This is a distributable operator guide for deploying the TYCHON PKI Elasticsearch data layer, Kibana dashboards, access role, and SIEM rules.
tychon-pqc-pki. The self-contained tychon-pki-route-to-rollover pipeline expands flat fields, normalizes scanner data, and changes the target to tychon-pki-write, which writes to the current numeric rollover index.ILM, templates, simulations, indices, aliases, and roles are Elasticsearch requests for Dev Tools or port 9200. Dashboards, alerts, data views, runtime fields, and SIEM rules are Kibana objects imported from the supplied saved-object package.
Purpose: Define rollover, warm-tier, and retention behavior.
PUT /_ilm/policy/tychon-pki-policy
{
"policy": {
"phases": {
"hot": {
"actions": {
"rollover": {
"min_docs": 1,
"max_primary_shard_size": "5gb",
"max_age": "1d"
},
"set_priority": {
"priority": 100
}
}
},
"warm": {
"min_age": "90d",
"actions": {
"shrink": {
"number_of_shards": 1
},
"forcemerge": {
"max_num_segments": 1
},
"set_priority": {
"priority": 50
}
}
},
"delete": {
"min_age": "180d",
"actions": {
"delete": {}
}
}
}
}
}Purpose: Apply the complete PKI mapping to every new numeric rollover generation. Do not replace this with a shortened mapping.
The mapping is cumulative: it combines the scanner-provided tychon-pqc-pki schema with the PKI dashboard fields and additional known Tychon inventory fields. Scanner-defined certificate-chain, host, crypto, HSM, application, network, VPN, and TLS fields are retained. Explicit primitive types are used for dates, booleans, integers, floating-point values, IP addresses, and numeric counters. Strings default to keyword through strings_as_keyword; only scanner-designated free-text fields use text. Dynamic objects remain dynamic where the scanner emits variable keys. The scanner’s numeric event.severity definition is authoritative; warning/error filtering should therefore use event.type or the numeric severity values emitted by the scanner.
PUT /_index_template/tychon-pki
{
"index_patterns": [
"tychon-pki-*"
],
"priority": 300,
"template": {
"settings": {
"index.codec": "best_compression",
"index.mapping.total_fields.limit": 2000,
"index.refresh_interval": "30s",
"index.lifecycle.name": "tychon-pki-policy",
"index.lifecycle.rollover_alias": "tychon-pki-write"
},
"aliases": {
"tychon-pki-read": {}
},
"mappings": {
"dynamic": "true",
"dynamic_templates": [
{
"strings_as_keyword": {
"match_mapping_type": "string",
"mapping": {
"ignore_above": 256,
"type": "keyword"
}
}
}
],
"properties": {
"@timestamp": {
"type": "date"
},
"active": {
"type": "boolean"
},
"app": {
"properties": {
"quantum": {
"properties": {
"grade": {
"properties": {
"letter": {
"ignore_above": 3,
"type": "keyword"
},
"score": {
"type": "integer"
}
}
}
}
}
}
},
"archive": {
"properties": {
"encryption": {
"properties": {
"enabled": {
"type": "boolean"
},
"strength": {
"ignore_above": 256,
"type": "keyword"
},
"type": {
"ignore_above": 256,
"type": "keyword"
}
}
},
"format": {
"properties": {
"version": {
"ignore_above": 256,
"type": "keyword"
}
}
},
"type": {
"ignore_above": 256,
"type": "keyword"
}
}
},
"asset_type": {
"ignore_above": 256,
"type": "keyword"
},
"certificate": {
"properties": {
"algorithm": {
"ignore_above": 256,
"type": "keyword"
},
"bit_size": {
"type": "long"
},
"cert_store_locations": {
"ignore_above": 1024,
"type": "keyword"
},
"chain": {
"properties": {
"0": {
"properties": {
"authority_key_id": {
"type": "keyword",
"ignore_above": 256
},
"basic_constraints": {
"properties": {
"is_ca": {
"type": "boolean"
},
"max_path_len_zero": {
"type": "boolean"
}
}
},
"is_csr": {
"type": "boolean"
},
"is_private_key": {
"type": "boolean"
},
"is_self_signed": {
