Skip to content

Splunk Dashboard: Vulnerability Analysis

The detailed vulnerable-traffic workbench for remediation planning: priority counts, vulnerable trends, cipher and key-exchange exposure, protocol distribution, readiness-score distribution, and recent vulnerable connection evidence.

See Splunk Dashboards Overview for suite-wide context and shared terms used across the dashboard set.

Purpose

This dashboard narrows the fleet view down to the connections already classified as Vulnerable and then explains what is making them vulnerable.

Its mix of trend charts, breakdowns, and inventory tables is meant for teams deciding which protocols, ciphers, hosts, or services should be remediated first.

Panels

Panel Type What It Shows
Critical / High / Medium / Low Priority splunk.singlevalue Four separate KPIs that size the remediation queue by priority band.
Vulnerability Timeline splunk.line Shows vulnerable traffic over time, separated by remediation priority.
Vulnerable Cipher Breakdown splunk.bar Ranks the most common TLS ciphers observed in vulnerable connections.
Vulnerable Key Exchange Groups splunk.bar Shows which server-selected groups are most associated with vulnerable traffic.
TLS Version Risk Analysis splunk.pie Summarizes which protocol versions are most common inside vulnerable traffic.
Quantum Resistance Score Distribution splunk.column Buckets readiness scores into risk bands across all events with a valid score.
Vulnerable Protocol Distribution splunk.bar Shows which application or transport protocols dominate vulnerable connections.
Top Vulnerable Source IPs splunk.table Lists the highest-volume vulnerable source hosts together with their observed cipher, group, and destination combinations.
Top Vulnerable Destination Services splunk.table Lists the highest-volume vulnerable services and the combinations driving their exposure.
Latest Vulnerable Connection Log splunk.table Shows the most recent vulnerable combinations, aggregated into one-second buckets.

Data Schema

Field Why It Matters
pqc.quantum_safety Primary filter for most panels; this dashboard is centered on the Vulnerable classification.
pqc.assessment.remediation_priority Defines the priority KPIs and the priority-separated trend view.
tls.cipher Used for cipher exposure analysis and for source and destination evidence tables.
pqc.handshake.server_hello.key_share.group Provides the server-selected key-exchange context behind vulnerable observations.
tls.version_protocol Supports protocol-version risk distribution and recent-event context.
pqc.readiness_score Feeds the readiness-score histogram, which intentionally includes all valid scored events.
source.ip Identifies which source hosts generate the most vulnerable traffic.
destination.ip Identifies which destination services are concentrated remediation targets.

Reading the Dashboard

  • Begin with the four priority KPIs. They tell you whether the current vulnerable traffic is mostly urgent or mostly backlog.
  • Use the cipher, group, TLS-version, and protocol charts together. Any one of them alone shows a symptom; together they show the shape of the cryptographic exposure.
  • Remember that the readiness-score panel is broader than the rest of the dashboard. It includes all events with a valid score, not only vulnerable ones.

Back to Splunk Dashboards Overview