Algorithm \\u2014 deprecated, should not be in new certs\"}, {\"k\": \"unknown_der\", \"clr\": \"#78909c\", \"bg\": \"#78909c18\", \"lbl\": \"Unknown DER\", \"desc\": \"DER-encoded cert with unrecognized key OID\"}, {\"k\": \"unknown_pem\", \"clr\": \"#78909c\", \"bg\": \"#78909c18\", \"lbl\": \"Unknown PEM\", \"desc\": \"PEM-encoded cert with unrecognized key OID\"}, {\"k\": \"ML-DSA\", \"clr\": \"#00c853\", \"bg\": \"#00c85318\", \"lbl\": \"ML-DSA\", \"desc\": \"Lattice-based PQC signature \\u2014 CNSA 2.0 quantum-resistant\"}, {\"k\": \"SLH-DSA\", \"clr\": \"#00c853\", \"bg\": \"#00c85318\", \"lbl\": \"SLH-DSA\", \"desc\": \"Hash-based PQC signature \\u2014 CNSA 2.0 quantum-resistant\"}, {\"k\": \"FN-DSA\", \"clr\": \"#00c853\", \"bg\": \"#00c85318\", \"lbl\": \"FN-DSA\", \"desc\": \"Falcon lattice signature \\u2014 CNSA 2.0 quantum-resistant\"}]}, {\"name\": \"rows\", \"source\": \"raw\", \"transform\": [{\"type\": \"lookup\", \"from\": \"palette\", \"key\": \"k\", \"fields\": [\"k\"], \"values\": [\"clr\", \"bg\", \"lbl\", \"desc\"], \"as\": [\"clr\", \"bg\", \"lbl\", \"desc\"], \"default\": \"#78909c\"}, {\"type\": \"formula\", \"as\": \"clr\", \"expr\": \"datum.clr || '#78909c'\"}, {\"type\": \"formula\", \"as\": \"bg\", \"expr\": \"datum.bg || '#78909c18'\"}, {\"type\": \"formula\", \"as\": \"lbl\", \"expr\": \"datum.lbl || datum.k\"}, {\"type\": \"formula\", \"as\": \"desc\", \"expr\": \"datum.desc || 'Unrecognized key algorithm'\"}, {\"type\": \"collect\", \"sort\": {\"field\": \"n\", \"order\": \"descending\"}}, {\"type\": \"window\", \"ops\": [\"rank\"], \"as\": [\"rnk\"]}, {\"type\": \"formula\", \"as\": \"y\", \"expr\": \"(datum.rnk - 1) * 70 + 52\"}, {\"type\": \"formula\", \"as\": \"tot\", \"expr\": \"length(data('tot'))>0 ? data('tot')[0].n : 1\"}, {\"type\": \"formula\", \"as\": \"pct\", \"expr\": \"datum.tot > 0 ? datum.n / datum.tot : 0\"}, {\"type\": \"formula\", \"as\": \"bw\", \"expr\": \"width * 0.58 - 110\"}]}, {\"name\": \"mx\", \"source\": \"rows\", \"transform\": [{\"type\": \"aggregate\", \"ops\": [\"max\"], \"fields\": [\"n\"], \"as\": [\"v\"]}]}], \"marks\": [{\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"value\": 14}, \"y\": {\"value\": 18}, \"text\": {\"value\": \"KEY ALGORITHM\"}, \"fill\": {\"value\": \"#cccccc\"}, \"fontSize\": {\"value\": 10}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"letterSpacing\": {\"value\": 1.5}}}}, {\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"value\": 14}, \"y\": {\"value\": 34}, \"text\": {\"value\": \"PUBLIC KEY TYPE \\u2014 click to filter\"}, \"fill\": {\"value\": \"#555555\"}, \"fontSize\": {\"value\": 9}, \"font\": {\"value\": \"monospace\"}, \"letterSpacing\": {\"value\": 1}}}}, {\"type\": \"rule\", \"encode\": {\"enter\": {\"x\": {\"value\": 0}, \"x2\": {\"signal\": \"width\"}, \"y\": {\"value\": 42}, \"stroke\": {\"value\": \"#252525\"}, \"strokeWidth\": {\"value\": 1}}}}, {\"type\": \"rect\", \"name\": \"bg\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 0}, \"y\": {\"field\": \"y\"}, \"width\": {\"signal\": \"width\"}, \"height\": {\"value\": 64}, \"fill\": {\"signal\": \"datum.k===sel ? '#1c1c2e' : datum.n>0 ? '#161622' : '#161616'\"}, \"cursor\": {\"value\": \"pointer\"}}}}, {\"type\": \"rect\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 0}, \"y\": {\"field\": \"y\"}, \"width\": {\"value\": 4}, \"height\": {\"value\": 64}, \"fill\": {\"field\": \"clr\"}}}}, {\"type\": \"rule\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 0}, \"x2\": {\"signal\": \"width\"}, \"y\": {\"signal\": \"datum.y + 63\"}, \"stroke\": {\"value\": \"#222222\"}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 14}, \"y\": {\"signal\": \"datum.y + 22\"}, \"text\": {\"field\": \"lbl\"}, \"limit\": {\"signal\": \"width * 0.4\"}, \"fill\": {\"value\": \"#e8e8e8\"}, \"fontSize\": {\"value\": 13}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 14}, \"y\": {\"signal\": \"datum.y + 40\"}, \"text\": {\"field\": \"desc\"}, \"limit\": {\"signal\": \"width * 0.56\"}, \"fill\": {\"value\": \"#555555\"}, \"fontSize\": {\"value\": 9}, \"font\": {\"value\": \"monospace\"}}}}, {\"type\": \"rect\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width * 0.58\"}, \"y\": {\"signal\": \"datum.y + 22\"}, \"width\": {\"signal\": \"length(data('mx'))>0 && data('mx')[0].v > 0 ? (datum.n / data('mx')[0].v) * (width * 0.30) : 0\"}, \"height\": {\"value\": 10}, \"cornerRadius\": {\"value\": 2}, \"fill\": {\"signal\": \"datum.k===sel ? datum.clr : datum.clr + '88'\"}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width - 10\"}, \"y\": {\"signal\": \"datum.y + 36\"}, \"text\": {\"signal\": \"datum.n >= 1000 ? format(datum.n,'.3~s') : format(datum.n,',')\"}, \"fill\": {\"signal\": \"datum.k===sel ? datum.clr : '#dddddd'\"}, \"fontSize\": {\"value\": 18}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"right\"}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width - 10\"}, \"y\": {\"signal\": \"datum.y + 50\"}, \"text\": {\"signal\": \"format(datum.pct * 100, '.1f') + '%'\"}, \"fill\": {\"value\": \"#555555\"}, \"fontSize\": {\"value\": 9}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"right\"}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width / 2\"}, \"y\": {\"signal\": \"height / 2 - 8\"}, \"text\": {\"signal\": \"length(data('raw')) === 0 ? 'NO DATA FOR CURRENT FILTERS / TIME RANGE' : ''\"}, \"fill\": {\"value\": \"#666666\"}, \"font\": {\"value\": \"monospace\"}, \"fontSize\": {\"value\": 11}, \"fontWeight\": {\"value\": \"bold\"}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"zindex\": {\"value\": 100}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width / 2\"}, \"y\": {\"signal\": \"height / 2 + 12\"}, \"text\": {\"signal\": \"length(data('raw')) === 0 ? 'Adjust dashboard filters or expand the selected time range.' : ''\"}, \"fill\": {\"value\": \"#444444\"}, \"font\": {\"value\": \"monospace\"}, \"fontSize\": {\"value\": 9}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"zindex\": {\"value\": 100}}}}]}" + }, + "title": "CERT OPS — Key Algorithm", + "type": "vega", + "uiState": {} + } + }, + "gridData": { + "h": 30, + "i": "65669cd8-396b-410c-bc9b-ee3389ef8017", + "w": 16, + "x": 0, + "y": 39 + }, + "panelIndex": "65669cd8-396b-410c-bc9b-ee3389ef8017", + "title": "CERT OPS — Key Algorithm", + "type": "visualization" + }, + { + "embeddableConfig": { + "description": "", + "enhancements": { + "dynamicActions": { + "events": [ + { + "action": { + "config": { + "openInNewTab": false, + "useCurrentDateRange": true, + "useCurrentFilters": true + }, + "factoryId": "DASHBOARD_TO_DASHBOARD_DRILLDOWN", + "name": "Open Application Report" + }, + "eventId": "4cb43ecb-be8e-5b80-8c8e-32e171de9e03", + "triggers": [ + "FILTER_TRIGGER" + ] + } + ] + } + }, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "id": "", + "params": { + "spec": "{\"$schema\": \"https://vega.github.io/schema/vega/v5.json\", \"padding\": {\"top\": 0, \"bottom\": 0, \"left\": 0, \"right\": 0}, \"background\": \"#111111\", \"signals\": [{\"name\": \"sel\", \"value\": null, \"on\": [{\"events\": {\"type\": \"click\", \"markname\": \"bg\"}, \"update\": \"datum.k === sel ? null : datum.k\", \"force\": true}]}, {\"name\": \"_kf\", \"value\": null, \"on\": [{\"events\": {\"type\": \"click\", \"markname\": \"bg\"}, \"update\": \"datum.k === sel ? kibanaRemoveFilter({'match_phrase': {'certificate.subject_public_key_info.bit_size': datum.sz}}) : kibanaAddFilter({'match_phrase': {'certificate.subject_public_key_info.bit_size': datum.sz}})\", \"force\": true}]}], \"data\": [{\"name\": \"raw\", \"url\": {\"%context%\": true, \"%timefield%\": \"@timestamp\", \"index\": \"tychon-pqc-certificates*\", \"body\": {\"size\": 0, \"aggs\": {\"by_size\": {\"terms\": {\"field\": \"certificate.subject_public_key_info.bit_size\", \"size\": 15, \"order\": {\"_count\": \"desc\"}}}, \"total\": {\"value_count\": {\"field\": \"id\"}}}}}, \"format\": {\"property\": \"aggregations.by_size.buckets\"}, \"transform\": [{\"type\": \"formula\", \"as\": \"sz\", \"expr\": \"datum.key\"}, {\"type\": \"formula\", \"as\": \"k\", \"expr\": \"toString(datum.key) + '-bit'\"}, {\"type\": \"formula\", \"as\": \"n\", \"expr\": \"datum.doc_count\"}, {\"type\": \"formula\", \"as\": \"clr\", \"expr\": \"datum.key <= 1024 ? '#ef5350' : datum.key <= 2048 ? '#ffa726' : datum.key <= 3072 ? '#448aff' : '#00c853'\"}, {\"type\": \"formula\", \"as\": \"bg\", \"expr\": \"datum.key <= 1024 ? '#ef535018' : datum.key <= 2048 ? '#ffa72618' : datum.key <= 3072 ? '#448aff18' : '#00c85318'\"}, {\"type\": \"formula\", \"as\": \"tier\", \"expr\": \"datum.key <= 512 ? 