Skip to content

Splunk Dashboard: Algorithm Migration Tracker

The migration-progress dashboard for PQC adoption percentage, TLS 1.3 adoption, negotiated-group trends, algorithm-class breakdown, key-exchange inventory, PQC-enabled destinations, vulnerable cipher usage, and client-server PQC negotiation gaps.

See Splunk Dashboards Overview for suite-wide context and shared terms used across the dashboard set.

Purpose

This dashboard focuses on transition state. Instead of only asking whether traffic is secure today, it asks how far the environment has moved from classical-only negotiation toward hybrid and pure-PQC outcomes.

It is therefore useful for program and architecture tracking, where percentage movement and negotiated-group mix matter as much as raw vulnerable counts.

Panels

Panel Type What It Shows
PQC Adoption Rate splunk.singlevalue Shows the percentage of events classified Secure.
TLSv1.3 Adoption Rate splunk.singlevalue Shows the percentage of events using TLS 1.3 representations.
Algorithm Migration Timeline splunk.area Tracks observed server-negotiated key-share groups over time.
Classical vs Hybrid vs PQC Breakdown splunk.pie Buckets observed traffic into classical-only, hybrid, and pure-PQC classes.
Key Exchange Algorithm Inventory Table splunk.table Lists observed key-share groups, counts, share of total, and associated Quantum Resistance status.
PQC-Enabled Destinations splunk.table Shows secure destination-service combinations together with negotiated group and TLS version.
Deprecated Algorithm Usage splunk.bar Ranks ciphers still associated with vulnerable traffic.
Client-Server PQC Gap Analysis splunk.table Shows vulnerable cases where the client advertised recognized PQC-capable groups but the result stayed classical.
Migration Velocity Trend splunk.line Tracks the percentage of secure events against the dashboard's 80 percent target line.

Data Schema

Field Why It Matters
pqc.quantum_safety Used for adoption percentage, classical-versus-PQC classification, and target tracking.
tls.version_protocol Used for TLS 1.3 adoption and PQC-enabled destination context.
pqc.handshake.server_hello.key_share.group Core migration field for timeline, class breakdown, inventory, and destination context.
tls.cipher Used for the deprecated-usage view and to characterize vulnerable residual traffic.
destination.ip Identifies services already observed negotiating secure traffic.
destination.port Completes the service identity for PQC-enabled destinations and client-server gap analysis.
pqc.handshake.client_hello.supported_groups{} Multivalue client capability field used to detect negotiation gaps between client offers and server outcomes.

Reading the Dashboard

  • Use the two KPI cards and the velocity trend together. They show whether the environment is actually moving toward the target, not just producing isolated secure traffic.
  • The migration timeline and class donut explain the shape of that movement. A growing secure rate with mostly hybrid outcomes tells a different story than a growing pure-PQC share.
  • The client-server gap table is the place to look when client capability appears ahead of server support. It turns migration lag into concrete service-level evidence.

Back to Splunk Dashboards Overview