"type": "boolean"
},
"issuer": {
"type": "keyword",
"ignore_above": 256
},
"issuer_common_name": {
"type": "keyword",
"ignore_above": 256
},
"issuer_country": {
"type": "keyword",
"ignore_above": 256
},
"issuer_organization": {
"type": "keyword",
"ignore_above": 256
},
"issuer_organizational_unit": {
"type": "keyword",
"ignore_above": 256
},
"key_strength_assessment": {
"type": "keyword",
"ignore_above": 256
},
"key_usage": {
"type": "keyword",
"ignore_above": 256
},
"migration_priority": {
"type": "keyword",
"ignore_above": 256
},
"permitted_dns_domains": {
"type": "keyword",
"ignore_above": 256
},
"permitted_dns_domains_critical": {
"type": "boolean"
},
"pqc_readiness": {
"type": "keyword",
"ignore_above": 256
},
"pqc_vulnerable": {
"type": "boolean"
},
"quantum_risk": {
"type": "keyword",
"ignore_above": 256
},
"raw_pem_certificate": {
"type": "keyword",
"ignore_above": 256
},
"recommended_action": {
"type": "keyword",
"ignore_above": 256
},
"serial_number": {
"type": "keyword",
"ignore_above": 256
},
"sha1_fingerprint": {
"type": "keyword",
"ignore_above": 256
},
"sha256_fingerprint": {
"type": "keyword",
"ignore_above": 256
},
"signature_algorithm": {
"type": "keyword",
"ignore_above": 256
},
"signature_hex": {
"type": "keyword",
"ignore_above": 256
},
"source_id": {
"type": "keyword",
"ignore_above": 256
},
"subject": {
"type": "keyword",
"ignore_above": 256
},
"subject_alternative_names": {
"properties": {
"dns_names": {
"type": "keyword",
"ignore_above": 256
}
}
},
"subject_common_name": {
"type": "keyword",
"ignore_above": 256
},
"subject_country": {
"type": "keyword",
"ignore_above": 256
},
"subject_key_id": {
"type": "keyword",
"ignore_above": 256
},
"subject_organization": {
"type": "keyword",
"ignore_above": 256
},
"subject_organizational_unit": {
"type": "keyword",
"ignore_above": 256
},
"subject_public_key_info": {
"properties": {
"algorithm": {
"type": "keyword",
"ignore_above": 256
},
"bit_size": {
"type": "long"
},
"curve": {
"type": "keyword",
"ignore_above": 256
},
"ecdsa_x_hex": {
"type": "keyword",
"ignore_above": 256
},
"ecdsa_y_hex": {
"type": "keyword",
"ignore_above": 256
},
"rsa_exponent": {
"type": "long"
},
"rsa_modulus_hex": {
"type": "keyword",
"ignore_above": 256
}
}
},
"validity": {
"properties": {
"duration_days": {
"type": "keyword",
"ignore_above": 256
}
}
},
"version": {
"type": "long"
}
}
}
}
},
"curve": {
"ignore_above": 256,
"type": "keyword"
},
"extended_key_usage": {
"ignore_above": 256,
"type": "keyword"
},
"has_client_cert": {
"type": "boolean"
},
"is_file": {
"type": "boolean"
},
"is_private_key": {
"type": "boolean"
},
"is_self_signed": {
"type": "boolean"
},
"issuer": {
"ignore_above": 1024,
"type": "keyword"
},
"issuer_common_name": {
"ignore_above": 256,
"type": "keyword"
},
"key_usage": {
"ignore_above": 256,
"type": "keyword"
},
"not_after": {
"type": "date"
},
"not_before": {
"type": "date"
},
"serial_number": {
"ignore_above": 256,
"type": "keyword"
},
"subject": {
"ignore_above": 1024,
"type": "keyword"
},
"subject_common_name": {
"ignore_above": 256,
"type": "keyword"
},
"version": {
"type": "long"
}
}
},
"config": {
"properties": {
"config_file": {
"type": "keyword",
"ignore_above": 256
},
"property_key": {
"type": "keyword",
"ignore_above": 256
},
"ref_type": {
"type": "keyword",
"ignore_above": 256
},
"resolved_path": {
"type": "keyword",
"ignore_above": 256
}
}
},
"connected": {
"properties": {
"has_crypto": {
"type": "boolean"
},
"port": {
"type": "long"
},
"primary_key_exchange": {
"type": "keyword"
},
"primary_protocol": {
"type": "keyword"
},
"remote_ip": {
"type": "ip"
},
"signature_algorithm": {
"type": "keyword"
}
}
},
"crypto": {
"properties": {
