Skip to content

Splunk Dashboard: Active Threat and Anomaly Detection

The SOC-facing dashboard for downgrade detections, unresolved Quantum Resistance classifications, and recent evidence that a client offered PQC-capable groups but the observed connection still negotiated down to a classical outcome.

See Splunk Dashboards Overview for suite-wide context and shared terms used across the dashboard set.

Purpose

This dashboard is not a general posture screen. It is tuned to help an analyst decide whether downgrade behavior is isolated noise, a misconfiguration pattern, or evidence of active interference.

It also tracks Unknown classifications because unresolved assessments can hide blind spots, parser gaps, or traffic patterns that deserve investigation even when they are not confirmed downgrade events.

Panels

Panel Type What It Shows
Active Downgrade Detections splunk.singlevalue Counts events whose normalized downgrade flag is Boolean true.
Unknown Classification splunk.singlevalue Counts events where pqc.quantum_safety is Unknown.
Downgrade Event Timeline splunk.line Shows how downgrade activity rises or falls over time.
Downgrade Events by Source IP splunk.bar Ranks the source addresses generating the most downgrade-detected traffic.
Downgrade Events by Destination splunk.table Summarizes the highest-volume destination services together with a representative top source and negotiated cipher.
PQC Client vs Classical Server Gap Table splunk.table Shows cases where the client advertised PQC-capable groups but the observed result remained classical.
Unknown Quantum Resistance Connection Log splunk.table Provides recent evidence for events the sniffer could not confidently classify.
Live Downgrade Alert Feed splunk.table Presents the most recent downgrade evidence for investigation.
Downgrade Rate as % of Total Traffic splunk.line Normalizes downgrade detections against total traffic so rate changes are visible even when raw volume changes.

Data Schema

Field Why It Matters
pqc.pqc_downgrade_detected Core downgrade indicator used throughout the dashboard.
pqc.quantum_safety Drives the Unknown Classification KPI and the unresolved-connection log.
pqc.handshake.client_hello.supported_groups{} Multivalue field used to prove the client advertised PQC-capable groups.
pqc.handshake.server_hello.key_share.group Shows what the server ultimately selected during suspect negotiations.
source.ip Used to distinguish isolated clients from broad source-side patterns.
destination.ip Used to identify affected services and likely investigation targets.
destination.port Important for the destination-service view and the low-port operational focus in evidence tables.
tls.cipher Adds negotiated-cipher context to downgrade investigations.

Reading the Dashboard

  • Treat the two KPI counters as triage gates. A nonzero downgrade count means the rest of the dashboard should be reviewed immediately; a high Unknown count means classification coverage itself may need attention.
  • Compare the timeline with the rate chart. A spike in raw counts during a broader traffic spike may be less interesting than a smaller spike that sharply raises the downgrade percentage.
  • Use the evidence tables to move from pattern to proof. The gap table and live feed preserve the endpoint, cipher, and negotiated-group context needed for a real incident review.

Back to Splunk Dashboards Overview