Skip to content

Splunk Dashboard: Compliance and Regulatory Posture

The compliance-oriented dashboard for dashboard-defined CNSA 2.0 posture, deprecated-protocol exposure, approved-cipher rate, compliance trends, control breakdowns, and non-compliant connection evidence.

See Splunk Dashboards Overview for suite-wide context and shared terms used across the dashboard set.

Purpose

This dashboard translates observed connection behavior into a small set of operational compliance proxies so a team can measure progress and identify connection records that need review.

It does not claim to prove full external compliance on its own. Instead, it turns observed traffic into practical compliance-oriented indicators that help teams spot gaps and track progress.

Panels

Panel Type What It Shows
CNSA 2.0 Compliant Connections splunk.singlevalue Shows the percentage of events that are both Secure and TLS 1.3.
Deprecated Protocol Violations splunk.singlevalue Counts connections using TLS 1.0, TLS 1.1, or SSLv3 representations recognized by the dashboard.
FIPS-Approved Cipher Rate splunk.singlevalue Shows the percentage of events using the dashboard-defined approved cipher set.
TLS Version Compliance Distribution splunk.pie Displays the most common observed TLS version values.
Compliance Trend Over Time splunk.line Tracks the dashboard-defined CNSA 2.0 compliance percentage over time against interim and full targets.
Non-Compliant Connection Inventory splunk.table Shows recent connection combinations that fall outside the dashboard's compliance checks.
Compliance by Destination Port splunk.bar Summarizes compliant versus vulnerable counts inside the single destination-port range 0-999.
Cipher Compliance Breakdown splunk.bar Compares approved versus non-approved cipher counts as one control bar.

Data Schema

Field Why It Matters
pqc.quantum_safety Combined with TLS version to build the dashboard-defined CNSA 2.0 compliant condition.
tls.version_protocol Used for the TLS-version distribution, deprecated-protocol KPI, compliance trend, and inventory rule.
tls.cipher Compared against the dashboard's approved-cipher set and shown in the evidence inventory.
destination.port Used for the 0-999 control-range panels and the evidence inventory.
source.ip Part of the non-compliant evidence rows so findings can be traced back to observed clients.
destination.ip Identifies the destination service associated with a non-compliant observation.
pqc.assessment.remediation_priority Carries urgency context into the non-compliant evidence table.

Reading the Dashboard

  • Read the three KPI cards as dashboard proxies, not formal audit conclusions. Each one is intentionally narrower than a real external standard.
  • The trend line is most useful when compared against the two built-in target lines. It shows whether posture is moving toward the dashboard's interim and full thresholds.
  • The non-compliant inventory is the operational handoff view. It is where analysts move from percentage-based posture back to concrete endpoint and cipher combinations.
  • Fleet Posture - provides the broad secure versus vulnerable posture context behind the compliance percentages.
  • Vulnerability Analysis - digs into the vulnerable traffic that often drives non-compliant results.
  • Algorithm Migration Tracker - shows whether improved migration posture is translating into better dashboard-defined compliance.

Back to Splunk Dashboards Overview