Skip to content

Elastic Dashboard: Algorithm Migration Tracker

The program-management view of PQC migration — tracking velocity from classical, to hybrid, to pure post-quantum key exchange across the fleet, not just a point-in-time snapshot.

See Dashboards Overview for shared conventions, color palette, and data source details.

Purpose

Migrating a large enterprise or federal network to NIST-standardized post-quantum algorithms is a multi-year program touching every endpoint, server, and piece of network gear. Program managers and security leads don't just need to know the current PQC adoption percentage — they need to know whether it's moving, how fast, and which servers are the long pole. This dashboard is built as the primary reporting tool for that program office, and its charts are designed to be exported directly into quarterly posture reports for leadership and regulators.

Where PQC Fleet Posture shows a snapshot, this dashboard shows a trajectory: the shift of the fleet's negotiated key exchange groups from classical-only, to hybrid (classical + PQC combined, such as X25519MLKEM768), to pure PQC, tracked over a 90-day default window.

Panels

Panel Type What It Shows
PQC Adoption Rate KPI Percentage of connections where pqc.quantum_safety is Secure — the program's headline progress number against the CNSA 2.0 target.
TLS 1.3 Adoption Rate KPI Percentage of connections using tls.version_protocol: "TLSv1.3" — tracks Phase 1 of migration, since PQC key exchange groups require TLS 1.3.
Algorithm Migration Timeline Stacked area chart Top 8 pqc.handshake.server_hello.key_share.group values over time (default last 90 days) — visualizes the classical-to-hybrid-to-PQC shift as it happens.
Classical vs Hybrid vs PQC Breakdown Donut chart Connections bucketed into Classical Only, Hybrid PQC, and Pure PQC based on the negotiated key exchange group — a three-phase snapshot of where the fleet sits.
Key Exchange Algorithm Inventory Table Data table Every pqc.handshake.server_hello.key_share.group value observed (top 30), with connection count, percentage of total, and quantum-safety status — the definitive algorithm inventory for the migration workplan.
PQC-Enabled Destinations Data table Top 50 destination.ip + destination.port pairs already negotiating PQC or hybrid key exchange — reference configurations to model remaining server migrations on.
Deprecated Algorithm Usage Horizontal bar chart Top 20 tls.cipher values among vulnerable connections — the deprecation timeline starting point for algorithms still seen in production.
Client-Server PQC Gap Analysis Data table Connections where the client advertised an ML-KEM-capable group in pqc.handshake.client_hello.supported_groups but the connection was still classified Vulnerable — identifies servers actively blocking already-PQC-capable clients.
Migration Velocity Trend Line chart PQC adoption percentage over time (default last 90 days) with an 80% "CNSA 2.0 Target" reference line — the chart used to project when the fleet reaches the compliance target.

Data Schema

Field Description
pqc.quantum_safety Drives the PQC Adoption Rate KPI, Migration Velocity Trend, and Deprecated Algorithm Usage filter.
pqc.handshake.server_hello.key_share.group The core migration-tracking field. Classified into three tiers: Pure PQC (mlkem512/768/1024, ML-KEM-*), Hybrid PQC (X25519MLKEM768 and similar classical+PQC combinations), and Classical Only (everything else — x25519, P-256, P-384, P-521, etc.). Drives the Migration Timeline, Classical/Hybrid/PQC donut, and Algorithm Inventory table.
pqc.handshake.client_hello.supported_groups Client-advertised key exchange groups — drives the Client-Server PQC Gap Analysis panel, filtered for groups containing MLKEM.
tls.version_protocol Drives the TLS 1.3 Adoption Rate KPI.
tls.cipher Drives the Deprecated Algorithm Usage panel.
destination.ip / destination.port Drive the PQC-Enabled Destinations and Client-Server PQC Gap Analysis tables.
@timestamp Drives the Migration Timeline and Migration Velocity Trend charts.

Reading the Dashboard

  • Hybrid is not the finish line — pure PQC is. The Classical vs Hybrid vs PQC donut and the Migration Timeline both distinguish hybrid groups (like X25519MLKEM768) from pure-PQC groups, because a program can look "PQC-adopted" by connection count while still running in hybrid mode everywhere. Use the Key Exchange Algorithm Inventory Table to see the exact split.
  • Client-Server PQC Gap Analysis is the fastest way to find blocking servers. A destination showing up here means clients are already capable — the server, not the client fleet, is the remaining work item.
  • PQC-Enabled Destinations doubles as a template list. These are servers that have already been migrated successfully; their TLS configuration is a reasonable starting point for migrating the rest of the server estate.
  • The 80% reference line on Migration Velocity Trend marks the CNSA 2.0 full-adoption target, not 100% — CNSA 2.0 guidance treats 80% as the practical full-migration threshold given long-tail legacy systems.

Back to Elastic Dashboards Overview