Elastic Dashboards Overview

Release Details

Release Version: 1.0.0.2 Release Date: 07/27/2026

This is the initial Elastic dashboard release for this product. It introduces the first reference dashboard set for fleet posture, vulnerability analysis, device inventory, migration tracking, compliance review, and active threat detection.

Six purpose-built Kibana dashboards turn ACDI Sniffer connection telemetry into fleet-wide post-quantum cryptography (PQC) situational awareness, from an executive summary down to per-device and per-connection detail.

Each dashboard answers a different question a security team asks about quantum-readiness. This page explains how they fit together, where their data comes from, and the conventions shared across all six. Use the individual dashboard pages for panel-by-panel detail, field schema, and interpretation guidance.

The Dashboard Suite

#	Dashboard	Primary Audience	Answers
1	PQC Fleet Posture	Executives, NOC	What is our overall quantum-safety posture right now?
2	PQC Vulnerability Analysis	Security analysts	Which algorithms, hosts, and services are driving our vulnerable connections?
3	Device and Endpoint Crypto Inventory	Asset managers, network engineers	What is the crypto profile of each individual device and service?
4	Algorithm Migration Tracker	Program managers	How fast are we moving from classical to hybrid to pure-PQC algorithms?
5	Compliance and Regulatory Posture	Compliance officers, auditors	Are we meeting CNSA 2.0, FIPS, and related regulatory requirements?
6	Active Threat and Anomaly Detection	SOC analysts	Is someone actively forcing our connections to downgrade away from PQC right now?

Dashboard 1 (Fleet Posture) is the entry point — it is designed for NOC screens and executive briefings, and every other dashboard drills into a specific slice of the posture it establishes.

Data Source

All six dashboards read from the same underlying data:

Item	Value
Data stream	logs-tychon.pqc.sniffer-default-*
Ingest pipeline	tychon-pqc-sniffer-parser — parses the raw NDJSON message field into indexed fields
Component template	logs-tychon.pqc.sniffer@custom
Collection agent	Elastic Agent (Filebeat) monitoring the sniffer's offline NDJSON output
Kibana space	pqc-stand-alone (not visible in the default space)

Field names on these pages reflect the ingest pipeline, not raw NDJSON

The tychon-pqc-sniffer-parser pipeline normalizes some sniffer output fields before indexing — for example, pqc.handshake.downgrade_detected here corresponds to the sniffer's own pqc.pqc_downgrade_detected field described in the NDJSON Schema Reference. If you set up your own Elastic Agent ingestion using the generic steps in Elastic Agent Integration (no custom pipeline), your indexed field names will match the raw NDJSON schema instead of the names shown on these dashboard pages. Contact your TYCHON deployment team for the ingest pipeline definition if you want field-for-field parity with the reference dashboards.

Shared Conventions

Quantum safety color palette — used consistently across every dashboard panel that breaks data down by pqc.quantum_safety:

Status	Color
Secure	Green (#017d73)
Vulnerable	Red (#bd271e)
Unknown	Gray (#98a2b3)

Remediation priority tiers — Critical / High / Medium / Low, generally colored red / orange / yellow / green, used to size and sequence remediation work across the fleet.

Enterprise scale — every dashboard is designed against fleets of 100,000 to 500,000+ devices generating tens of millions of connection records per day. That scale shapes several recurring design choices you'll see called out on individual pages:

• Panels use top-N aggregations (top 20, top 50, top 500) rather than full enumeration, with CSV export available where a complete list matters (audit evidence, full device inventory).
• Cardinality counts (unique device counts) use a tuned precision_threshold rather than exact counts, since exact cardinality across hundreds of thousands of values is not practical to compute on every dashboard load.
• Default time ranges vary by use case: 24 hours for SOC/threat detection, 7 days for device inventory, 30 days for general posture and compliance, 90 days for migration trend reporting.

Data Schema Reference

Every dashboard panel is built on top of the same connection-record schema documented in the NDJSON Schema Reference. The fields most relevant to these dashboards are the PQC assessment, TLS handshake, and conversation fields — pqc.quantum_safety, pqc.assessment.remediation_priority, tls.cipher, tls.version_protocol, pqc.handshake.server_hello.key_share.group, pqc.handshake.client_hello.supported_groups, source.ip, and destination.ip/destination.port. Each dashboard page documents the specific fields its panels use and why.