Flat NDJSON Output Format

Base Event Fields (All Events)

Quantum Readiness Fields (Local Mode Only) NEW

These fields are added to all events when quantum readiness assessment is enabled in local mode (default). Can be disabled with -disable-quantum-readiness flag.

Network Target Fields (Remote Scans)

Cipher Suite Event Fields

Event Action: cipher_suite_discovered

Certificate Event Fields

Event Actions: network_certificate_discovered, filesystem_certificate_discovered

Filesystem Event Fields

Event Action: filesystem_certificate_discovered

Memory Library Event Fields

Event Action: crypto_library_discovered

Keystore Event Fields NEW

Event Actions: keystore_discovered, keystore_certificate_discovered

SSH Host Key Event Fields

Event Action: ssh_host_key_discovered

Outlook Archive Event Fields

Event Action: outlook_archive_discovered

VPN Client Event Fields NEW

Event Action: vpn_client_discovered

IPSec Tunnel Event Fields NEW

Event Action: ipsec_tunnel_discovered

Security Intelligence Fields

Applied to cipher suites and cryptographic assets

Event Action Types

Common Field Patterns

Cipher Suite Record

{"observer.hostname":"scanner-host","observer.software_version":"1.0.42","scan.type":"remote","scan.timestamp":"2025-09-02T09:00:17-04:00","target_host.address":"example.com","target_host.ip":"93.184.216.34","port.number":443,"port.status_overall":"open","port.protocol_detected":"TLS","cipher.protocol":"TLSv1.3","cipher.cipher_suite":"TLS_AES_256_GCM_SHA384","cipher.key_length_bits":256,"cipher.negotiated_group":"X25519","cipher.is_preferred":true,"cipher.intel.security_level":"high","cipher.intel.recommendation":"recommended","x509.subject.distinguished_name":"CN=example.com,O=Example Corp,C=US","x509.serial_number":"123456789012345678901234567890","hash.sha256_certificate":"ab:cd:ef:12:34:56:78:90:..."}

Filesystem Certificate Record

{"observer.hostname":"scanner-host","scan.type":"local","event.action":"filesystem_certificate_discovered","file.path":"/etc/ssl/certs/ca-cert.pem","certificate.subject.common_name":"Internal Root CA","certificate.issuer.common_name":"Internal Root CA","certificate.serial_number":"123456789","x509.is_valid":true,"hash.sha256_certificate":"12:34:56:78:90:ab:cd:ef:..."}

Crypto Library Record

{"observer.hostname":"scanner-host","scan.type":"local","event.action":"crypto_library_in_memory","process.pid":1234,"process.name":"nginx","process.executable":"/usr/sbin/nginx","cryptolibrary.name":"libssl.so.3","cryptolibrary.path":"/usr/lib/x86_64-linux-gnu/libssl.so.3","cryptolibrary.crypto_type":"TLS Library","cryptolibrary.detected_apis":"SSL_connect,SSL_accept,TLS_method"}

Keystore Certificate Record NEW

{"@timestamp":"2025-09-17T14:30:00.000Z","observer.hostname":"scanner-host","scan.type":"local","event.action":"keystore_certificate_discovered","event.category":"file","event.dataset":"keystore_certificate","keystore.path":"/Users/admin/Documents/certificates/server.p12","keystore.type":"PKCS12","keystore.accessible":true,"keystore.cert_count":3,"keystore_certificate.alias":"server-cert","keystore_certificate.has_private_key":true,"keystore_certificate.chain_length":2,"x509.subject.distinguished_name":"CN=api.example.com,O=Example Corp,C=US","x509.issuer.distinguished_name":"CN=Example Internal CA,O=Example Corp,C=US","x509.serial_number":"0x1a2b3c4d5e6f7890","x509.public_key.algorithm":"RSA","x509.public_key.size":2048,"x509.signature_algorithm":"SHA256-RSA","x509.not_before":"2024-01-01T00:00:00Z","x509.not_after":"2025-12-31T23:59:59Z","keystore_certificate.vulnerable":false,"keystore_certificate.risk_level":"medium","keystore_certificate.pqc_vulnerable":true,"keystore_certificate.pqc_reason":"RSA algorithm vulnerable to quantum cryptanalysis"}

