Splunk Dashboards Overview¶
Release Details
This dashboard suite provides Splunk Dashboard Studio views for posture, threat detection, vulnerability analysis, device inventory, compliance review, and migration tracking.
Six Splunk Dashboard Studio dashboards turn indexed sniffer connection telemetry into operational views for posture, threat hunting, vulnerability analysis, device inventory, compliance review, and migration tracking.
Use this overview to understand how the suite fits together, then open the individual dashboard pages for panel descriptions, field usage, and interpretation guidance.
The Dashboard Suite¶
| # | Dashboard | Primary Audience | Answers |
|---|---|---|---|
| 1 | Fleet Posture | Executives, NOC | What does overall quantum-resistance posture look like across the fleet? |
| 2 | Active Threat and Anomaly Detection | SOC analysts | Are downgrade detections or unresolved classifications showing active risk right now? |
| 3 | Vulnerability Analysis | Security analysts | Which vulnerable algorithms, hosts, and services are driving remediation work? |
| 4 | Device and Endpoint Crypto Inventory | Asset owners, network engineers | What cryptographic posture is visible per source host and destination service? |
| 5 | Compliance and Regulatory Posture | Compliance officers, auditors | How do observed connections map to the suite's CNSA 2.0, deprecated-protocol, and approved-cipher checks? |
| 6 | Algorithm Migration Tracker | Program managers, architecture teams | How quickly is the fleet moving from classical cryptography toward hybrid and PQC negotiation? |
Fleet Posture is the entry point. The other five dashboards narrow in on one part of the story: active downgrade activity, vulnerable exposure, per-asset detail, compliance evidence, or migration progress.
Data Source¶
All six dashboards read from the same Splunk dataset:
| Item | Value |
|---|---|
| Platform | Splunk Dashboard Studio (grid layout) |
| Base search | index=tychon-sniffer sourcetype="pqc:connections" |
| Event handling | Dashboards summarize connection records so totals and rankings reflect distinct observed activity. |
| Default dashboard time | Last 30 days for the suite, except where a specific panel overrides the range |
| Collection path | Sniffer NDJSON forwarded into Splunk and field-extracted under the pqc:connections sourcetype |
Shared fields across the suite
Several dashboards reuse the same core fields, including downgrade detection, quantum-safety classification, client-advertised groups, negotiated key-share groups, TLS version, cipher, and endpoint identity.
Shared Conventions¶
| Convention | Meaning |
|---|---|
| Quantum Resistance labels | Secure, Vulnerable, and Unknown are used as the core posture categories, even when a panel's user-facing label says Quantum Resistant. |
| Remediation priority | Critical, High, Medium, and Low drive prioritization-oriented KPIs and inventories. |
| Top-N design | Most charts and tables keep only the highest-volume values so dashboards remain usable at fleet scale. |
| Evidence tables | Recent-event tables generally group or cap rows instead of attempting to show every raw event in the selected range. |
| Consistent interpretation | Each dashboard page explains how to read its panels so teams can compare posture, evidence, and trends consistently. |
Data Schema Reference¶
Every dashboard in this suite is built on top of the sniffer connection schema documented in the NDJSON Schema Reference. The most frequently reused fields are the Quantum Resistance assessment, TLS version and cipher, server-selected key-share group, client-advertised groups, source and destination endpoints, and remediation-priority metadata. Each individual dashboard page below narrows that down to the fields that matter for that dashboard's questions.