Skip to content

Splunk Dashboard: Device and Endpoint Crypto Inventory

The asset-centric dashboard for source hosts and destination services: unique endpoint counts, PQC adoption percentage, per-device posture combinations, client-advertised PQC groups, source-side group usage, and service crypto profiles.

See Splunk Dashboards Overview for suite-wide context and shared terms used across the dashboard set.

Purpose

This dashboard answers the inventory question the posture dashboards cannot: what does the cryptographic profile look like when you pivot from aggregate counts to specific hosts and services.

It is especially useful for remediation planning because it keeps endpoint identity attached to ciphers, key-share groups, and remediation priorities instead of collapsing everything into fleet-level summaries.

Panels

Panel Type What It Shows
Unique Source Hosts splunk.singlevalue Counts distinct observed source.ip values.
Unique Destination Services splunk.singlevalue Counts distinct destination IPs seen in the selected time range.
PQC Adoption Rate splunk.singlevalue Shows the percentage of events classified Secure.
Device Posture Inventory splunk.table Lists source-IP combinations with ciphers, key-share groups, remediation priority, and counts.
Device Risk Distribution splunk.column Shows connection counts by remediation priority category.
Destination Service Crypto Profile splunk.table Lists service-level combinations of endpoint, cipher, group, posture, and connection count.
Client Advertised PQC Groups splunk.bar Expands the client multivalue supported-groups field so each advertised group is counted individually.
Key Exchange Group Usage per Source Segment splunk.column Shows server-selected groups across the highest-volume source IPs.

Data Schema

Field Why It Matters
source.ip Primary identity field for host-centric KPIs, posture rows, and source-side group usage.
destination.ip Primary identity field for the destination-service inventory.
destination.port Used to render the service view as IP > Port combinations.
pqc.quantum_safety Used for PQC adoption rate and to label destination-service posture.
pqc.assessment.remediation_priority Provides risk grouping for device inventory and risk-distribution summaries.
tls.cipher Captures the negotiated cipher associated with a device or service record.
pqc.handshake.server_hello.key_share.group Shows which groups were actually negotiated for each device or service profile.
pqc.handshake.client_hello.supported_groups{} Multivalue client capability field expanded for the advertised-groups chart.

Reading the Dashboard

  • Use the KPI cards to measure inventory breadth, then move straight into the tables when you need exact host or service context.
  • The client-advertised-groups chart is the fastest way to see whether PQC-capable clients are already present in the environment even when negotiated outcomes lag behind.
  • Vulnerability Analysis - explains why some of the device and service combinations here are vulnerable.
  • Algorithm Migration Tracker - shows whether the observed per-device and per-service behavior is shifting toward hybrid and PQC negotiation.
  • Fleet Posture - provides the aggregate posture numbers this inventory decomposes.

Back to Splunk Dashboards Overview