Elasticsearch Ingestion

# Direct streaming to Elasticsearch
`.\certscanner-windows-amd64.exe -host internal-network.txt -cipherscan `
  -outputformat flatndjson `
  -posttoelastic -elasticnode "https://elastic.company.com:9200" `
  -elasticindex "crypto-scans"

# File-based ingestion
`.\certscanner-windows-amd64.exe -mode local -scanfilesystem `
  -outputformat flatndjson -output certs.ndjson
curl -X POST "elastic.company.com:9200/certs/_bulk" `
  -H "Content-Type: application/x-ndjson" `
  --data-binary "@certs.ndjson"

# Direct streaming to Elasticsearch
./certscanner-linux-x64 -host internal-network.txt -cipherscan \
  -outputformat flatndjson \
  -posttoelastic -elasticnode "https://elastic.company.com:9200" \
  -elasticindex "crypto-scans"

# File-based ingestion
./certscanner-linux-x64 -mode local -scanfilesystem \
  -outputformat flatndjson -output certs.ndjson
curl -X POST "elastic.company.com:9200/certs/_bulk" \
  -H "Content-Type: application/x-ndjson" \
  --data-binary "@certs.ndjson"

# Direct streaming to Elasticsearch - Intel Macs
./certscanner-darwin-amd64 -host internal-network.txt -cipherscan \
  -outputformat flatndjson \
  -posttoelastic -elasticnode "https://elastic.company.com:9200" \
  -elasticindex "crypto-scans"

# File-based ingestion - Intel Macs
./certscanner-darwin-amd64 -mode local -scanfilesystem \
  -outputformat flatndjson -output certs.ndjson
  
# For Apple Silicon Macs, use:
# ./certscanner-darwin-arm64 [same arguments]

curl -X POST "elastic.company.com:9200/certs/_bulk" \
  -H "Content-Type: application/x-ndjson" \
  --data-binary "@certs.ndjson"

Log Analysis Pipeline

# Stream processing with jq
`.\certscanner-windows-amd64.exe -host servers.txt -outputformat flatndjson | `
  jq 'select(.cipher.intel.security_level == "low")' | `
  jq '.target_host.address + ":" + (.port.number | tostring) + " - " + .cipher.cipher_suite'

# Filter for expiring certificates
`.\certscanner-windows-amd64.exe -mode local -scanfilesystem -outputformat flatndjson | `
  jq 'select(.event.action == "filesystem_certificate_discovered") | select(.x509.is_valid == false)'

# Stream processing with jq
./certscanner-linux-x64 -host servers.txt -outputformat flatndjson | \
  jq 'select(.cipher.intel.security_level == "low")' | \
  jq '.target_host.address + ":" + (.port.number | tostring) + " - " + .cipher.cipher_suite'

# Filter for expiring certificates
./certscanner-linux-x64 -mode local -scanfilesystem -outputformat flatndjson | \
  jq 'select(.event.action == "filesystem_certificate_discovered") | select(.x509.is_valid == false)'

# Stream processing with jq - Intel Macs
./certscanner-darwin-amd64 -host servers.txt -outputformat flatndjson | \
  jq 'select(.cipher.intel.security_level == "low")' | \
  jq '.target_host.address + ":" + (.port.number | tostring) + " - " + .cipher.cipher_suite'

# Filter for expiring certificates - Intel Macs (no memory scanning)
./certscanner-darwin-amd64 -mode local -scanfilesystem -outputformat flatndjson | \
  jq 'select(.event.action == "filesystem_certificate_discovered") | select(.x509.is_valid == false)'
  
# For Apple Silicon Macs, replace -darwin-amd64 with -darwin-arm64