EventLog Output Format

Event Properties

Event ID Mapping

Complete Schema Reference

All event types share common fields with type-specific additions. Optional fields marked with * may not be present in all events.

Cipher Event Schema (Event ID 1001) - Cross-Platform

{
  "@timestamp": "2025-09-09T13:00:17.000Z",
  "tychon": {
    "type": "cipher",
    "scan_mode": "local", 
    "scan_timestamp": "2025-09-09T13:00:17.000Z",
    "scanner_version": "1.0.43",
    "host": {
      "machine_serial_number": "ABC123DEF456"
    },
    "pqc_vulnerable": true,
    "cipher": {
      "detail": {
        "security": "high",
        "is_quantum_ready": false,
        "algo": {
          "auth": "RSA"
        }
      },
      "is_preferred": true
    },
    "certificate": {
      "validity": {
        "duration_days": 365
      },
      "public_key": {
        "rsa_exponent": 65537
      }
    },
    "active": true,
    "last_seen": "2025-09-09T12:30:17.000Z"
  },
  "certificate": {
    "is_file": "false"
  },
  "server": {
    "address": "192.168.1.10",
    "ip": "192.168.1.10", 
    "port": 443
  },
  "service": {
    "protocol": {
      "type": "TLS",
      "name": "TLSV1_3"
    }
  },
  "tls": {
    "cipher": "TLS_AES_256_GCM_SHA384",
    "version_protocol": "TLS",
    "version": "1.3"
  },
  "x509": {
    "version_number": 3,
    "serial_number": "12345678901234567890",
    "signature_algorithm": "SHA256-RSA",
    "issuer": {
      "common_name": "Company Internal CA",
      "country": "US",
      "organization": "Company Inc"
    },
    "subject": {
      "common_name": "internal.company.com",
      "country": "US", 
      "organization": "Company Inc"
    },
    "not_before": "2024-09-09T00:00:00.000Z",
    "not_after": "2025-09-09T23:59:59.000Z",
    "is_valid": true,
    "public_key_algorithm": "RSA",
    "public_key_size": 2048,
    "is_self_signed": false,
    "hash": "ab:cd:ef:12:34:56:78:90:ab:cd:ef:12:34:56:78:90:ab:cd:ef:12:34:56:78:90:ab:cd:ef:12"
  },
  "process": {
    "pid": 1234,
    "name": "firefox",
    "executable": "/usr/bin/firefox"
  },
  "file": {
    "path": "/usr/bin/firefox",
    "name": "firefox", 
    "size": 2097152,
    "mtime": "2024-08-20T14:15:00.000Z",
    "hash": {
      "sha1": "da39a3ee5e6b4b0d3255bfef95601890afd80709",
      "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
    }
  },
  "pe": {
    "file_version": "127.0.6533.120",
    "product_version": "127.0.6533.120"
  },
  "tags": ["production", "web-servers"]
}

Filesystem Certificate Schema (Event ID 1002)

{
  "@timestamp": "2025-09-09T13:00:17.000Z",
  "tychon": {
    "type": "filesystem",
    "scan_mode": "local",
    "scan_timestamp": "2025-09-09T13:00:17.000Z",
    "scanner_version": "1.0.43",
    "host": {
      "machine_serial_number": "ABC123DEF456"
    },
    "active": true
  },
  "certificate": {
    "is_file": "true"
  },
  "file": {
    "path": "/etc/ssl/certs/ca-certificate.crt",
    "name": "ca-certificate.crt",
    "size": 4096,
    "mtime": "2024-09-01T10:00:00.000Z",
    "hash": {
      "sha1": "da39a3ee5e6b4b0d3255bfef95601890afd80709",
      "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
    }
  },
  "x509": {
    "version_number": 3,
    "serial_number": "98765432109876543210",
    "signature_algorithm": "SHA256-RSA",
    "subject": {
      "common_name": "Company Root CA",
      "country": "US",
      "organization": "Company Inc"
    },
    "issuer": {
      "common_name": "Company Root CA", 
      "country": "US",
      "organization": "Company Inc"
    },
    "not_before": "2020-01-01T00:00:00.000Z",
    "not_after": "2030-01-01T23:59:59.000Z",
    "is_valid": true,
    "public_key_algorithm": "RSA",
    "public_key_size": 4096,
    "is_self_signed": true,
    "hash": "12:34:56:78:90:ab:cd:ef:12:34:56:78:90:ab:cd:ef:12:34:56:78:90:ab:cd:ef:12:34:56:78"
  }
}

Crypto Library Schema (Event ID 1003)

{
  "@timestamp": "2025-09-09T13:00:17.000Z",
  "tychon": {
    "type": "library",
    "scan_mode": "local",
    "scan_timestamp": "2025-09-09T13:00:17.000Z",
    "scanner_version": "1.0.43",
    "host": {
      "machine_serial_number": "ABC123DEF456"
    },
    "active": true
  },
  "certificate": {
    "is_file": "true"
  },
  "process": {
    "pid": 5678,
    "name": "java",
    "executable": "/usr/bin/java"
  },
  "file": {
    "path": "/usr/lib/jvm/java-11-openjdk/lib/security/bcprov.jar",
    "name": "bcprov.jar"
  },
  "pe": {
    "file_version": "1.70.0.0",
    "product_version": "1.70"
  }
}

Archive File Schema (Event ID 1004)

