NDJSON Schema Reference

This page describes the fields emitted in each offline NDJSON connection record.

The sniffer writes ECS-style JSON with a custom pqc.* namespace for quantum-safety and handshake details. Fields are omitted when the related protocol data was not observed or could not be parsed.

Record Shape

Each line is one complete JSON object:

{
  "@timestamp": "2026-05-11T18:40:13.141Z",
  "event": {},
  "source": {},
  "destination": {},
  "network": {},
  "observer": {},
  "pqc": {}
}

Protocol-specific objects such as tls, ssh, quic, and tcp are present only when that information is available.

Core Fields

Field	Type	Description
@timestamp	string	Event timestamp in ISO-8601 UTC format.
event.id	string	Connection identifier.
event.category	array[string]	ECS category; currently includes network.
event.type	array[string]	ECS event type; currently includes connection and protocol.
event.kind	string	ECS event kind; currently event.
event.dataset	string	Dataset name; currently pqc.network.
event.duration	integer	Connection duration in nanoseconds when available.
tags	array[string]	Optional tags, typically including the customer ID.

Conversation Fields

These are the fields most useful for top-talkers, port grouping, and address grouping.

Field	Type	Description
source.ip	string	Source IP address.
source.port	integer	Source transport port.
source.bytes	integer	Bytes observed from source to destination.
source.packets	integer	Packets observed from source to destination.
destination.ip	string	Destination IP address.
destination.port	integer	Destination transport port.
destination.bytes	integer	Bytes observed from destination to source.
destination.packets	integer	Packets observed from destination to source.
network.transport	string	Transport protocol, such as tcp or udp.
network.protocol	string	Application/protocol classification, such as tls, quic, ssh, or http.
network.bytes	integer	Sum of source and destination bytes.
network.packets	integer	Sum of source and destination packets.
network.community_id	string	Optional community ID when available.
tcp.state	string	TCP state when tracked.
tcp.client_isn	integer	Optional client initial sequence number.
tcp.server_isn	integer	Optional server initial sequence number.

TLS Fields

Field	Type	Description
tls.version_protocol	string	Negotiated TLS version label: TLSv1.3, TLSv1.2, TLSv1.1, TLSv1.0, SSLv3, or Unknown.
tls.cipher	string	Negotiated cipher suite name when known.
tls.client.server_name	string	Client SNI value when present.
tls.next_protocol	string	Negotiated ALPN protocol when present.
tls.client_offered_pqc_kex	string	Comma-separated PQC KEX algorithms offered by the client when detected.
tls.established	boolean	Whether the TLS connection was established.

TLS Handshake Fields

TLS parser details are emitted under pqc.handshake.* so quantum-safety consumers can keep crypto evidence with the assessment.

Field	Type	Description
pqc.handshake.client_hello.version	string	ClientHello version.
pqc.handshake.client_hello.ciphersuites	array[string]	Client-offered cipher suites.
pqc.handshake.client_hello.compression_methods	array[integer]	Client-offered compression methods.
pqc.handshake.client_hello.supported_groups	array[string]	Client-offered supported groups/key-share groups. Known values are emitted as names; unmapped values fall back to hex.
pqc.handshake.client_hello.signature_algorithms	array[string]	Client-offered signature algorithms. Known values are emitted as names; unmapped values fall back to hex.
pqc.handshake.client_hello.alpn_protocols	array[string]	Client-offered ALPN protocols.
pqc.handshake.client_hello.supported_versions	array[string]	Client-offered TLS versions.
pqc.handshake.server_hello.version	string	ServerHello version.
pqc.handshake.server_hello.selected_ciphersuite	string	Selected cipher suite name, or hex value if unknown.
pqc.handshake.server_hello.selected_alpn	string	Selected ALPN protocol.
pqc.handshake.server_hello.key_share.group	string	Selected TLS 1.3 key-share group.
pqc.handshake.server_hello.key_share.key_exchange_length	integer	Selected key-share length.
pqc.handshake.server_key_exchange.kex_type	string	TLS 1.0-1.2 key exchange type, such as ECDHE or DHE.
pqc.handshake.server_key_exchange.curve_name	string	ECDHE curve name when available.
pqc.handshake.server_key_exchange.public_key_length	integer	ECDHE public key length.
pqc.handshake.server_key_exchange.dh_p_length	integer	DHE prime modulus length.
pqc.handshake.server_key_exchange.dh_g_length	integer	DHE generator length.
pqc.handshake.server_key_exchange.dh_Ys_length	integer	DHE public value length.
pqc.handshake.key_exchange_algorithm	string	Parsed key exchange algorithm.
pqc.handshake.signature_algorithm	string	Parsed signature algorithm.
pqc.handshake.encryption_algorithm	string	Parsed encryption algorithm.
pqc.handshake.ciphersuite_name	string	Parsed cipher suite name.
pqc.handshake.client_offered_pqc_kex	string	PQC KEX algorithms offered by the client.
pqc.handshake.kex_quantum_safe	string	KEX component safety: Safe, Vulnerable, or Unknown.
pqc.handshake.sig_quantum_safe	string	Signature component safety: Safe, Vulnerable, or Unknown.
pqc.handshake.enc_quantum_safe	string	Encryption component safety: Safe, Vulnerable, or Unknown.