"block_ciphers": {
"ignore_above": 256,
"type": "keyword"
},
"cipher_key_sizes": {
"dynamic": "true",
"type": "object"
},
"cipher_modes": {
"dynamic": "true",
"type": "object"
},
"curve": {
"ignore_above": 256,
"type": "keyword"
},
"fingerprint_sha1": {
"ignore_above": 256,
"type": "keyword"
},
"hash_algorithms": {
"ignore_above": 256,
"type": "keyword"
},
"kex_types": {
"ignore_above": 256,
"type": "keyword"
},
"key_algorithm": {
"ignore_above": 256,
"type": "keyword"
},
"key_size": {
"type": "long"
},
"mac_algorithms": {
"ignore_above": 256,
"type": "keyword"
},
"signature_algorithm": {
"ignore_above": 256,
"type": "keyword"
}
}
},
"destination": {
"properties": {
"domain": {
"type": "keyword",
"ignore_above": 256
},
"ip": {
"ignore_above": 256,
"type": "keyword"
},
"port": {
"type": "long"
}
}
},
"error": {
"properties": {
"code": {
"ignore_above": 256,
"type": "keyword"
},
"message": {
"fields": {
"keyword": {
"ignore_above": 512,
"type": "keyword"
}
},
"type": "text"
}
}
},
"event": {
"properties": {
"action": {
"ignore_above": 256,
"type": "keyword"
},
"category": {
"ignore_above": 256,
"type": "keyword"
},
"created": {
"type": "date"
},
"dataset": {
"ignore_above": 256,
"type": "keyword"
},
"duration": {
"type": "long"
},
"kind": {
"ignore_above": 256,
"type": "keyword"
},
"outcome": {
"ignore_above": 256,
"type": "keyword"
},
"risk_score": {
"type": "float"
},
"severity": {
"type": "long"
},
"type": {
"ignore_above": 256,
"type": "keyword"
}
}
},
"file": {
"properties": {
"accessed": {
"type": "date"
},
"created": {
"type": "date"
},
"ctime": {
"type": "date"
},
"extension": {
"ignore_above": 256,
"type": "keyword"
},
"group": {
"properties": {
"id": {
"ignore_above": 256,
"type": "keyword"
},
"name": {
"ignore_above": 256,
"type": "keyword"
}
}
},
"hash": {
"properties": {
"md5": {
"ignore_above": 256,
"type": "keyword"
},
"sha1": {
"ignore_above": 256,
"type": "keyword"
},
"sha1_certificate": {
"ignore_above": 256,
"type": "keyword"
},
"sha256": {
"ignore_above": 256,
"type": "keyword"
},
"sha256_certificate": {
"ignore_above": 256,
"type": "keyword"
}
}
},
"mtime": {
"type": "date"
},
"name": {
"ignore_above": 256,
"type": "keyword"
},
"owner": {
"properties": {
"id": {
"ignore_above": 256,
"type": "keyword"
},
"name": {
"ignore_above": 256,
"type": "keyword"
}
}
},
"path": {
"ignore_above": 1024,
"type": "keyword"
},
"permissions": {
"ignore_above": 256,
"type": "keyword"
},
"size": {
"type": "long"
}
}
},
"hash": {
"properties": {
"sha1": {
"ignore_above": 256,
"type": "keyword"
},
"sha1_certificate": {
"ignore_above": 256,
"type": "keyword"
},
"sha256": {
"ignore_above": 256,
"type": "keyword"
},
"sha256_certificate": {
"ignore_above": 256,
"type": "keyword"
}
}
},
"host": {
"properties": {
"address": {
"ignore_above": 256,
"type": "keyword"
},
"architecture": {
"ignore_above": 64,
"type": "keyword"
},
"cpu": {
"properties": {
"cores": {
"type": "integer"
}
}
},
"domain": {
"ignore_above": 256,
"type": "keyword"
},
"hostname": {
"ignore_above": 256,
"type": "keyword"
},
"id": {
"ignore_above": 256,
"type": "keyword"
},
"ip": {
"type": "ip"
},
"ipv4": {
"type": "ip"
},
"ipv6": {
"type": "ip"
},
"mac": {
"ignore_above": 256,
"type": "keyword"
},
"memory": {
"properties": {
"total": {
"type": "long"
}
}
},
"name": {
"ignore_above": 256,
"type": "keyword"
},
"os": {
"properties": {
"family": {
"ignore_above": 64,
"type": "keyword"
},
"kernel": {
"ignore_above": 256,
"type": "keyword"
},
"name": {
"ignore_above": 256,
"type": "keyword"
},
"platform": {
"ignore_above": 256,
"type": "keyword"
},
"version": {
"ignore_above": 128,
"type": "keyword"
}
}
},
"os_category": {
"ignore_above": 64,
"type": "keyword"
},