'CRITICAL' : datum.key <= 1024 ? 'WEAK' : datum.key <= 2048 ? 'CLASSICAL' : datum.key <= 3072 ? 'STRONG' : 'CNSA 2.0'\"}, {\"type\": \"formula\", \"as\": \"desc\", \"expr\": \"datum.key <= 512 ? 'Trivially breakable \\u2014 remove immediately' : datum.key <= 1024 ? 'Below NIST minimum \\u2014 must be replaced' : datum.key === 2048 ? 'RSA-2048 / ECDSA-P256 \\u2014 classical standard, quantum-vulnerable' : datum.key === 3072 ? 'RSA-3072 \\u2014 transitional strength, quantum-vulnerable' : datum.key === 4096 ? 'RSA-4096 \\u2014 strong classical, quantum-vulnerable' : datum.key === 256 ? 'ECDSA-P256 \\u2014 modern elliptic curve' : datum.key === 384 ? 'ECDSA-P384 \\u2014 strong elliptic curve (CNSA 1.0)' : 'Key size ' + datum.key\"}, {\"type\": \"collect\", \"sort\": {\"field\": \"n\", \"order\": \"descending\"}}, {\"type\": \"window\", \"ops\": [\"rank\"], \"as\": [\"rnk\"]}, {\"type\": \"formula\", \"as\": \"y\", \"expr\": \"(datum.rnk - 1) * 70 + 52\"}]}, {\"name\": \"tot\", \"url\": {\"%context%\": true, \"%timefield%\": \"@timestamp\", \"index\": \"tychon-pqc-certificates*\", \"body\": {\"size\": 0, \"aggs\": {\"v\": {\"value_count\": {\"field\": \"id\"}}}}}, \"format\": {\"property\": \"aggregations.v\"}, \"transform\": [{\"type\": \"formula\", \"as\": \"n\", \"expr\": \"datum.value\"}]}, {\"name\": \"mx\", \"source\": \"raw\", \"transform\": [{\"type\": \"aggregate\", \"ops\": [\"max\"], \"fields\": [\"n\"], \"as\": [\"v\"]}]}, {\"name\": \"rows\", \"source\": \"raw\", \"transform\": [{\"type\": \"formula\", \"as\": \"tot\", \"expr\": \"length(data('tot'))>0 ? data('tot')[0].n : 1\"}, {\"type\": \"formula\", \"as\": \"pct\", \"expr\": \"datum.tot > 0 ? datum.n / datum.tot : 0\"}]}], \"marks\": [{\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"value\": 14}, \"y\": {\"value\": 18}, \"text\": {\"value\": \"KEY SIZE DISTRIBUTION\"}, \"fill\": {\"value\": \"#cccccc\"}, \"fontSize\": {\"value\": 10}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"letterSpacing\": {\"value\": 1.5}}}}, {\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"value\": 14}, \"y\": {\"value\": 34}, \"text\": {\"value\": \"BIT STRENGTH \\u2014 click to filter \\u00b7 CNSA 2.0 requires RSA \\u22653072 or ECDSA P-384\"}, \"fill\": {\"value\": \"#555555\"}, \"fontSize\": {\"value\": 9}, \"font\": {\"value\": \"monospace\"}, \"letterSpacing\": {\"value\": 1}}}}, {\"type\": \"rule\", \"encode\": {\"enter\": {\"x\": {\"value\": 0}, \"x2\": {\"signal\": \"width\"}, \"y\": {\"value\": 42}, \"stroke\": {\"value\": \"#252525\"}, \"strokeWidth\": {\"value\": 1}}}}, {\"type\": \"rect\", \"name\": \"bg\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 0}, \"y\": {\"field\": \"y\"}, \"width\": {\"signal\": \"width\"}, \"height\": {\"value\": 64}, \"fill\": {\"signal\": \"datum.k===sel ? '#1c1c2e' : '#161616'\"}, \"cursor\": {\"value\": \"pointer\"}}}}, {\"type\": \"rect\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 0}, \"y\": {\"field\": \"y\"}, \"width\": {\"value\": 4}, \"height\": {\"value\": 64}, \"fill\": {\"field\": \"clr\"}}}}, {\"type\": \"rule\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 0}, \"x2\": {\"signal\": \"width\"}, \"y\": {\"signal\": \"datum.y + 63\"}, \"stroke\": {\"value\": \"#222222\"}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 14}, \"y\": {\"signal\": \"datum.y + 22\"}, \"text\": {\"field\": \"k\"}, \"fill\": {\"value\": \"#e8e8e8\"}, \"fontSize\": {\"value\": 13}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 14}, \"y\": {\"signal\": \"datum.y + 40\"}, \"text\": {\"field\": \"desc\"}, \"limit\": {\"signal\": \"width * 0.55\"}, \"fill\": {\"value\": \"#555555\"}, \"fontSize\": {\"value\": 9}, \"font\": {\"value\": \"monospace\"}}}}, {\"type\": \"rect\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width * 0.58\"}, \"y\": {\"signal\": \"datum.y + 7\"}, \"width\": {\"value\": 64}, \"height\": {\"value\": 16}, \"cornerRadius\": {\"value\": 2}, \"fill\": {\"field\": \"bg\"}, \"stroke\": {\"field\": \"clr\"}, \"strokeWidth\": {\"value\": 1}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width * 0.58 + 32\"}, \"y\": {\"signal\": \"datum.y + 19\"}, \"text\": {\"field\": \"tier\"}, \"fill\": {\"field\": \"clr\"}, \"fontSize\": {\"value\": 8}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"center\"}, \"letterSpacing\": {\"value\": 0.8}}}}, {\"type\": \"rect\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width * 0.58\"}, \"y\": {\"signal\": \"datum.y + 27\"}, \"width\": {\"signal\": \"length(data('mx'))>0 && data('mx')[0].v > 0 ? (datum.n / data('mx')[0].v) * 64 : 0\"}, \"height\": {\"value\": 12}, \"cornerRadius\": {\"value\": 2}, \"fill\": {\"signal\": \"datum.clr + '55'\"}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width - 10\"}, \"y\": {\"signal\": \"datum.y + 36\"}, \"text\": {\"signal\": \"datum.n >= 1000 ? format(datum.n,'.3~s') : format(datum.n,',')\"}, \"fill\": {\"signal\": \"datum.k===sel ? datum.clr : '#dddddd'\"}, \"fontSize\": {\"value\": 18}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"right\"}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width - 10\"}, \"y\": {\"signal\": \"datum.y + 50\"}, \"text\": {\"signal\": \"format(datum.pct * 100, '.1f') + '%'\"}, \"fill\": {\"value\": \"#555555\"}, \"fontSize\": {\"value\": 9}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"right\"}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width / 2\"}, \"y\": {\"signal\": \"height / 2 - 8\"}, \"text\": {\"signal\": \"length(data('raw')) === 0 ? 'NO DATA FOR CURRENT FILTERS / TIME RANGE' : ''\"}, \"fill\": {\"value\": \"#666666\"}, \"font\": {\"value\": \"monospace\"}, \"fontSize\": {\"value\": 11}, \"fontWeight\": {\"value\": \"bold\"}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"zindex\": {\"value\": 100}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width / 2\"}, \"y\": {\"signal\": \"height / 2 + 12\"}, \"text\": {\"signal\": \"length(data('raw')) === 0 ? 'Adjust dashboard filters or expand the selected time range.' : ''\"}, \"fill\": {\"value\": \"#444444\"}, \"font\": {\"value\": \"monospace\"}, \"fontSize\": {\"value\": 9}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"zindex\": {\"value\": 100}}}}]}" + }, + "title": "CERT OPS — Key Size Distribution", + "type": "vega", + "uiState": {} + } + }, + "gridData": { + "h": 30, + "i": "3a8c4d30-8553-4034-91da-f7010ef7b182", + "w": 16, + "x": 16, + "y": 39 + }, + "panelIndex": "3a8c4d30-8553-4034-91da-f7010ef7b182", + "title": "CERT OPS — Key Size Distribution", + "type": "visualization" + }, + { + "embeddableConfig": { + "description": "", + "enhancements": { + "dynamicActions": { + "events": [ + { + "action": { + "config": { + "openInNewTab": false, + "useCurrentDateRange": true, + "useCurrentFilters": true + }, + "factoryId": "DASHBOARD_TO_DASHBOARD_DRILLDOWN", + "name": "Open Application Report" + }, + "eventId": "5e8c06e1-fcf5-5aab-b7bc-c3cdc891baee", + "triggers": [ + "FILTER_TRIGGER" + ] + } + ] + } + }, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "", + "id": "", + "params": { + "spec": "{\"$schema\": \"https://vega.github.io/schema/vega/v5.json\", \"padding\": {\"top\": 0, \"bottom\": 0, \"left\": 0, \"right\": 0}, \"background\": \"#111111\", \"signals\": [{\"name\": \"sel\", \"value\": null, \"on\": [{\"events\": {\"type\": \"click\", \"markname\": \"bg\"}, \"update\": \"datum.k === sel ? null : datum.k\", \"force\": true}]}, {\"name\": \"_kf\", \"value\": null, \"on\": [{\"events\": {\"type\": \"click\", \"markname\": \"bg\"}, \"update\": \"datum.k === sel ? kibanaRemoveFilter({'match_phrase': {'certificate.signature_algorithm': datum.k}}) : kibanaAddFilter({'match_phrase': {'certificate.signature_algorithm': datum.k}})\", \"force\": true}]}], \"data\": [{\"name\": \"raw\", \"url\": {\"%context%\": true, \"%timefield%\": \"@timestamp\", \"index\": \"tychon-pqc-certificates*\", \"body\": {\"size\": 0, \"aggs\": {\"by_sig\": {\"terms\": {\"field\": \"certificate.signature_algorithm\", \"size\": 15, \"order\": {\"_count\": \"desc\"}}}, \"total\": {\"value_count\": {\"field\": \"id\"}}}}}, \"format\": {\"property\": \"aggregations.by_sig.buckets\"}, \"transform\": [{\"type\": \"formula\", \"as\": \"k\", \"expr\": \"datum.key\"}, {\"type\": \"formula\", \"as\": \"n\", \"expr\": \"datum.doc_count\"}, {\"type\": \"formula\", \"as\": \"clr\", \"expr\": \"datum.key === 'MD5-RSA' ? '#ef5350' : datum.key === 'DSA-SHA1' || datum.key === 'SHA1-RSA' ? '#ef5350' : datum.key === 'ECDSA-SHA256' || datum.key === 'ECDSA-SHA384' || datum.key === 'ECDSA-SHA512' ? '#448aff' : datum.key === 'SHA256-RSA' || datum.key === 'SHA384-RSA' || datum.key === 'SHA512-RSA' ? '#ffa726' : datum.key === 'N/A' || datum.key === '0' ? '#555555' : '#00c853'\"}, {\"type\": \"formula\", \"as\": \"bg\", \"expr\": \"datum.key === 'MD5-RSA' ? '#ef535018' : datum.key === 'DSA-SHA1' || datum.key === 'SHA1-RSA' ? '#ef535018' : datum.key === 'ECDSA-SHA256' || datum.key === 'ECDSA-SHA384' || datum.key === 'ECDSA-SHA512' ? '#448aff18' : datum.key === 'SHA256-RSA' || datum.key === 'SHA384-RSA' || datum.key === 'SHA512-RSA' ? '#ffa72618' : '#55555518'\"}, {\"type\": \"formula\", \"as\": \"tier\", \"expr\": \"datum.key === 'MD5-RSA' ? 