PQC Assessment Fields

Field	Type	Description
pqc.quantum_safety	string	Overall classification: Safe, Vulnerable, or Unknown. Unknown/unmapped TLS cipher suites or key-share groups produce Unknown rather than being treated as vulnerable classical crypto.
pqc.readiness_score	integer	Readiness score from 0 to 100.
pqc.has_pqc_kex	boolean	Whether PQC key exchange was detected.
pqc.has_pqc_sig	boolean	Whether a PQC signature algorithm was detected.
pqc.pqc_kex_is_hybrid	boolean	Whether the PQC KEX is hybrid.
pqc.pqc_sig_is_hybrid	boolean	Whether the PQC signature is hybrid.
pqc.pqc_downgrade_detected	boolean	Whether downgrade behavior was detected.
pqc.pqc_kex_algorithm	string	Detected PQC KEX algorithm.
pqc.pqc_sig_algorithm	string	Detected PQC signature algorithm.
pqc.vulnerability_reason	string	Human-readable reason for a vulnerable or unknown classification.
pqc.assessment.overall_safety	string	Detailed overall assessment.
pqc.assessment.vulnerability_score	integer	Vulnerability score from 0 to 100.
pqc.assessment.vulnerable_components	array[string]	Components contributing to vulnerability.
pqc.assessment.recommended_algorithms	array[string]	Suggested safer algorithms.
pqc.assessment.remediation_priority	string	Priority label such as High, Medium, or Low.
pqc.assessment.assessed_at	string	Assessment timestamp in ISO-8601 UTC format.

SSH Fields

Field	Type	Description
ssh.client.protocol_version	string	Client SSH protocol version.
ssh.client.software_version	string	Client SSH software version.
ssh.client.comments	string	Optional client banner comments.
ssh.client.kex_algorithms	array[string]	Client-offered SSH KEX algorithms.
ssh.server.protocol_version	string	Server SSH protocol version.
ssh.server.software_version	string	Server SSH software version.
ssh.server.comments	string	Optional server banner comments.
ssh.selected_kex_algorithm	string	Selected SSH KEX algorithm.
ssh.has_pqc_kex	boolean	Whether SSH PQC KEX was detected.
ssh.kex_quantum_safe	string	SSH KEX safety classification.

QUIC Fields

Field	Type	Description
quic.version	string	Parsed QUIC version.

Observer Fields

Field	Type	Description
observer.name	string	Sniffer ID/name.
observer.type	string	Observer type; currently sniffer.
observer.vendor	string	Vendor name; currently Tychon.
observer.product	string	Product name.

Dashboard Notes

For top-talkers grouped by port, address, and KEX method, use:

• Port: destination.port, with source.port available for client-side grouping.
• Address: source.ip and destination.ip.
• Conversation count: count records or unique event.id values, depending on the aggregation window.
• KEX method: prefer pqc.handshake.key_exchange_algorithm; fallback to pqc.handshake.server_hello.key_share.group for TLS 1.3 key-share group detail.
• Safety: use pqc.quantum_safety for the overall connection classification.