Skip to content

Splunk Dashboard: Fleet Posture

The executive starting point for the Splunk suite: a fleet-wide view of connection volume, Quantum Resistance posture, downgrade detections, network-protocol mix, remediation priority, and the destinations contributing most to vulnerable traffic.

See Splunk Dashboards Overview for suite-wide context and shared terms used across the dashboard set.

Purpose

This dashboard summarizes observed connection events across the selected time range so a team can answer two first-order questions quickly: how much traffic is visible, and how much of it is still quantum-vulnerable.

From there it branches into distribution and drill-down panels that explain why the posture looks the way it does: protocol mix, key-share selection, cipher usage, remediation-priority mix, and the highest-volume vulnerable destinations.

Panels

Panel Type What It Shows
Total Connections splunk.singlevalue Primary fleet-wide connection KPI for the selected window.
Quantum Vulnerable splunk.singlevalue Counts events whose pqc.quantum_safety classification is Vulnerable.
Quantum Resistant splunk.singlevalue Counts events classified Secure, presented to users as Quantum Resistant.
Downgrade Detections splunk.singlevalue Counts connections flagged as downgrade detections.
Quantum Resistance Distribution splunk.pie Shows how connection volume divides across the leading Quantum Resistance classes.
Remediation Priority Distribution splunk.pie Sizes the work queue by priority tier rather than by endpoint inventory.
Quantum Resistance by Network Protocol splunk.column Breaks posture down by the highest-volume observed network protocols.
Quantum Resistance Trend splunk.area Shows whether posture is improving, worsening, or simply following traffic cycles over time.
Server Key Share Groups splunk.bar Highlights which server-negotiated key-share groups dominate current traffic.
TLS Cipher Usage splunk.bar Surfaces the most common negotiated ciphers in the observed fleet.
Top Vulnerable Destinations splunk.table Combines destination IP, leading ciphers, and key-share groups for the highest-volume vulnerable services.

Data Schema

Field Why It Matters
pqc.quantum_safety Drives the resistant/vulnerable split, the posture trend, and the protocol breakdown.
pqc.pqc_downgrade_detected Identifies connections flagged as downgrade detections.
pqc.assessment.remediation_priority Used to turn vulnerable traffic into remediation workload categories.
network.protocol Explains which application or transport protocols are carrying secure versus vulnerable traffic.
pqc.handshake.server_hello.key_share.group Shows what the server actually negotiated for key exchange.
tls.cipher Used for cipher inventory and for vulnerable-destination drill-down.
destination.ip Identifies which services are contributing most to vulnerable exposure.

Reading the Dashboard

  • Start with the four KPIs as the posture headline. If the vulnerable count is high or the downgrade counter is nonzero, the rest of the dashboard helps explain why.
  • Use the trend and distribution panels together. A stable distribution with rising total traffic means growth without a posture shift; a changing distribution means the fleet mix itself is moving.
  • Treat Top Vulnerable Destinations as the handoff into deeper analysis. It points directly to the services you would investigate next in Vulnerability Analysis or Device and Endpoint Crypto Inventory.

Back to Splunk Dashboards Overview