Skip to content

Elastic Dashboard: PQC Fleet Posture

The single-pane-of-glass entry point for quantum-readiness monitoring — a NOC- and executive-facing summary of how much of the fleet's TLS traffic is quantum-safe right now, and where it's trending.

See Dashboards Overview for shared conventions, color palette, and data source details.

Purpose

Security leadership needs a fast answer to one question: how many of our active TLS connections are quantum-vulnerable today, and is that number going down? This dashboard aggregates the sniffer's live TLS handshake captures into that answer at fleet scale — potentially hundreds of thousands of devices and millions of daily connections — without requiring anyone to run a query.

It is designed to be displayed continuously on a NOC screen and dropped directly into executive briefings. Every other dashboard in the suite drills down from the posture established here: vulnerability root cause (PQC Vulnerability Analysis), per-device detail (Device and Endpoint Crypto Inventory), and migration velocity (Algorithm Migration Tracker) all start from a number shown here.

Panels

Panel Type What It Shows
Total Connections KPI Count of all captured TLS connections in the selected time range — establishes the scale of what's being observed.
Quantum Vulnerable KPI Count of connections where pqc.quantum_safety is Vulnerable — the size of the remediation population.
Quantum Safe KPI Count of connections where pqc.quantum_safety is Secure — tracks migration progress.
Downgrade Detections KPI Count of connections where pqc.handshake.downgrade_detected is true — surfaces potential active downgrade interference; see Active Threat and Anomaly Detection for investigation tools.
Quantum Safety Breakdown Donut chart Percentage split of Secure / Vulnerable / Unknown connections — the headline posture indicator, colored using the shared quantum-safety palette.
Remediation Priority Distribution Pie chart Connections grouped by pqc.assessment.remediation_priority (Critical / High / Medium / Low / None) — sizes remediation waves. Unlike Vulnerability Analysis, this panel is not filtered to vulnerable traffic, so it also shows the Low and None slices produced by quantum-safe connections.
Protocol Breakdown by Quantum Safety Stacked bar chart Top 10 network.protocol values, stacked by quantum safety status — shows which protocols carry the most vulnerable traffic.
PQC Adoption Trend Stacked area chart pqc.quantum_safety counts over time (default last 30 days) — demonstrates migration velocity.
Key Exchange Groups in Use Horizontal bar chart Top 15 negotiated pqc.handshake.server_hello.key_share.group values — quantifies PQC key exchange algorithm adoption.
TLS Cipher Suite Distribution Horizontal bar chart Top 15 negotiated tls.cipher values across the fleet.
Top Vulnerable Destinations Data table Top 20 destination.ip values by vulnerable-connection count, with top cipher and key exchange group per destination — a ranked remediation starting point.

Data Schema

Field Description
pqc.quantum_safety Overall classification: Secure, Vulnerable, or Unknown. Drives the KPI counters and donut breakdown.
pqc.app_protocol_basis Whether network.protocol was proven by ALPN (alpn) or inferred from a port (port). Filter the Protocol Breakdown to alpn for a view that excludes port guesses. See How the protocol is decided.
pqc.assessment.remediation_priority Critical, High, Medium, Low, or None, ordered by remaining effort rather than alarm — drives the priority pie chart and remediation sequencing. See Remediation priority for what produces each tier.
pqc.handshake.downgrade_detected Boolean. true indicates the client offered PQC key exchange but the server negotiated a classical group.
pqc.handshake.server_hello.key_share.group Negotiated TLS key exchange group — drives the Key Exchange Groups panel.
tls.cipher Negotiated TLS cipher suite — drives the Cipher Suite Distribution panel.
network.protocol Application-layer protocol classification — drives the Protocol Breakdown panel. HTTPS is identified from the negotiated ALPN rather than from port 443 alone, so TLS on 8443/9443 now appears as https where it previously counted as tls. Read alongside pqc.app_protocol_basis.
destination.ip / destination.port Identify the remote endpoint — drive the Top Vulnerable Destinations table.
@timestamp Event time — drives the PQC Adoption Trend time series.

Reading the Dashboard

  • Zero vulnerable connections is the goal, not the default. Track the Quantum Safety Breakdown donut and the PQC Adoption Trend area chart together — the donut is the snapshot, the trend tells you whether the snapshot is improving.
  • Downgrade Detections greater than zero warrants immediate attention. A nonzero count here is not necessarily an attack — it can also indicate a misconfigured server — but it should always be triaged. Pivot to Active Threat and Anomaly Detection for source/destination breakdowns and a live event feed.
  • Top Vulnerable Destinations is the fastest path to a remediation list. It's sorted by connection count, so the top rows represent the highest-leverage servers to upgrade first.

Back to Elastic Dashboards Overview