"os_pqc_tier": {
"ignore_above": 64,
"type": "keyword"
},
"type": {
"ignore_above": 256,
"type": "keyword"
}
}
},
"hsm": {
"properties": {
"detection_method": {
"ignore_above": 64,
"type": "keyword"
},
"fips_level": {
"ignore_above": 16,
"type": "keyword"
},
"firmware_version": {
"ignore_above": 64,
"type": "keyword"
},
"id": {
"ignore_above": 64,
"type": "keyword"
},
"library_path": {
"ignore_above": 512,
"type": "keyword"
},
"pqc_ready": {
"type": "boolean"
},
"product": {
"ignore_above": 128,
"type": "keyword"
},
"serial": {
"ignore_above": 128,
"type": "keyword"
},
"slot_count": {
"type": "integer"
},
"vendor": {
"ignore_above": 128,
"type": "keyword"
}
}
},
"id": {
"type": "keyword"
},
"iis": {
"properties": {
"app_pool_name": {
"ignore_above": 256,
"type": "keyword"
},
"binding": {
"ignore_above": 256,
"type": "keyword"
},
"manufacturer": {
"ignore_above": 128,
"type": "keyword"
},
"physical_path": {
"ignore_above": 1024,
"type": "keyword"
},
"site_id": {
"ignore_above": 64,
"type": "keyword"
},
"site_name": {
"ignore_above": 256,
"type": "keyword"
},
"version": {
"ignore_above": 64,
"type": "keyword"
}
}
},
"ipsec_tunnel": {
"properties": {
"active": {
"type": "boolean"
},
"config_path": {
"ignore_above": 1024,
"type": "keyword"
},
"detection_confidence": {
"ignore_above": 256,
"type": "keyword"
},
"detection_method": {
"ignore_above": 256,
"type": "keyword"
},
"first_detected": {
"type": "date"
},
"implementation": {
"ignore_above": 256,
"type": "keyword"
},
"last_seen": {
"type": "date"
},
"name": {
"ignore_above": 256,
"type": "keyword"
},
"status": {
"ignore_above": 256,
"type": "keyword"
},
"version": {
"ignore_above": 256,
"type": "keyword"
}
}
},
"java": {
"properties": {
"manifest": {
"dynamic": "true",
"type": "object"
},
"vendor": {
"ignore_above": 256,
"type": "keyword"
},
"version": {
"ignore_above": 256,
"type": "keyword"
}
}
},
"kerberos": {
"properties": {
"config_source": {
"ignore_above": 256,
"type": "keyword"
},
"has_aes128": {
"type": "boolean"
},
"has_aes256": {
"type": "boolean"
},
"has_des": {
"type": "boolean"
},
"has_rc4": {
"type": "boolean"
},
"is_explicitly_configured": {
"type": "boolean"
},
"is_quantum_safe": {
"type": "boolean"
},
"raw_bitmask": {
"type": "long"
},
"supported_types": {
"ignore_above": 256,
"type": "keyword"
}
}
},
"keystore": {
"properties": {
"accessible": {
"type": "boolean"
},
"cert_count": {
"type": "long"
},
"error_message": {
"fields": {
"keyword": {
"ignore_above": 512,
"type": "keyword"
}
},
"type": "text"
},
"owner": {
"ignore_above": 256,
"type": "keyword"
},
"permissions": {
"ignore_above": 256,
"type": "keyword"
},
"requires_auth": {
"type": "boolean"
},
"stats": {
"properties": {
"certificate_types": {
"properties": {
"ca": {
"type": "long"
},
"end_entity": {
"type": "long"
}
}
},
"expired_certificates": {
"type": "long"
},
"expiring_soon_certificates": {
"type": "long"
},
"key_algorithms": {
"dynamic": "true",
"properties": {
"DSA": {
"type": "integer"
},
"ECDH": {
"type": "integer"
},
"ECDSA": {
"type": "integer"
},
"Ed25519": {
"type": "integer"
},
"RSA": {
"type": "integer"
}
}
},
"pqc_vulnerable_certificates": {
"type": "long"
},
"vulnerable_certificates": {
"type": "long"
}
}
},
"type": {
"ignore_above": 256,
"type": "keyword"
}
}
},
"last_seen": {
"type": "date"
},
"library": {
"properties": {
"additional_version_details": {
"dynamic": "true",
"type": "object"
},
"company_name": {
"ignore_above": 256,
"type": "keyword"
},
"crypto_features": {
"ignore_above": 256,
"type": "keyword"
},
"crypto_type": {
"ignore_above": 256,
"type": "keyword"
},
"description": {
"fields": {
"keyword": {
"ignore_above": 512,
"type": "keyword"
}
},
"type": "text"
},
"detected_apis": {
