Skip to content

Elastic Dashboard: PQC Vulnerability Analysis

The analyst's deep-dive environment for understanding why connections are classified as quantum-vulnerable — which algorithms, which hosts, and which services are responsible.

See Dashboards Overview for shared conventions, color palette, and data source details.

Purpose

PQC Fleet Posture tells leadership how many connections are vulnerable. This dashboard tells the security team why, by slicing the vulnerable population down by protocol, TLS version, cipher, and key exchange group, and by surfacing the specific source hosts and destination services generating the most exposure. In a fleet of 100,000+ devices, the vulnerable population alone can span tens of thousands of distinct source hosts — manual triage isn't feasible, so every panel here is built as a top-N ranking rather than a full listing, letting a small security team focus on the highest-impact hosts first. A full per-device enumeration is available on Device and Endpoint Crypto Inventory.

Every panel on this dashboard applies a dashboard-level filter of pqc.quantum_safety: "Vulnerable" — everything you see here is already scoped to the vulnerable population.

Panels

Panel Type What It Shows
Priority Tier KPIs 4 KPIs Vulnerable connection counts broken out by pqc.assessment.remediation_priority (Critical / High / Medium / Low), shown side-by-side.
Vulnerability Timeline Stacked area chart Vulnerable connection count over time (default last 30 days), stacked by remediation priority — verifies remediation actions are reducing exposure.
Vulnerable Cipher Breakdown Horizontal bar chart Top 15 tls.cipher values among vulnerable connections — identifies specific cipher configurations to target.
Vulnerable Key Exchange Groups Horizontal bar chart Top 15 pqc.handshake.server_hello.key_share.group values among vulnerable connections — confirms which classical-only groups are driving the classification.
TLS Version Risk Analysis Donut chart tls.version_protocol distribution among vulnerable connections — flags whether legacy TLS 1.2 is a primary driver.
Quantum Readiness Score Distribution Histogram Distribution of pqc.assessment.quantum_readiness_score (0–100, bucketed in 10s) across the vulnerable population — shows severity spread, not just a pass/fail count.
Top Vulnerable Source IPs Data table Top 20 source.ip values by vulnerable-connection count, with top cipher, top key exchange group, and top destination per source — a client-side upgrade priority list.
Top Vulnerable Destination Services Data table Top 20 destination.ip + destination.port pairs by vulnerable-connection count, with top cipher and remediation priority — a server-side remediation list.
Vulnerable Protocol Distribution Vertical bar chart Top 10 network.protocol values among vulnerable connections — helps route findings to the right protocol/service owner.
Latest Vulnerable Connection Log Data table Most recent 50 vulnerable connections, newest first, with full handshake context — for investigating an active incident without querying raw logs.

Data Schema

Field Description
pqc.quantum_safety Base filter for the entire dashboard; every panel is scoped to Vulnerable.
pqc.assessment.remediation_priority Drives the four Priority Tier KPIs and the Vulnerability Timeline stacking.
pqc.assessment.quantum_readiness_score Integer 0–100. Drives the readiness score histogram — lower scores indicate more severe crypto weakness.
tls.cipher Drives the Vulnerable Cipher Breakdown panel and appears as a lookup column in the source/destination tables.
tls.version_protocol Drives the TLS Version Risk donut.
pqc.handshake.server_hello.key_share.group Drives the Vulnerable Key Exchange Groups panel.
network.protocol Drives the Vulnerable Protocol Distribution panel.
source.ip Drives the Top Vulnerable Source IPs table.
destination.ip / destination.port Drive the Top Vulnerable Destination Services table.
@timestamp Drives the Vulnerability Timeline and sorts the Latest Vulnerable Connection Log.

Reading the Dashboard

  • The four Priority Tier KPIs should sum to roughly the Quantum Vulnerable count on Fleet Posture. If they don't, it usually means the two dashboards are looking at different time ranges.
  • Clicking a source IP in the Top Vulnerable Source IPs table filters the entire dashboard to that host — useful for confirming whether a specific device's vulnerability spans multiple destinations (broad exposure) or is isolated to one service (likely a single misconfigured server).
  • The Quantum Readiness Score histogram is for severity triage, not counting. Use the Priority Tier KPIs for counts; use this histogram to see whether the vulnerable population is clustered near "almost safe" or "completely classical."

Back to Elastic Dashboards Overview