'BROKEN' : datum.key === 'DSA-SHA1' || datum.key === 'SHA1-RSA' ? 'LEGACY' : datum.key === 'ECDSA-SHA256' || datum.key === 'ECDSA-SHA384' || datum.key === 'ECDSA-SHA512' ? 'MODERN' : datum.key === 'SHA256-RSA' || datum.key === 'SHA384-RSA' || datum.key === 'SHA512-RSA' ? 'CLASSICAL' : datum.key === 'N/A' || datum.key === '0' ? 'UNKNOWN' : 'PQC READY'\"}, {\"type\": \"formula\", \"as\": \"desc\", \"expr\": \"datum.key === 'MD5-RSA' ? 'MD5 collision attacks are trivial \\u2014 critically broken' : datum.key === 'SHA1-RSA' ? 'SHA-1 deprecated \\u2014 browsers reject, fails compliance' : datum.key === 'DSA-SHA1' ? 'DSA with SHA-1 \\u2014 both deprecated, remove immediately' : datum.key === 'SHA256-RSA' ? 'RSA with SHA-256 \\u2014 dominant classical standard' : datum.key === 'SHA384-RSA' ? 'RSA with SHA-384 \\u2014 stronger hash, still quantum-vulnerable' : datum.key === 'SHA512-RSA' ? 'RSA with SHA-512 \\u2014 strongest classical RSA variant' : datum.key === 'ECDSA-SHA256' ? 'ECDSA with SHA-256 \\u2014 modern, efficient, quantum-vulnerable' : datum.key === 'ECDSA-SHA384' ? 'ECDSA with SHA-384 \\u2014 CNSA 1.0 approved, quantum-vulnerable' : 'Signature algorithm'\"}, {\"type\": \"filter\", \"expr\": \"datum.k !== 'N/A' && datum.k !== '0'\"}, {\"type\": \"collect\", \"sort\": {\"field\": \"n\", \"order\": \"descending\"}}, {\"type\": \"window\", \"ops\": [\"rank\"], \"as\": [\"rnk\"]}, {\"type\": \"formula\", \"as\": \"y\", \"expr\": \"(datum.rnk - 1) * 66 + 52\"}]}, {\"name\": \"tot\", \"url\": {\"%context%\": true, \"%timefield%\": \"@timestamp\", \"index\": \"tychon-pqc-certificates*\", \"body\": {\"size\": 0, \"aggs\": {\"v\": {\"value_count\": {\"field\": \"id\"}}}}}, \"format\": {\"property\": \"aggregations.v\"}, \"transform\": [{\"type\": \"formula\", \"as\": \"n\", \"expr\": \"datum.value\"}]}, {\"name\": \"mx\", \"source\": \"raw\", \"transform\": [{\"type\": \"aggregate\", \"ops\": [\"max\"], \"fields\": [\"n\"], \"as\": [\"v\"]}]}, {\"name\": \"rows\", \"source\": \"raw\", \"transform\": [{\"type\": \"formula\", \"as\": \"tot\", \"expr\": \"length(data('tot'))>0 ? data('tot')[0].n : 1\"}, {\"type\": \"formula\", \"as\": \"pct\", \"expr\": \"datum.tot > 0 ? datum.n / datum.tot : 0\"}]}], \"marks\": [{\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"value\": 14}, \"y\": {\"value\": 18}, \"text\": {\"value\": \"SIGNATURE ALGORITHM\"}, \"fill\": {\"value\": \"#cccccc\"}, \"fontSize\": {\"value\": 10}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"letterSpacing\": {\"value\": 1.5}}}}, {\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"value\": 14}, \"y\": {\"value\": 34}, \"text\": {\"value\": \"HOW CERTIFICATES ARE SIGNED \\u2014 click to filter\"}, \"fill\": {\"value\": \"#555555\"}, \"fontSize\": {\"value\": 9}, \"font\": {\"value\": \"monospace\"}, \"letterSpacing\": {\"value\": 1}}}}, {\"type\": \"rule\", \"encode\": {\"enter\": {\"x\": {\"value\": 0}, \"x2\": {\"signal\": \"width\"}, \"y\": {\"value\": 42}, \"stroke\": {\"value\": \"#252525\"}, \"strokeWidth\": {\"value\": 1}}}}, {\"type\": \"rect\", \"name\": \"bg\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 0}, \"y\": {\"field\": \"y\"}, \"width\": {\"signal\": \"width\"}, \"height\": {\"value\": 60}, \"fill\": {\"signal\": \"datum.k===sel ? '#1c1c2e' : '#161616'\"}, \"cursor\": {\"value\": \"pointer\"}}}}, {\"type\": \"rect\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 0}, \"y\": {\"field\": \"y\"}, \"width\": {\"value\": 4}, \"height\": {\"value\": 60}, \"fill\": {\"field\": \"clr\"}}}}, {\"type\": \"rule\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 0}, \"x2\": {\"signal\": \"width\"}, \"y\": {\"signal\": \"datum.y + 59\"}, \"stroke\": {\"value\": \"#222222\"}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 14}, \"y\": {\"signal\": \"datum.y + 20\"}, \"text\": {\"field\": \"k\"}, \"limit\": {\"signal\": \"width * 0.42\"}, \"fill\": {\"value\": \"#e8e8e8\"}, \"fontSize\": {\"value\": 13}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 14}, \"y\": {\"signal\": \"datum.y + 38\"}, \"text\": {\"field\": \"desc\"}, \"limit\": {\"signal\": \"width * 0.55\"}, \"fill\": {\"value\": \"#555555\"}, \"fontSize\": {\"value\": 9}, \"font\": {\"value\": \"monospace\"}}}}, {\"type\": \"rect\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width * 0.60\"}, \"y\": {\"signal\": \"datum.y + 6\"}, \"width\": {\"value\": 68}, \"height\": {\"value\": 15}, \"cornerRadius\": {\"value\": 2}, \"fill\": {\"field\": \"bg\"}, \"stroke\": {\"field\": \"clr\"}, \"strokeWidth\": {\"value\": 1}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width * 0.60 + 34\"}, \"y\": {\"signal\": \"datum.y + 18\"}, \"text\": {\"field\": \"tier\"}, \"fill\": {\"field\": \"clr\"}, \"fontSize\": {\"value\": 8}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"center\"}, \"letterSpacing\": {\"value\": 0.8}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width - 10\"}, \"y\": {\"signal\": \"datum.y + 32\"}, \"text\": {\"signal\": \"datum.n >= 1000 ? format(datum.n,'.3~s') : format(datum.n,',')\"}, \"fill\": {\"signal\": \"datum.k===sel ? datum.clr : '#dddddd'\"}, \"fontSize\": {\"value\": 18}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"right\"}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width - 10\"}, \"y\": {\"signal\": \"datum.y + 47\"}, \"text\": {\"signal\": \"format(datum.pct * 100, '.1f') + '%'\"}, \"fill\": {\"value\": \"#555555\"}, \"fontSize\": {\"value\": 9}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"right\"}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width / 2\"}, \"y\": {\"signal\": \"height / 2 - 8\"}, \"text\": {\"signal\": \"length(data('raw')) === 0 ? 'NO DATA FOR CURRENT FILTERS / TIME RANGE' : ''\"}, \"fill\": {\"value\": \"#666666\"}, \"font\": {\"value\": \"monospace\"}, \"fontSize\": {\"value\": 11}, \"fontWeight\": {\"value\": \"bold\"}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"zindex\": {\"value\": 100}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width / 2\"}, \"y\": {\"signal\": \"height / 2 + 12\"}, \"text\": {\"signal\": \"length(data('raw')) === 0 ? 