Skip to content

Elastic Dashboard: Active Threat and Anomaly Detection

The SOC's real-time detection surface for active PQC downgrade interference — a man-in-the-middle forcing a connection back to classical key exchange, or a misconfigured server silently dropping PQC support.

See Dashboards Overview for shared conventions, color palette, and data source details.

Purpose

The other dashboards in this suite are about inventory and migration posture. This one is about a different threat model: someone actively interfering with PQC negotiation right now. As PQC-capable endpoints roll out across a fleet, adversaries may attempt to force connections to downgrade to classical algorithms — a "harvest now, decrypt later" enabler, or a targeted man-in-the-middle attempt.

The sniffer detects this via pqc.handshake.downgrade_detected, set when a client advertised PQC groups in its ClientHello but the server negotiated a classical group in its response. At fleet scale, a downgrade attack will show up as a statistically small anomaly inside an enormous volume of normal traffic — this dashboard is optimized for pulling that signal out, not for exhaustively reviewing every event. It defaults to a 24-hour window and is built for continuous SOC display with auto-refresh, not for historical analysis.

Panels

Panel Type What It Shows
Downgrade Detection Counter KPI Count of connections with pqc.handshake.downgrade_detected: true in the current window. Displays "NO DOWNGRADE DETECTED" in green at zero, and turns red for any nonzero count — so an empty state can't be mistaken for a broken dashboard.
Unknown Quantum Safety KPI Count of connections where pqc.quantum_safety is Unknown — flags connections the sniffer couldn't fully assess, which at fleet scale can indicate coverage gaps.
Downgrade Event Timeline Line chart Downgrade events at 1-minute granularity over the last 24 hours, including zero-count intervals — used to spot attack spikes or a sustained downgrade condition.
Downgrade Events by Source IP Horizontal bar chart Top 20 source.ip values generating downgrade events — distinguishes a single misconfigured host from a distributed pattern.
Downgrade Events by Destination Data table Top 20 destination.ip + destination.port pairs associated with downgrade events, with event count, top source IP, and top negotiated cipher.
PQC Client vs Classical Server Gap Table Data table Downgrade events with full handshake context — server-negotiated classical group alongside the client's originally-offered PQC groups. Sorted by most recent event per row (see note below). Row limit 50.
Unknown Quantum Safety Connection Log Data table Recent connections classified Unknown, for investigating whether they represent evasion attempts or sniffer coverage gaps. Row limit 50.
Live Downgrade Alert Feed Data table Continuously updating feed (60-second auto-refresh) of the most recent 100 downgrade events with full triage context, including remediation priority.
Downgrade Rate as % of Total Traffic Line chart Downgrade events as a percentage of total traffic over the last 7 days — normalizes for normal day-to-day volume swings so a real rate increase isn't masked by (or mistaken for) a traffic spike.

Why some tables show 'Last Seen' instead of a time histogram

The PQC Client vs Classical Server Gap Table and the Unknown Quantum Safety Connection Log both sort by a max(@timestamp) metric ("last seen") rather than a time-bucketed histogram. An earlier implementation that bucketed these tables by time caused excessive result-set growth against high-volume data and couldn't keep up with real-world traffic. If these tables don't fully meet triage needs in your environment, this is a known area to revisit rather than an oversight.

Data Schema

Field Description
pqc.handshake.downgrade_detected The core detection field. true when the client's ClientHello advertised at least one PQC group and the server's ServerHello selected a classical group. Drives every downgrade-focused panel on this dashboard.
pqc.quantum_safety Drives the Unknown Quantum Safety KPI and connection log.
pqc.handshake.client_hello.supported_groups Client-offered groups — shown in the PQC Client vs Classical Server Gap Table to prove the client was PQC-capable.
pqc.handshake.server_hello.key_share.group Server-negotiated group — shown alongside client-offered groups to make the downgrade visible.
tls.cipher Shown in downgrade event tables and the live alert feed.
tls.version_protocol Shown in the Unknown Quantum Safety Connection Log.
source.ip Drives Downgrade Events by Source IP and appears throughout the downgrade tables.
destination.ip / destination.port Drive Downgrade Events by Destination and appear throughout the downgrade tables.
pqc.assessment.remediation_priority Shown in the Live Downgrade Alert Feed for triage prioritization.
@timestamp Drives the Downgrade Event Timeline and Downgrade Rate trend; used as the sort/recency metric elsewhere.

Reading the Dashboard

  • "NO DOWNGRADE DETECTED" in green is the expected steady state. Treat any red KPI as worth a look, even a single event — but remember a single downgrade at one source-destination pair is often server misconfiguration, not an attack. A pattern across multiple destinations from the same source, or multiple sources hitting the same destination, is the stronger indicator of active interference.
  • Downgrade counts are expected to be a very small fraction of total traffic in a large fleet — often well under 1%. Use the Downgrade Rate as % of Total Traffic panel, not the raw event count, to judge whether a spike is a genuine rate increase or just a traffic-volume swing.
  • This dashboard is paired with a Kibana alerting rule (a separate saved object, not a dashboard panel) that fires when downgrade events exceed a threshold within a 15-minute window. That threshold needs to be calibrated against your own environment's baseline downgrade rate — a threshold tuned for a small pilot will generate false positives once the fleet reaches full scale.
  • Auto-refresh matters here more than on other dashboards. Set it to 60 seconds for continuous SOC display; the Live Downgrade Alert Feed and timeline are designed around that refresh cadence.

Back to Elastic Dashboards Overview