Skip to content

Elastic Dashboard: PQC Fleet Posture

The single-pane-of-glass entry point for quantum-readiness monitoring — a NOC- and executive-facing summary of how much of the fleet's TLS traffic is quantum-safe right now, and where it's trending.

See Dashboards Overview for shared conventions, color palette, and data source details.

Purpose

Security leadership needs a fast answer to one question: how many of our active TLS connections are quantum-vulnerable today, and is that number going down? This dashboard aggregates the sniffer's live TLS handshake captures into that answer at fleet scale — potentially hundreds of thousands of devices and millions of daily connections — without requiring anyone to run a query.

It is designed to be displayed continuously on a NOC screen and dropped directly into executive briefings. Every other dashboard in the suite drills down from the posture established here: vulnerability root cause (PQC Vulnerability Analysis), per-device detail (Device and Endpoint Crypto Inventory), and migration velocity (Algorithm Migration Tracker) all start from a number shown here.

Panels

Panel Type What It Shows
Total Connections KPI Count of all captured TLS connections in the selected time range — establishes the scale of what's being observed.
Quantum Vulnerable KPI Count of connections where pqc.quantum_safety is Vulnerable — the size of the remediation population.
Quantum Safe KPI Count of connections where pqc.quantum_safety is Secure — tracks migration progress.
Downgrade Detections KPI Count of connections where pqc.handshake.downgrade_detected is true — surfaces potential active downgrade interference; see Active Threat and Anomaly Detection for investigation tools.
Quantum Safety Breakdown Donut chart Percentage split of Secure / Vulnerable / Unknown connections — the headline posture indicator, colored using the shared quantum-safety palette.
Remediation Priority Distribution Pie chart Connections grouped by pqc.assessment.remediation_priority (Critical / High / Medium / Low) — sizes remediation waves.
Protocol Breakdown by Quantum Safety Stacked bar chart Top 10 network.protocol values, stacked by quantum safety status — shows which protocols carry the most vulnerable traffic.
PQC Adoption Trend Stacked area chart pqc.quantum_safety counts over time (default last 30 days) — demonstrates migration velocity.
Key Exchange Groups in Use Horizontal bar chart Top 15 negotiated pqc.handshake.server_hello.key_share.group values — quantifies PQC key exchange algorithm adoption.
TLS Cipher Suite Distribution Horizontal bar chart Top 15 negotiated tls.cipher values across the fleet.
Top Vulnerable Destinations Data table Top 20 destination.ip values by vulnerable-connection count, with top cipher and key exchange group per destination — a ranked remediation starting point.

Data Schema

Field Description
pqc.quantum_safety Overall classification: Secure, Vulnerable, or Unknown. Drives the KPI counters and donut breakdown.
pqc.assessment.remediation_priority Critical, High, Medium, or Low — drives the priority pie chart and remediation sequencing.
pqc.handshake.downgrade_detected Boolean. true indicates the client offered PQC key exchange but the server negotiated a classical group.
pqc.handshake.server_hello.key_share.group Negotiated TLS key exchange group — drives the Key Exchange Groups panel.
tls.cipher Negotiated TLS cipher suite — drives the Cipher Suite Distribution panel.
network.protocol Application-layer protocol classification — drives the Protocol Breakdown panel.
destination.ip / destination.port Identify the remote endpoint — drive the Top Vulnerable Destinations table.
@timestamp Event time — drives the PQC Adoption Trend time series.

Reading the Dashboard

  • Zero vulnerable connections is the goal, not the default. Track the Quantum Safety Breakdown donut and the PQC Adoption Trend area chart together — the donut is the snapshot, the trend tells you whether the snapshot is improving.
  • Downgrade Detections greater than zero warrants immediate attention. A nonzero count here is not necessarily an attack — it can also indicate a misconfigured server — but it should always be triaged. Pivot to Active Threat and Anomaly Detection for source/destination breakdowns and a live event feed.
  • Top Vulnerable Destinations is the fastest path to a remediation list. It's sorted by connection count, so the top rows represent the highest-leverage servers to upgrade first.

Back to Elastic Dashboards Overview