'Adjust dashboard filters or expand the selected time range.' : ''\"}, \"fill\": {\"value\": \"#444444\"}, \"font\": {\"value\": \"monospace\"}, \"fontSize\": {\"value\": 9}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"zindex\": {\"value\": 100}}}}]}" + }, + "title": "CERT OPS — Signature Algorithm", + "type": "vega", + "uiState": {} + } + }, + "gridData": { + "h": 30, + "i": "3fa6122b-517f-47d6-b194-2fcea3de3332", + "w": 16, + "x": 32, + "y": 39 + }, + "panelIndex": "3fa6122b-517f-47d6-b194-2fcea3de3332", + "title": "CERT OPS — Signature Algorithm", + "type": "visualization" + }, + { + "embeddableConfig": { + "description": "Certificate lifetime buckets: automated (≤90d) through legacy (>5yr) with key management system insight", + "enhancements": { + "dynamicActions": { + "events": [ + { + "action": { + "config": { + "openInNewTab": false, + "useCurrentDateRange": true, + "useCurrentFilters": true + }, + "factoryId": "DASHBOARD_TO_DASHBOARD_DRILLDOWN", + "name": "Open Cost Analysis" + }, + "eventId": "8de715c9-8769-51a8-8672-32a3af72a8c7", + "triggers": [ + "FILTER_TRIGGER" + ] + } + ] + } + }, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "Certificate lifetime buckets: automated (≤90d) through legacy (>5yr) with key management system insight", + "id": "", + "params": { + "spec": "{\"$schema\": \"https://vega.github.io/schema/vega/v5.json\", \"padding\": {\"top\": 0, \"bottom\": 0, \"left\": 0, \"right\": 0}, \"background\": \"#111111\", \"signals\": [{\"name\": \"sel\", \"value\": null, \"on\": [{\"events\": {\"type\": \"click\", \"markname\": \"bg\"}, \"update\": \"datum.k === sel ? null : datum.k\", \"force\": true}]}, {\"name\": \"_kf\", \"value\": null, \"on\": [{\"events\": {\"type\": \"click\", \"markname\": \"bg\"}, \"update\": \"datum.n > 0 ? (datum.k === sel ? kibanaRemoveFilter(datum.filt) : kibanaAddFilter(datum.filt)) : null\", \"force\": true}]}], \"data\": [{\"name\": \"raw\", \"url\": {\"%context%\": true, \"%timefield%\": \"@timestamp\", \"index\": \"tychon-pqc-certificates*\", \"body\": {\"size\": 0, \"aggs\": {\"le90d\": {\"filter\": {\"script\": {\"script\": {\"lang\": \"painless\", \"source\": \"if(doc['certificate.not_before'].size()==0||doc['certificate.not_after'].size()==0)return false;long nb=doc['certificate.not_before'].value.toInstant().toEpochMilli();long na=doc['certificate.not_after'].value.toInstant().toEpochMilli();if(na<=System.currentTimeMillis())return false;long d=(na-nb)/86400000L;return d>=0&&d<=90;\"}}}}, \"le1yr\": {\"filter\": {\"script\": {\"script\": {\"lang\": \"painless\", \"source\": \"if(doc['certificate.not_before'].size()==0||doc['certificate.not_after'].size()==0)return false;long nb=doc['certificate.not_before'].value.toInstant().toEpochMilli();long na=doc['certificate.not_after'].value.toInstant().toEpochMilli();long d=(na-nb)/86400000L;return d>90&&d<=365;\"}}}}, \"le825d\": {\"filter\": {\"script\": {\"script\": {\"lang\": \"painless\", \"source\": \"if(doc['certificate.not_before'].size()==0||doc['certificate.not_after'].size()==0)return false;long nb=doc['certificate.not_before'].value.toInstant().toEpochMilli();long na=doc['certificate.not_after'].value.toInstant().toEpochMilli();long d=(na-nb)/86400000L;return d>365&&d<=825;\"}}}}, \"le5yr\": {\"filter\": {\"script\": {\"script\": {\"lang\": \"painless\", \"source\": \"if(doc['certificate.not_before'].size()==0||doc['certificate.not_after'].size()==0)return false;long nb=doc['certificate.not_before'].value.toInstant().toEpochMilli();long na=doc['certificate.not_after'].value.toInstant().toEpochMilli();long d=(na-nb)/86400000L;return d>825&&d<=1825;\"}}}}, \"gt5yr\": {\"filter\": {\"script\": {\"script\": {\"lang\": \"painless\", \"source\": \"if(doc['certificate.not_before'].size()==0||doc['certificate.not_after'].size()==0)return false;long nb=doc['certificate.not_before'].value.toInstant().toEpochMilli();long na=doc['certificate.not_after'].value.toInstant().toEpochMilli();long d=(na-nb)/86400000L;return d>1825;\"}}}}}}}, \"format\": {\"property\": \"aggregations\"}, \"transform\": [{\"type\": \"formula\", \"as\": \"le90d\", \"expr\": \"datum.le90d ? datum.le90d.doc_count : 0\"}, {\"type\": \"formula\", \"as\": \"le1yr\", \"expr\": \"datum.le1yr ? datum.le1yr.doc_count : 0\"}, {\"type\": \"formula\", \"as\": \"le825d\", \"expr\": \"datum.le825d ? datum.le825d.doc_count : 0\"}, {\"type\": \"formula\", \"as\": \"le5yr\", \"expr\": \"datum.le5yr ? datum.le5yr.doc_count : 0\"}, {\"type\": \"formula\", \"as\": \"gt5yr\", \"expr\": \"datum.gt5yr ? datum.gt5yr.doc_count : 0\"}]}, {\"name\": \"tot\", \"url\": {\"%context%\": true, \"%timefield%\": \"@timestamp\", \"index\": \"tychon-pqc-certificates*\", \"body\": {\"size\": 0, \"aggs\": {\"v\": {\"value_count\": {\"field\": \"certificate.not_after\"}}}}}, \"format\": {\"property\": \"aggregations.v\"}, \"transform\": [{\"type\": \"formula\", \"as\": \"n\", \"expr\": \"datum.value\"}]}, {\"name\": \"rows\", \"values\": [{\"k\": \"le90d\", \"lbl\": \"Automated \\u226490 days\", \"mgmt\": \"KEY MGT SYSTEM\", \"desc\": \"Almost certainly managed by ACME / Let's Encrypt / cert-manager \\u2014 short lifetime is a signature of automated issuance\", \"clr\": \"#00c853\", \"bg\": \"#00c85318\", \"ord\": 0, \"field\": \"le90d\", \"filt\": {\"range\": {\"cert_total_days\": {\"gte\": 0, \"lte\": 90}}}}, {\"k\": \"le1yr\", \"lbl\": \"Short-lived \\u22641 year\", \"mgmt\": \"LIKELY MANAGED\", \"desc\": \"Annual lifetime pattern \\u2014 may be automated renewal or disciplined manual rotation by an ops team\", \"clr\": \"#4db6ac\", \"bg\": \"#4db6ac18\", \"ord\": 1, \"field\": \"le1yr\", \"filt\": {\"range\": {\"cert_total_days\": {\"gt\": 90, \"lte\": 365}}}}, {\"k\": \"le825d\", \"lbl\": \"Modern \\u2264825 days\", \"mgmt\": \"CA ISSUED\", \"desc\": \"Within Apple / browser maximum trust limit (825 days) \\u2014 actively issued by a real CA, rotation expected\", \"clr\": \"#448aff\", \"bg\": \"#448aff18\", \"ord\": 2, \"field\": \"le825d\", \"filt\": {\"range\": {\"cert_total_days\": {\"gt\": 365, \"lte\": 825}}}}, {\"k\": \"le5yr\", \"lbl\": \"Long-lived \\u22645 years\", \"mgmt\": \"MANUAL\", \"desc\": \"826\\u20131825 day lifetime \\u2014 manually managed, no automated rotation, quantum risk grows over the certificate's life\", \"clr\": \"#ffa726\", \"bg\": \"#ffa72618\", \"ord\": 3, \"field\": \"le5yr\", \"filt\": {\"range\": {\"cert_total_days\": {\"gt\": 825, \"lte\": 1825}}}}, {\"k\": \"gt5yr\", \"lbl\": \"Legacy > 5 years\", \"mgmt\": \"LEGACY / MANUAL\", \"desc\": \"5+ year validity \\u2014 definitely manually issued; each year of remaining life increases the window for harvest-now-decrypt-later attacks\", \"clr\": \"#ef5350\", \"bg\": \"#ef535018\", \"ord\": 4, \"field\": \"gt5yr\", \"filt\": {\"range\": {\"cert_total_days\": {\"gt\": 1825}}}}], \"transform\": [{\"type\": \"formula\", \"as\": \"n\", \"expr\": \"length(data('raw'))>0 ? (datum.field==='le90d' ? data('raw')[0].le90d : datum.field==='le1yr' ? data('raw')[0].le1yr : datum.field==='le825d' ? data('raw')[0].le825d : datum.field==='le5yr' ? data('raw')[0].le5yr : data('raw')[0].gt5yr) : 0\"}, {\"type\": \"formula\", \"as\": \"tot\", \"expr\": \"length(data('tot'))>0 ? data('tot')[0].n : 1\"}, {\"type\": \"formula\", \"as\": \"pct\", \"expr\": \"datum.tot > 0 ? datum.n / datum.tot : 0\"}, {\"type\": \"formula\", \"as\": \"y\", \"expr\": \"datum.ord * 72 + 52\"}]}, {\"name\": \"mx\", \"source\": \"rows\", \"transform\": [{\"type\": \"aggregate\", \"ops\": [\"max\"], \"fields\": [\"n\"], \"as\": [\"v\"]}]}], \"marks\": [{\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"value\": 14}, \"y\": {\"value\": 18}, \"text\": {\"value\": \"CERTIFICATE LONGEVITY\"}, \"fill\": {\"value\": \"#cccccc\"}, \"fontSize\": {\"value\": 10}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"letterSpacing\": {\"value\": 1.5}}}}, {\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"value\": 14}, \"y\": {\"value\": 34}, \"text\": {\"value\": \"CERTIFICATE LIFETIME \\u2014 short = automated key management \\u00b7 long = manual / legacy\"}, \"fill\": {\"value\": \"#555555\"}, \"fontSize\": {\"value\": 9}, \"font\": {\"value\": \"monospace\"}, \"letterSpacing\": {\"value\": 1}}}}, {\"type\": \"rule\", \"encode\": {\"enter\": {\"x\": {\"value\": 0}, \"x2\": {\"signal\": \"width\"}, \"y\": {\"value\": 42}, \"stroke\": {\"value\": \"#252525\"}, \"strokeWidth\": {\"value\": 1}}}}, {\"type\": \"rect\", \"name\": \"bg\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 0}, \"y\": {\"field\": \"y\"}, \"width\": {\"signal\": \"width\"}, \"height\": {\"value\": 66}, \"fill\": {\"signal\": \"datum.k===sel ? '#1c1c2e' : datum.n>0 ? '#161616' : '#121212'\"}, \"cursor\": {\"value\": \"pointer\"}}}}, {\"type\": \"rect\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 0}, \"y\": {\"field\": \"y\"}, \"width\": {\"value\": 4}, \"height\": {\"value\": 66}, \"fill\": {\"signal\": \"datum.n>0 ? datum.clr : '#2a2a2a'\"}}}}, {\"type\": \"rule\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 0}, \"x2\": {\"signal\": \"width\"}, \"y\": {\"signal\": \"datum.y + 65\"}, \"stroke\": {\"value\": \"#1e1e1e\"}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 14}, \"y\": {\"signal\": \"datum.y + 22\"}, \"text\": {\"field\": \"lbl\"}, \"limit\": {\"signal\": \"width * 0.52\"}, \"fill\": {\"signal\": \"datum.n>0 ? '#e8e8e8' : '#444444'\"}, \"fontSize\": {\"value\": 12}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 14}, \"y\": {\"signal\": \"datum.y + 42\"}, \"text\": {\"field\": \"desc\"}, \"limit\": {\"signal\": \"width * 0.74\"}, \"fill\": {\"value\": \"#555555\"}, \"fontSize\": {\"value\": 9}, \"font\": {\"value\": \"monospace\"}}}}, {\"type\": \"rect\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width * 0.76\"}, \"y\": {\"signal\": \"datum.y + 8\"}, \"width\": {\"value\": 82}, \"height\": {\"value\": 16}, \"cornerRadius\": {\"value\": 2}, \"fill\": {\"signal\": \"datum.n>0 ? datum.bg : '#1a1a1a'\"}, \"stroke\": {\"signal\": \"datum.n>0 ? datum.clr : '#2a2a2a'\"}, \"strokeWidth\": {\"value\": 1}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width * 0.76 + 41\"}, \"y\": {\"signal\": \"datum.y + 20\"}, \"text\": {\"field\": \"mgmt\"}, \"fill\": {\"signal\": \"datum.n>0 ? datum.clr : '#383838'\"}, \"fontSize\": {\"value\": 8}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"center\"}, \"letterSpacing\": {\"value\": 0.8}}}}, {\"type\": \"rect\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width * 0.76\"}, \"y\": {\"signal\": \"datum.y + 28\"}, \"width\": {\"signal\": \"length(data('mx'))>0 && data('mx')[0].v > 0 ? (datum.n / data('mx')[0].v) * 82 : 0\"}, \"height\": {\"value\": 8}, \"cornerRadius\": {\"value\": 2}, \"fill\": {\"signal\": \"datum.clr + '44'\"}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width - 10\"}, \"y\": {\"signal\": \"datum.y + 36\"}, \"text\": {\"signal\": \"datum.n > 0 ? (datum.n >= 1000 ? format(datum.n,'.3~s') : format(datum.n,',')) : '\\u2014'\"}, \"fill\": {\"signal\": \"datum.k===sel ? datum.clr : datum.n>0 ? '#dddddd' : '#333333'\"}, \"fontSize\": {\"value\": 20}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"right\"}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width - 10\"}, \"y\": {\"signal\": \"datum.y + 52\"}, \"text\": {\"signal\": \"datum.tot > 0 && datum.n > 0 ? format(datum.pct * 100, '.1f') + '%' : ''\"}, \"fill\": {\"value\": \"#555555\"}, \"fontSize\": {\"value\": 9}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"right\"}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width / 2\"}, \"y\": {\"signal\": \"height / 2 - 8\"}, \"text\": {\"signal\": \"length(data('raw')) === 0 ? 'NO DATA FOR CURRENT FILTERS / TIME RANGE' : ''\"}, \"fill\": {\"value\": \"#666666\"}, \"font\": {\"value\": \"monospace\"}, \"fontSize\": {\"value\": 11}, \"fontWeight\": {\"value\": \"bold\"}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"zindex\": {\"value\": 100}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width / 2\"}, \"y\": {\"signal\": \"height / 2 + 12\"}, \"text\": {\"signal\": \"length(data('raw')) === 0 ? 'Adjust dashboard filters or expand the selected time range.' : ''\"}, \"fill\": {\"value\": \"#444444\"}, \"font\": {\"value\": \"monospace\"}, \"fontSize\": {\"value\": 9}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"zindex\": {\"value\": 100}}}}]}" + }, + "title": "Certificate Longevity", + "type": "vega", + "uiState": {} + } + }, + "gridData": { + "h": 22, + "i": "d2ae0bd5-2c42-4bb1-a4e7-a80b31524be2", + "w": 24, + "x": 0, + "y": 69 + }, + "panelIndex": "d2ae0bd5-2c42-4bb1-a4e7-a80b31524be2", + "title": "Certificate Longevity", + "type": "visualization" + }, + { + "embeddableConfig": { + "description": "File system disk scan vs live TLS port capture — how each certificate was discovered", + "enhancements": { + "dynamicActions": { + "events": [ + { + "action": { + "config": { + "openInNewTab": false, + "useCurrentDateRange": true, + "useCurrentFilters": true + }, + "factoryId": "DASHBOARD_TO_DASHBOARD_DRILLDOWN", + "name": "Open Inventory" + }, + "eventId": "d14a762a-33a5-545d-9c69-b36b1279da31", + "triggers": [ + "FILTER_TRIGGER" + ] + } + ] + } + }, + "savedVis": { + "data": { + "aggs": [], + "searchSource": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "description": "File system disk scan vs live TLS port capture — how each certificate was discovered", + "id": "", + "params": { + "spec": "{\"$schema\": \"https://vega.github.io/schema/vega/v5.json\", \"padding\": {\"top\": 0, \"bottom\": 0, \"left\": 0, \"right\": 0}, \"background\": \"#111111\", \"signals\": [{\"name\": \"sel\", \"value\": null, \"on\": [{\"events\": {\"type\": \"click\", \"markname\": \"row_bg\"}, \"update\": \"datum.k === sel ? null : datum.k\", \"force\": true}]}, {\"name\": \"_kf\", \"value\": null, \"on\": [{\"events\": {\"type\": \"click\", \"markname\": \"row_bg\"}, \"update\": \"datum.n > 0 ? (datum.k === sel ? kibanaRemoveFilter(datum.filt) : kibanaAddFilter(datum.filt)) : null\", \"force\": true}]}], \"data\": [{\"name\": \"d_fs\", \"url\": {\"index\": \"tychon-pqc-certificates*\", \"body\": {\"size\": 0, \"query\": {\"bool\": {\"must\": [\"%dashboard_context-must_clause%\", {\"range\": {\"@timestamp\": {\"%timefilter%\": true}}}, {\"term\": {\"tychon.type\": \"filesystem\"}}], \"filter\": [\"%dashboard_context-filter_clause%\"], \"must_not\": [\"%dashboard_context-must_not_clause%\"]}}, \"aggs\": {\"v\": {\"value_count\": {\"field\": \"id\"}}}}}, \"format\": {\"property\": \"aggregations.v\"}, \"transform\": [{\"type\": \"formula\", \"as\": \"n\", \"expr\": \"datum.value || 0\"}]}, {\"name\": \"d_port\", \"url\": {\"index\": \"tychon-pqc-inventory*\", \"body\": {\"size\": 0, \"query\": {\"bool\": {\"must\": [\"%dashboard_context-must_clause%\", {\"range\": {\"@timestamp\": {\"%timefilter%\": true}}}, {\"exists\": {\"field\": \"x509.subject.common_name\"}}, {\"term\": {\"tychon.type\": \"cipher\"}}], \"filter\": [\"%dashboard_context-filter_clause%\"], \"must_not\": [\"%dashboard_context-must_not_clause%\"]}}, \"aggs\": {\"v\": {\"value_count\": {\"field\": \"tychon.type\"}}}}}, \"format\": {\"property\": \"aggregations.v\"}, \"transform\": [{\"type\": \"formula\", \"as\": \"n\", \"expr\": \"datum.value || 0\"}]}, {\"name\": \"rows\", \"values\": [{\"k\": \"fs\", \"ord\": 0, \"lbl\": \"File System\", \"badge\": \"DISK\", \"sub\": \"Certificates read from disk \\u2014 PEM/DER files, keystores, application bundles\", \"desc\": \"Found by crawling the local filesystem. Source path is known. These certs may not be actively serving traffic \\u2014 they could be backups, bundled CA roots, or application trust stores.\", \"clr\": \"#448aff\", \"bg\": \"#448aff18\", \"icon\": \"\\u2399\", \"filt\": {\"match_phrase\": {\"tychon.type\": \"filesystem\"}}}, {\"k\": \"port\", \"ord\": 1, \"lbl\": \"Port / Network\", \"badge\": \"NETWORK\", \"sub\": \"Certificates captured live from TLS handshakes on open network ports\", \"desc\": \"Captured during an active TLS scan. These certs are definitely in use serving live traffic. Quantum readiness score and cipher suite are also available for these entries.\", \"clr\": \"#00c853\", \"bg\": \"#00c85318\", \"icon\": \"\\u26a1\", \"filt\": {\"match_phrase\": {\"tychon.type\": \"cipher\"}}}], \"transform\": [{\"type\": \"formula\", \"as\": \"n\", \"expr\": \"datum.k === 'fs' ? (length(data('d_fs'))>0 ? data('d_fs')[0].n : 0) : (length(data('d_port'))>0 ? data('d_port')[0].n : 0)\"}, {\"type\": \"formula\", \"as\": \"y\", \"expr\": \"datum.ord * 134 + 52\"}]}], \"marks\": [{\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"value\": 14}, \"y\": {\"value\": 18}, \"text\": {\"value\": \"CERTIFICATE SOURCE\"}, \"fill\": {\"value\": \"#cccccc\"}, \"fontSize\": {\"value\": 10}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"letterSpacing\": {\"value\": 1.5}}}}, {\"type\": \"text\", \"encode\": {\"enter\": {\"x\": {\"value\": 14}, \"y\": {\"value\": 34}, \"text\": {\"value\": \"HOW CERTIFICATES WERE DISCOVERED \\u2014 file scan vs live TLS capture\"}, \"fill\": {\"value\": \"#555555\"}, \"fontSize\": {\"value\": 9}, \"font\": {\"value\": \"monospace\"}, \"letterSpacing\": {\"value\": 1}}}}, {\"type\": \"rule\", \"encode\": {\"enter\": {\"x\": {\"value\": 0}, \"x2\": {\"signal\": \"width\"}, \"y\": {\"value\": 42}, \"stroke\": {\"value\": \"#252525\"}, \"strokeWidth\": {\"value\": 1}}}}, {\"type\": \"rect\", \"name\": \"row_bg\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 0}, \"y\": {\"field\": \"y\"}, \"width\": {\"signal\": \"width\"}, \"height\": {\"value\": 128}, \"fill\": {\"signal\": \"datum.k === sel ? '#1c1c2e' : '#161616'\"}, \"cursor\": {\"value\": \"pointer\"}}}}, {\"type\": \"rect\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 0}, \"y\": {\"field\": \"y\"}, \"width\": {\"value\": 4}, \"height\": {\"value\": 128}, \"fill\": {\"signal\": \"datum.n > 0 ? datum.clr : '#2a2a2a'\"}}}}, {\"type\": \"rule\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 0}, \"x2\": {\"signal\": \"width\"}, \"y\": {\"signal\": \"datum.y + 127\"}, \"stroke\": {\"value\": \"#1e1e1e\"}}}}, {\"type\": \"rect\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 14}, \"y\": {\"signal\": \"datum.y + 10\"}, \"width\": {\"value\": 56}, \"height\": {\"value\": 18}, \"cornerRadius\": {\"value\": 2}, \"fill\": {\"signal\": \"datum.n > 0 ? datum.bg : '#1a1a1a'\"}, \"stroke\": {\"signal\": \"datum.n > 0 ? datum.clr : '#2a2a2a'\"}, \"strokeWidth\": {\"value\": 1}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 42}, \"y\": {\"signal\": \"datum.y + 23\"}, \"text\": {\"field\": \"badge\"}, \"fill\": {\"signal\": \"datum.n > 0 ? datum.clr : '#333333'\"}, \"fontSize\": {\"value\": 8}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"center\"}, \"letterSpacing\": {\"value\": 0.8}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 78}, \"y\": {\"signal\": \"datum.y + 24\"}, \"text\": {\"field\": \"lbl\"}, \"fill\": {\"signal\": \"datum.n > 0 ? '#e8e8e8' : '#444444'\"}, \"fontSize\": {\"value\": 14}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 14}, \"y\": {\"signal\": \"datum.y + 44\"}, \"text\": {\"field\": \"sub\"}, \"limit\": {\"signal\": \"width * 0.82\"}, \"fill\": {\"value\": \"#666666\"}, \"fontSize\": {\"value\": 9}, \"font\": {\"value\": \"monospace\"}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"value\": 14}, \"y\": {\"signal\": \"datum.y + 64\"}, \"text\": {\"field\": \"desc\"}, \"limit\": {\"signal\": \"width * 0.64\"}, \"fill\": {\"value\": \"#444444\"}, \"fontSize\": {\"value\": 9}, \"font\": {\"value\": \"monospace\"}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width - 10\"}, \"y\": {\"signal\": \"datum.y + 70\"}, \"text\": {\"signal\": \"datum.n > 0 ? (datum.n >= 1000 ? format(datum.n, '.3~s') : format(datum.n, ',')) : '\\u2014'\"}, \"fill\": {\"signal\": \"datum.n > 0 ? datum.clr : '#333333'\"}, \"fontSize\": {\"value\": 32}, \"fontWeight\": {\"value\": \"bold\"}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"right\"}}}}, {\"type\": \"text\", \"from\": {\"data\": \"rows\"}, \"encode\": {\"update\": {\"x\": {\"signal\": \"width - 10\"}, \"y\": {\"signal\": \"datum.y + 88\"}, \"text\": {\"value\": \"certificates\"}, \"fill\": {\"value\": \"#3a3a3a\"}, \"fontSize\": {\"value\": 9}, \"font\": {\"value\": \"monospace\"}, \"align\": {\"value\": \"right\"}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width / 2\"}, \"y\": {\"signal\": \"height / 2 - 8\"}, \"text\": {\"signal\": \"length(data('d_fs')) === 0 ? 'NO DATA FOR CURRENT FILTERS / TIME RANGE' : ''\"}, \"fill\": {\"value\": \"#666666\"}, \"font\": {\"value\": \"monospace\"}, \"fontSize\": {\"value\": 11}, \"fontWeight\": {\"value\": \"bold\"}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"zindex\": {\"value\": 100}}}}, {\"type\": \"text\", \"encode\": {\"update\": {\"x\": {\"signal\": \"width / 2\"}, \"y\": {\"signal\": \"height / 2 + 12\"}, \"text\": {\"signal\": \"length(data('d_fs')) === 0 ? 'Adjust dashboard filters or expand the selected time range.' : ''\"}, \"fill\": {\"value\": \"#444444\"}, \"font\": {\"value\": \"monospace\"}, \"fontSize\": {\"value\": 9}, \"align\": {\"value\": \"center\"}, \"baseline\": {\"value\": \"middle\"}, \"zindex\": {\"value\": 100}}}}]}" + }, + "title": "Certificate Source Type", + "type": "vega", + "uiState": {} + } + }, + "gridData": { + "h": 22, + "i": "ce89de35-28cf-4f8c-82a1-215539f77bad", + "w": 24, + "x": 24, + "y": 69 + }, + "panelIndex": "ce89de35-28cf-4f8c-82a1-215539f77bad", + "title": "Certificate Source Type", + "type": "visualization" + }, + { + "embeddableConfig": { + "description": "Per-cert records sorted by earliest expiry. FILE=disk scan, PORT=live TLS. Paginated server-side — scales to any size.", + "enhancements": { + "dynamicActions": { + "events": [] + } + }, + "grid": {} + }, + "gridData": { + "h": 38, + "i": "3a5ae8e6-acd0-40f9-a6fb-488f44a55e32", + "w": 48, + "x": 0, + "y": 91 + }, + "panelIndex": "3a5ae8e6-acd0-40f9-a6fb-488f44a55e32", + "panelRefName": "panel_3a5ae8e6-acd0-40f9-a6fb-488f44a55e32", + "title": "Certificate Inventory Detail", + "type": "search" + } + ], + "timeRestore": false, + "title": "[TYCHON Quantum Command] Certificate Operations Dashboard", + "version": 3 + }, + "coreMigrationVersion": "8.8.0", + "created_at": "2026-07-20T16:55:14.701Z", + "id": "tychon_quantum_command-d0159137-9139-4a93-85bb-2ac9ddab3982-certificate-operations-dashboard", + "references": [ + { + "id": "tychon_quantum_command-32c01eb5-0d80-4a28-9de7-55b2046f7c45-inventory", + "name": "187d7c49-96d6-43fe-a3d7-ee51f605e0f5:drilldown:DASHBOARD_TO_DASHBOARD_DRILLDOWN:f676853f-014e-5857-89ba-97b22fb271af:dashboardId", + "type": "dashboard" + }, + { + "id": "tychon_quantum_command-443e5928-b1c4-4e07-b0b9-c675dd057e2f-application-report", + "name": "3a8c4d30-8553-4034-91da-f7010ef7b182:drilldown:DASHBOARD_TO_DASHBOARD_DRILLDOWN:4cb43ecb-be8e-5b80-8c8e-32e171de9e03:dashboardId", + "type": "dashboard" + }, + { + "id": "tychon_quantum_command-443e5928-b1c4-4e07-b0b9-c675dd057e2f-application-report", + "name": "3fa6122b-517f-47d6-b194-2fcea3de3332:drilldown:DASHBOARD_TO_DASHBOARD_DRILLDOWN:5e8c06e1-fcf5-5aab-b7bc-c3cdc891baee:dashboardId", + "type": "dashboard" + }, + { + "id": "tychon_quantum_command-02366033-dee4-4ea4-8458-7c8a8b58987e-cost-analysis", + "name": "48d7d98f-27df-4c04-a736-8e772da0b028:drilldown:DASHBOARD_TO_DASHBOARD_DRILLDOWN:c9ef7c09-bbcf-57c7-bcbc-d3fae0140da2:dashboardId", + "type": "dashboard" + }, + { + "id": "tychon_quantum_command-443e5928-b1c4-4e07-b0b9-c675dd057e2f-application-report", + "name": "65669cd8-396b-410c-bc9b-ee3389ef8017:drilldown:DASHBOARD_TO_DASHBOARD_DRILLDOWN:195b2262-1d5d-50e1-86d2-f404cd493030:dashboardId", + "type": "dashboard" + }, + { + "id": "tychon_quantum_command-32c01eb5-0d80-4a28-9de7-55b2046f7c45-inventory", + "name": "ce89de35-28cf-4f8c-82a1-215539f77bad:drilldown:DASHBOARD_TO_DASHBOARD_DRILLDOWN:d14a762a-33a5-545d-9c69-b36b1279da31:dashboardId", + "type": "dashboard" + }, + { + "id": "tychon_quantum_command-02366033-dee4-4ea4-8458-7c8a8b58987e-cost-analysis", + "name": "d2ae0bd5-2c42-4bb1-a4e7-a80b31524be2:drilldown:DASHBOARD_TO_DASHBOARD_DRILLDOWN:8de715c9-8769-51a8-8672-32a3af72a8c7:dashboardId", + "type": "dashboard" + }, + { + "id": "tychon_quantum_command-32c01eb5-0d80-4a28-9de7-55b2046f7c45-inventory", + "name": "df2ef032-250b-40c9-93de-3f6211bddac5:drilldown:DASHBOARD_TO_DASHBOARD_DRILLDOWN:5a19f6d5-01ea-5a0d-9469-870400433156:dashboardId", + "type": "dashboard" + }, + { + "id": "tychon_quantum_command-d7e8f9a0-2b3c-4d5e-9f0a-b1c2d3e40001-certificate-inventory-detail", + "name": "3a5ae8e6-acd0-40f9-a6fb-488f44a55e32:panel_3a5ae8e6-acd0-40f9-a6fb-488f44a55e32", + "type": "search" + }, + { + "id": "tychon_quantum_command-07b6a21f-5bba-413b-8d49-e8c246dde2ba", + "name": "tag-ref-tychon_quantum_command-07b6a21f-5bba-413b-8d49-e8c246dde2ba", + "type": "tag" + }, + { + "id": "tychon_quantum_command-dacb217e-57b4-4296-8545-cbf6b5739344", + "name": "tag-ref-tychon_quantum_command-dacb217e-57b4-4296-8545-cbf6b5739344", + "type": "tag" + }, + { + "id": "tychon_quantum_command-e9b715ba-5f19-4f99-b837-2c1a24143212", + "name": "tag-ref-tychon_quantum_command-e9b715ba-5f19-4f99-b837-2c1a24143212", + "type": "tag" + } + ], + "type": "dashboard", + "typeMigrationVersion": "10.3.0" +} diff --git a/packages/tychon_quantum_command/kibana/index_pattern/05179988-8b3d-4f26-9832-d83a1e769b2d.json b/packages/tychon_quantum_command/kibana/index_pattern/05179988-8b3d-4f26-9832-d83a1e769b2d.json new file mode 100644 index 00000000000..20a41e3ce71 --- /dev/null +++ b/packages/tychon_quantum_command/kibana/index_pattern/05179988-8b3d-4f26-9832-d83a1e769b2d.json @@ -0,0 +1,25 @@ +{ + "attributes": { + "allowHidden": false, + "fieldAttrs": "{\"observer.hostname\":{\"count\":2},\"omb.vulnerability_status\":{\"count\":1},\"process.name\":{\"count\":1},\"tychon.crypto.protocol\":{\"count\":3},\"tychon.index\":{\"count\":18},\"host.hostname\":{\"count\":0},\"omb.crqc_vulnerable_algos\":{\"count\":0},\"omb.module_name\":{\"count\":0},\"omb.pqc_algos\":{\"count\":0},\"omb.software_package_name\":{\"count\":0},\"omb.symmetric_algos\":{\"count\":0},\"certificate.subject\":{\"count\":2},\"tychon.application.connected_to_count\":{\"count\":2},\"destination.ip\":{\"count\":1}}", + "fieldFormatMap": "{}", + "fields": "[]", + "name": "Quantum