{
  "@timestamp": "2025-09-09T13:00:17.000Z",
  "tychon": {
    "type": "archivefile",
    "scan_mode": "local", 
    "scan_timestamp": "2025-09-09T13:00:17.000Z",
    "scanner_version": "1.0.43",
    "host": {
      "machine_serial_number": "ABC123DEF456"
    },
    "active": true
  },
  "certificate": {
    "is_file": "true"
  },
  "file": {
    "path": "/home/john/Documents/email/archive.mbox",
    "name": "archive.mbox",
    "size": 2147483648,
    "mtime": "2025-09-08T15:30:00.000Z",
    "hash": {
      "sha1": "da39a3ee5e6b4b0d3255bfef95601890afd80709",
      "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
    }
  },
  "archive": {
    "type": "mbox",
    "encryption": {
      "enabled": true,
      "type": "password_protected",
      "strength": "medium"
    },
    "format": {
      "version": "2019"
    }
  }
}

Platform-Specific Event Viewing

Platform-Specific Queries

# Get all TYCHON-PQC-Scanner events
Get-WinEvent -FilterHashtable @{LogName='Application'; ProviderName='TYCHON-PQC-Scanner'}

# Get cipher discovery events (ID 1001)
Get-WinEvent -FilterHashtable @{LogName='Application'; ProviderName='TYCHON-PQC-Scanner'; ID=1001}

# Export to JSON for analysis
Get-WinEvent -FilterHashtable @{LogName='Application'; ProviderName='TYCHON-PQC-Scanner'} | 
  Select-Object TimeCreated, Id, @{Name='Message';Expression={$_.Message}} | 
  ConvertTo-Json -Depth 10 | Out-File -FilePath "tychon-pqc-scanner-events.json"

# View recent TYCHON EventLog entries (recommended for SIEM)
log show --predicate 'eventMessage CONTAINS "TYCHON_SCAN"' --last 1h

# View all TYCHON events with syslog formatting
log show --style syslog --last 1h | grep "TYCHON_SCAN"

# Monitor TYCHON events in real-time
log stream --predicate 'eventMessage CONTAINS "TYCHON_SCAN"'

# View TYCHON events by logger process (all entries)
log show --predicate 'process == "logger" AND eventMessage CONTAINS "tychon-pqc-scanner"' --last 24h

# Export TYCHON events to file for analysis
log show --predicate 'eventMessage CONTAINS "TYCHON_SCAN"' --last 7d --style ndjson > tychon-events.ndjson

# View TYCHON events using journalctl
sudo journalctl -t tychon-pqc-scanner --since "1 hour ago"

# Search for specific scan events
sudo journalctl -t tychon-pqc-scanner -g "TYCHON_SCAN" --since today

# Monitor TYCHON events in real-time
sudo journalctl -t tychon-pqc-scanner -f

# Export recent events to file
sudo journalctl -t tychon-pqc-scanner --since "24 hours ago" --no-pager > tychon-events.log

Cross-Platform Scheduled Monitoring

REM Create scheduled task for daily crypto monitoring
schtasks /create /tn "TYCHON-PQC-Scanner-Daily" ^
  /tr "C:\Security\certscanner.exe -mode local -scanfilesystem -scanmemory -outputformat eventlog -tags daily-scan" ^
  /sc daily /st 02:00 /ru SYSTEM

REM Create task for network monitoring
schtasks /create /tn "TYCHON-PQC-Scanner-Network" ^
  /tr "C:\Security\certscanner.exe -scanconnected -outputformat eventlog -tags network-monitoring" ^
  /sc hourly /ru SYSTEM

<!-- /Library/LaunchDaemons/com.tychon.pqc-scanner.daily.plist -->
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Label</key>
    <string>com.tychon.pqc-scanner.daily</string>
    <key>ProgramArguments</key>
    <array>
        <string>/usr/local/bin/certscanner</string>
        <string>-mode</string>
        <string>local</string>
        <string>-scanfilesystem</string>
        <string>-scanmemory</string>
        <string>-outputformat</string>
        <string>eventlog</string>
        <string>-tags</string>
        <string>daily-scan</string>
    </array>
    <key>StartCalendarInterval</key>
    <dict>
        <key>Hour</key>
        <integer>2</integer>
        <key>Minute</key>
        <integer>0</integer>
    </dict>
</dict>
</plist>

# /etc/systemd/system/tychon-pqc-scanner-daily.service
[Unit]
Description=TYCHON PQC Scanner Daily Crypto Monitoring
After=network.target

[Service]
Type=oneshot
ExecStart=/usr/local/bin/certscanner -mode local -scanfilesystem -scanmemory -outputformat eventlog -tags daily-scan
User=root

# /etc/systemd/system/tychon-pqc-scanner-daily.timer
[Unit]
Description=Run TYCHON PQC Scanner daily
Requires=tychon-pqc-scanner-daily.service

[Timer]
OnCalendar=daily
Persistent=true

[Install]
WantedBy=timers.target

# Enable with: sudo systemctl enable --now tychon-pqc-scanner-daily.timer

SIEM Query Examples

-- Splunk: Find PQC-vulnerable ciphers (Cross-Platform)
index=* (source="WinEventLog:Application" SourceName="TYCHON-PQC-Scanner") OR (sourcetype="syslog" "tychon-pqc-scanner") EventCode=1001
| spath input=Message 
| search "cipher.intel.pqc_ready"=false
| table _time, target_host.address, cipher.name, cipher.intel.security_level

-- Microsoft Sentinel: Certificate expiration monitoring (Cross-Platform)
Event
| where (Source == "TYCHON-PQC-Scanner" and EventID == 1002) or (SyslogTag == "tychon-pqc-scanner" and EventID == 1002)
| extend CertData = parse_json(RenderedDescription)
| where todatetime(CertData.certificate.not_after) < now() + 30d
| project TimeGenerated, Computer, CertData.certificate.subject.common_name, CertData.certificate.not_after