Resistant Inventory", + "runtimeFieldMap": "{}", + "sourceFilters": "[]", + "timeFieldName": "@timestamp", + "title": "tychon-pqc*" + }, + "coreMigrationVersion": "8.8.0", + "created_at": "2026-06-11T16:06:12.868Z", + "created_by": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0", + "id": "05179988-8b3d-4f26-9832-d83a1e769b2d", + "managed": false, + "originId": "0e56225a-3b03-4f4e-bdbc-2fd59f0ef78c", + "references": [], + "type": "index-pattern", + "typeMigrationVersion": "8.0.0", + "updated_at": "2026-06-11T16:06:12.868Z", + "updated_by": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0", + "version": "WzY1NjEsMzBd" +} diff --git a/packages/tychon_quantum_command/kibana/index_pattern/1dc9d581-4b38-4108-84e1-59a9fbcfbca5.json b/packages/tychon_quantum_command/kibana/index_pattern/1dc9d581-4b38-4108-84e1-59a9fbcfbca5.json new file mode 100644 index 00000000000..fdaeb7f7412 --- /dev/null +++ b/packages/tychon_quantum_command/kibana/index_pattern/1dc9d581-4b38-4108-84e1-59a9fbcfbca5.json @@ -0,0 +1,25 @@ +{ + "attributes": { + "allowHidden": false, + "fieldAttrs": "{\"host.hostname\":{\"count\":1},\"omb.crqc_vulnerable_algos\":{\"count\":1},\"omb.module_name\":{\"count\":1},\"omb.pqc_algos\":{\"count\":2},\"omb.symmetric_algos\":{\"count\":1},\"omb.vulnerability_status\":{\"count\":2},\"omb.software_package_name\":{\"count\":1},\"omb.software_package_version\":{\"count\":1},\"omb.vendor\":{\"count\":1},\"omb.operating_system\":{\"count\":1},\"omb.additional_notes\":{\"count\":1},\"omb.kex_protocols\":{\"count\":1},\"tls.supported_ciphers\":{\"count\":1},\"tls.preferred_key_exchange\":{\"count\":1},\"omb.kex_secondary\":{\"count\":1},\"omb.kem_algorithms\":{\"count\":1},\"omb.kem_parameters\":{\"count\":1},\"omb.dsa_algorithms\":{\"count\":1},\"omb.dsa_parameters\":{\"count\":1},\"omb.dsa_hash_algorithms\":{\"count\":2},\"omb.block_cipher_key_lengths\":{\"count\":1},\"omb.block_cipher_modes\":{\"count\":1},\"crypto.hash_algorithms\":{\"count\":1},\"omb.hash_algorithm_parameters\":{\"count\":1},\"crypto.mac_algorithms\":{\"count\":1},\"omb.mac_algorithm_parameters\":{\"count\":1},\"omb.other_crypto_details\":{\"count\":1},\"omb.certifications\":{\"count\":1},\"cert_total_days\":{\"customLabel\":\"Total Validity\"},\"cert_days_remaining\":{\"customLabel\":\"Days Remaining\"}}", + "fieldFormatMap": "{\"cert_days_remaining\":{\"id\":\"duration\",\"params\":{\"inputFormat\":\"days\",\"outputFormat\":\"humanizePrecise\",\"outputPrecision\":1,\"includeSpaceWithSuffix\":true}},\"cert_total_days\":{\"id\":\"duration\",\"params\":{\"inputFormat\":\"days\",\"outputFormat\":\"humanizePrecise\",\"outputPrecision\":1,\"includeSpaceWithSuffix\":true}}}", + "fields": "[]", + "name": "Quantum Inventory Stats [TYCHON ACDI Direct]", + "runtimeFieldMap": "{\"cert_days_remaining\":{\"type\":\"long\",\"script\":{\"source\":\"long na=0L;if(doc[\\\"certificate.not_after\\\"].size()>0)na=doc[\\\"certificate.not_after\\\"].value.toInstant().toEpochMilli();else if(doc[\\\"x509.not_after\\\"].size()>0)na=doc[\\\"x509.not_after\\\"].value.toInstant().toEpochMilli();if(na==0L)return;emit((na-System.currentTimeMillis())/86400000L);\"}},\"cert_total_days\":{\"type\":\"long\",\"script\":{\"source\":\"long na=0L,nb=0L;if(doc[\\\"certificate.not_after\\\"].size()>0)na=doc[\\\"certificate.not_after\\\"].value.toInstant().toEpochMilli();else if(doc[\\\"x509.not_after\\\"].size()>0)na=doc[\\\"x509.not_after\\\"].value.toInstant().toEpochMilli();if(doc[\\\"certificate.not_before\\\"].size()>0)nb=doc[\\\"certificate.not_before\\\"].value.toInstant().toEpochMilli();else if(doc[\\\"x509.not_before\\\"].size()>0)nb=doc[\\\"x509.not_before\\\"].value.toInstant().toEpochMilli();if(na==0L||nb==0L)return;emit((na-nb)/86400000L);\"}}}", + "sourceFilters": "[]", + "timeFieldName": "@timestamp", + "title": "tychon-pqc-*" + }, + "coreMigrationVersion": "8.8.0", + "created_at": "2026-06-11T16:06:12.868Z", + "created_by": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0", + "id": "1dc9d581-4b38-4108-84e1-59a9fbcfbca5", + "managed": false, + "originId": "ca728b62-2968-45a5-b90b-32e2747056c0", + "references": [], + "type": "index-pattern", + "typeMigrationVersion": "8.0.0", + "updated_at": "2026-06-11T16:06:12.868Z", + "updated_by": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0", + "version": "WzY1NTgsMzBd" +} diff --git a/packages/tychon_quantum_command/kibana/index_pattern/852a2806-9a09-4c17-bcea-b54e7b69f3bc.json b/packages/tychon_quantum_command/kibana/index_pattern/852a2806-9a09-4c17-bcea-b54e7b69f3bc.json new file mode 100644 index 00000000000..0a52209f98b --- /dev/null +++ b/packages/tychon_quantum_command/kibana/index_pattern/852a2806-9a09-4c17-bcea-b54e7b69f3bc.json @@ -0,0 +1,25 @@ +{ + "attributes": { + "allowHidden": false, + "fieldAttrs": "{}", + "fieldFormatMap": "{}", + "fields": "[]", + "name": "Quantum Inventory", + "runtimeFieldMap": "{}", + "sourceFilters": "[]", + "timeFieldName": "@timestamp", + "title": "tychon-pqc-inventory*" + }, + "coreMigrationVersion": "8.8.0", + "created_at": "2026-06-11T16:06:12.868Z", + "created_by": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0", + "id": "852a2806-9a09-4c17-bcea-b54e7b69f3bc", + "managed": false, + "originId": "7eee23b7-ddb2-4c12-ad44-a12d7e8301cf", + "references": [], + "type": "index-pattern", + "typeMigrationVersion": "8.0.0", + "updated_at": "2026-06-11T16:06:12.868Z", + "updated_by": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0", + "version": "WzY1NjMsMzBd" +} diff --git a/packages/tychon_quantum_command/kibana/search/tychon_quantum_command-662602a4-f820-4e80-9fe2-115c951fe43c-dod-omb-report.json b/packages/tychon_quantum_command/kibana/search/tychon_quantum_command-662602a4-f820-4e80-9fe2-115c951fe43c-dod-omb-report.json new file mode 100644 index 00000000000..ca8a6083619 --- /dev/null +++ b/packages/tychon_quantum_command/kibana/search/tychon_quantum_command-662602a4-f820-4e80-9fe2-115c951fe43c-dod-omb-report.json @@ -0,0 +1,172 @@ +{ + "attributes": { + "columns": [ + "observer.hostname", + "omb.vulnerability_status", + "omb.module_name", + "omb.crqc_vulnerable_algos", + "omb.pqc_algos", + "omb.symmetric_algos", + "omb.software_package_name", + "omb.software_package_version", + "omb.vendor", + "omb.operating_system", + "omb.additional_notes", + "omb.kex_protocols", + "tls.supported_ciphers", + "tls.preferred_key_exchange", + "omb.kex_secondary", + "omb.kem_algorithms", + "omb.kem_parameters", + "omb.dsa_algorithms", + "omb.dsa_parameters", + "omb.block_cipher_key_lengths", + "omb.block_cipher_modes", + "crypto.hash_algorithms", + "omb.hash_algorithm_parameters", + "crypto.mac_algorithms", + "omb.mac_algorithm_parameters", + "omb.other_crypto_details", + "omb.certifications", + "@timestamp" + ], + "description": "OMB Report for the Department of Defense", + "grid": { + "columns": { + "omb.additional_notes": { + "width": 241 + } + } + }, + "hideChart": false, + "isTextBasedQuery": false, + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "key": "omb.vulnerability_status", + "negate": false, + "type": "exists", + "value": "exists" + }, + "query": { + "exists": { + "field": "omb.vulnerability_status" + } + } + } + ], + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "" + } + } + }, + "refreshInterval": { + "pause": true, + "value": 60000 + }, + "sort": [ + [ + "@timestamp", + "desc" + ] + ], + "tabs": [ + { + "attributes": { + "columns": [ + "observer.hostname", + "omb.vulnerability_status", + "omb.module_name", + "omb.crqc_vulnerable_algos", + "omb.pqc_algos", + "omb.symmetric_algos", + "omb.software_package_name", + "omb.software_package_version", + "omb.vendor", + "omb.operating_system", + "omb.additional_notes", + "omb.kex_protocols", + "tls.supported_ciphers", + "tls.preferred_key_exchange", + "omb.kex_secondary", + "omb.kem_algorithms", + "omb.kem_parameters", + "omb.dsa_algorithms", + "omb.dsa_parameters", + "omb.block_cipher_key_lengths", + "omb.block_cipher_modes", + "crypto.hash_algorithms", + "omb.hash_algorithm_parameters", + "crypto.mac_algorithms", + "omb.mac_algorithm_parameters", + "omb.other_crypto_details", + "omb.certifications", + "@timestamp" + ], + "grid": { + "columns": { + "omb.additional_notes": { + "width": 241 + } + } + }, + "hideChart": false, + "isTextBasedQuery": false, + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[{\"meta\":{\"alias\":null,\"negate\":false,\"disabled\":false,\"type\":\"exists\",\"key\":\"omb.vulnerability_status\",\"value\":\"exists\",\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\"},\"query\":{\"exists\":{\"field\":\"omb.vulnerability_status\"}},\"$state\":{\"store\":\"appState\"}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + }, + "refreshInterval": { + "pause": true, + "value": 60000 + }, + "sort": [ + [ + "@timestamp", + "desc" + ] + ], + "timeRange": { + "from": "now-24h/h", + "to": "now" + }, + "timeRestore": true + }, + "id": "cc77a3a6-6b3b-4ffc-b6fa-0db060e1091b", + "label": "Untitled" + } + ], + "timeRange": { + "from": "now-24h/h", + "to": "now" + }, + "timeRestore": true, + "title": "DoD OMB Report" + }, + "coreMigrationVersion": "8.8.0", + "created_at": "2026-07-21T14:29:29.805Z", + "id": "tychon_quantum_command-662602a4-f820-4e80-9fe2-115c951fe43c-dod-omb-report", + "references": [ + { + "id": "05179988-8b3d-4f26-9832-d83a1e769b2d", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + }, + { + "id": "05179988-8b3d-4f26-9832-d83a1e769b2d", + "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", + "type": "index-pattern" + } + ], + "type": "search", + "typeMigrationVersion": "10.9.0" +} diff --git a/packages/tychon_quantum_command/kibana/search/tychon_quantum_command-d7e8f9a0-2b3c-4d5e-9f0a-b1c2d3e40001-certificate-inventory-detail.json b/packages/tychon_quantum_command/kibana/search/tychon_quantum_command-d7e8f9a0-2b3c-4d5e-9f0a-b1c2d3e40001-certificate-inventory-detail.json new file mode 100644 index 00000000000..3446b89f85e --- /dev/null +++ b/packages/tychon_quantum_command/kibana/search/tychon_quantum_command-d7e8f9a0-2b3c-4d5e-9f0a-b1c2d3e40001-certificate-inventory-detail.json @@ -0,0 +1,89 @@ +{ + "attributes": { + "columns": [ + "observer.hostname", + "tychon.type", + "x509.subject.common_name", + "certificate.issuer_common_name", + "x509.issuer.common_name", + "omb.sig_tier", + "tychon.crypto.grade", + "cert_days_remaining", + "cert_total_days", + "certificate.not_after", + "x509.not_after", + "certificate.is_self_signed", + "file.path", + "server.ip", + "server.port" + ], + "description": "All certs — FILE (disk scan) and PORT (live TLS). Sorted by earliest expiry. Scales via server-side pagination.", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "highlightAll": true, + "indexRefName": "kibanaSavedObjectMeta.searchSourceJSON.index", + "query": { + "language": "kuery", + "query": "" + }, + "version": true + } + }, + "sort": [ + [ + "cert_days_remaining", + "asc" + ] + ], + "tabs": [ + { + "attributes": { + "columns": [ + "observer.hostname", + "tychon.type", + "x509.subject.common_name", + "certificate.issuer_common_name", + "x509.issuer.common_name", + "omb.sig_tier", + "tychon.crypto.grade", + "cert_days_remaining", + "cert_total_days", + "certificate.not_after", + "x509.not_after", + "certificate.is_self_signed", + "file.path", + "server.ip", + "server.port" + ], + "kibanaSavedObjectMeta": { + "searchSourceJSON": "{\"highlightAll\": true, \"version\": true, \"query\": {\"language\": \"kuery\", \"query\": \"\"}, \"filter\": [], \"indexRefName\": \"kibanaSavedObjectMeta.searchSourceJSON.index\"}" + }, + "sort": [ + [ + "cert_days_remaining", + "asc" + ] + ], + "version": 1 + }, + "id": "b1f91752-530a-4ed7-b9c2-79ff3c3a6653", + "label": "Untitled" + } + ], + "title": "Certificate Inventory Detail", + "version": 1 + }, + "coreMigrationVersion": "8.8.0", + "created_at": "2026-07-21T14:29:29.805Z", + "id": "tychon_quantum_command-d7e8f9a0-2b3c-4d5e-9f0a-b1c2d3e40001-certificate-inventory-detail", + "references": [ + { + "id": "1dc9d581-4b38-4108-84e1-59a9fbcfbca5", + "name": "kibanaSavedObjectMeta.searchSourceJSON.index", + "type": "index-pattern" + } + ], + "type": "search", + "typeMigrationVersion": "10.9.0" +} diff --git a/packages/tychon_quantum_command/kibana/tag/tychon_quantum_command-07b6a21f-5bba-413b-8d49-e8c246dde2ba.json b/packages/tychon_quantum_command/kibana/tag/tychon_quantum_command-07b6a21f-5bba-413b-8d49-e8c246dde2ba.json new file mode 100644 index 00000000000..cbbdf6d97d0 --- /dev/null +++ b/packages/tychon_quantum_command/kibana/tag/tychon_quantum_command-07b6a21f-5bba-413b-8d49-e8c246dde2ba.json @@ -0,0 +1,13 @@ +{ + "attributes": { + "color": "#E7664C", + "description": "PQC Scan Results", + "name": "ACDI" + }, + "coreMigrationVersion": "8.8.0", + "created_at": "2026-07-21T14:29:29.805Z", + "id": "tychon_quantum_command-07b6a21f-5bba-413b-8d49-e8c246dde2ba", + "references": [], + "type": "tag", + "typeMigrationVersion": "8.0.0" +} \ No newline at end of file diff --git a/packages/tychon_quantum_command/kibana/tag/tychon_quantum_command-dacb217e-57b4-4296-8545-cbf6b5739344.json b/packages/tychon_quantum_command/kibana/tag/tychon_quantum_command-dacb217e-57b4-4296-8545-cbf6b5739344.json new file mode 100644 index 00000000000..fd163f93249 --- /dev/null +++ b/packages/tychon_quantum_command/kibana/tag/tychon_quantum_command-dacb217e-57b4-4296-8545-cbf6b5739344.json @@ -0,0 +1,13 @@ +{ + "attributes": { + "color": "#B9A888", + "description": "Updated for the Quantum 2.0.3 schema", + "name": "2.0.3" + }, + "coreMigrationVersion": "8.8.0", + "created_at": "2026-07-21T14:29:29.805Z", + "id": "tychon_quantum_command-dacb217e-57b4-4296-8545-cbf6b5739344", + "references": [], + "type": "tag", + "typeMigrationVersion": "8.0.0" +} \ No newline at end of file diff --git a/packages/tychon_quantum_command/kibana/tag/tychon_quantum_command-e9b715ba-5f19-4f99-b837-2c1a24143212.json b/packages/tychon_quantum_command/kibana/tag/tychon_quantum_command-e9b715ba-5f19-4f99-b837-2c1a24143212.json new file mode 100644 index 00000000000..a09eaeb4186 --- /dev/null +++ b/packages/tychon_quantum_command/kibana/tag/tychon_quantum_command-e9b715ba-5f19-4f99-b837-2c1a24143212.json @@ -0,0 +1,13 @@ +{ + "attributes": { + "color": "#1140c2", + "description": "", + "name": "Quantum Resilient" + }, + "coreMigrationVersion": "8.8.0", + "created_at": "2026-07-21T14:29:29.805Z", + "id": "tychon_quantum_command-e9b715ba-5f19-4f99-b837-2c1a24143212", + "references": [], + "type": "tag", + "typeMigrationVersion": "8.0.0" +} \ No newline at end of file diff --git a/packages/tychon_quantum_command/manifest.yml b/packages/tychon_quantum_command/manifest.yml new file mode 100644 index 00000000000..442ee62f8df --- /dev/null +++ b/packages/tychon_quantum_command/manifest.yml @@ -0,0 +1,55 @@ +format_version: 2.0.0 +name: tychon_quantum_command +title: "TYCHON Quantum Command" +version: 2.0.4 +source: + license: "Elastic-2.0" +description: "Fleet integration for Tychon Quantum Command output." +type: integration +categories: + - security + - os_system +conditions: + kibana.version: "^8.11.0" + elastic.subscription: "basic" +screenshots: + - src: /img/TQC_Inventory.png + title: TYCHON Quantum Command - Inventory + size: 3434x1086 + type: image/png + - src: /img/TQC_Application_Report.png + title: TYCHON Quantum Command - Application Report + size: 3437x1072 + type: image/png + - src: /img/TQC_Application_Detail.png + title: TYCHON Quantum Command - Application Detail + size: 3435x1086 + type: image/png + - src: /img/TQC_Certificate_Report.png + title: TYCHON Quantum Command - Certificate Report + size: 3437x1083 + type: image/png + - src: /img/TQC_Application_Connections_Topology.png + title: TYCHON Quantum Command - Application Connections Topology + size: 3435x1082 + type: image/png + - src: /img/TQC_Cost_Analysis.png + title: TYCHON Quantum Command - Cost Analysis + size: 3438x1082 + type: image/png +icons: + - src: /img/TychonLogo.svg + title: TYCHON + size: 32x32 + type: image/svg+xml +policy_templates: + - name: tychon_quantum_command + title: Tychon Quantum Command + description: Collect TQC output files. + inputs: + - type: filestream + title: Collect TQC output + description: Collect NDJSON or JSON files generated by TQC. +owner: + github: elastic/security-service-integrations + type: partner diff --git a/packages/tychon_quantum_command/validation.yml b/packages/tychon_quantum_command/validation.yml new file mode 100644 index 00000000000..b48d0821f75 --- /dev/null +++ b/packages/tychon_quantum_command/validation.yml @@ -0,0 +1,6 @@ +# validation.yml +docs_structure_enforced: + enabled: true + version: 1 +errors: + exclude_checks: [ "SVR00002" ]