"ignore_above": 256,
"type": "keyword"
},
"detection_time": {
"type": "date"
},
"name": {
"ignore_above": 256,
"type": "keyword"
},
"path": {
"ignore_above": 1024,
"type": "keyword"
},
"product_name": {
"ignore_above": 256,
"type": "keyword"
},
"product_version": {
"ignore_above": 256,
"type": "keyword"
},
"type": {
"ignore_above": 256,
"type": "keyword"
},
"version": {
"ignore_above": 256,
"type": "keyword"
}
}
},
"macsec": {
"properties": {
"cipher_suite": {
"type": "keyword"
},
"detection_confidence": {
"type": "keyword"
},
"detection_method": {
"type": "keyword"
},
"encrypt": {
"type": "boolean"
},
"findings": {
"type": "text"
},
"implementation": {
"type": "keyword"
},
"include_sci": {
"type": "boolean"
},
"interface_name": {
"type": "keyword"
},
"key_agreement_method": {
"type": "keyword"
},
"mka_enabled": {
"type": "boolean"
},
"mka_priority": {
"type": "long"
},
"parent_interface": {
"type": "keyword"
},
"protect": {
"type": "boolean"
},
"quantum_safe": {
"type": "boolean"
},
"replay_protect": {
"type": "boolean"
},
"replay_window": {
"type": "long"
},
"risk_level": {
"type": "keyword"
},
"sci": {
"type": "keyword"
},
"security_score": {
"type": "long"
},
"status": {
"type": "keyword"
},
"validation_mode": {
"type": "keyword"
}
}
},
"network": {
"properties": {
"application": {
"ignore_above": 256,
"type": "keyword"
},
"protocol": {
"ignore_above": 256,
"type": "keyword"
},
"transport": {
"ignore_above": 256,
"type": "keyword"
}
}
},
"observer": {
"properties": {
"architecture": {
"ignore_above": 256,
"type": "keyword"
},
"bigfix_client_installed": {
"type": "boolean"
},
"bios_serial_number": {
"ignore_above": 256,
"type": "keyword"
},
"cpu_cores": {
"type": "long"
},
"cpu_logical_cores": {
"type": "long"
},
"cpu_model_name": {
"ignore_above": 256,
"type": "keyword"
},
"cpu_vendor_id": {
"ignore_above": 256,
"type": "keyword"
},
"current_user": {
"ignore_above": 256,
"type": "keyword"
},
"database_schema_version": {
"type": "keyword",
"ignore_above": 256
},
"domain": {
"ignore_above": 256,
"type": "keyword"
},
"error": {
"ignore_above": 256,
"type": "keyword"
},
"fips_mode_enabled": {
"type": "boolean"
},
"hostname": {
"ignore_above": 256,
"type": "keyword"
},
"id": {
"ignore_above": 256,
"type": "keyword"
},
"ip": {
"type": "ip"
},
"ip_addresses": {
"ignore_above": 256,
"type": "keyword"
},
"is_vdi_environment": {
"type": "boolean"
},
"kernel_arch": {
"ignore_above": 256,
"type": "keyword"
},
"kernel_version": {
"ignore_above": 256,
"type": "keyword"
},
"machine_serial_number": {
"ignore_above": 256,
"type": "keyword"
},
"organization": {
"ignore_above": 256,
"type": "keyword"
},
"os": {
"properties": {
"build": {
"ignore_above": 256,
"type": "keyword"
},
"family": {
"ignore_above": 256,
"type": "keyword"
},
"kernel": {
"ignore_above": 256,
"type": "keyword"
},
"name": {
"ignore_above": 256,
"type": "keyword"
},
"platform": {
"ignore_above": 256,
"type": "keyword"
},
"version": {
"ignore_above": 256,
"type": "keyword"
}
}
},
"output_schema_version": {
"type": "keyword",
"ignore_above": 256
},
"platform_version": {
"ignore_above": 256,
"type": "keyword"
},
"ram_used_percent": {
"type": "long"
},
"software_version": {
"ignore_above": 256,
"type": "keyword"
},
"system_uptime_seconds": {
"type": "long"
},
"total_ram_bytes": {
"type": "long"
},
"tychon_client_id": {
"ignore_above": 256,
"type": "keyword"
},
"type": {
"ignore_above": 256,
"type": "keyword"
},
"user_gid": {
"ignore_above": 256,
"type": "keyword"
},
"user_home_dir": {
"ignore_above": 256,
"type": "keyword"
},
"user_uid": {
"ignore_above": 256,
"type": "keyword"
},
"vdi_identity_source": {
"ignore_above": 256,
"type": "keyword"
},
"vendor": {
"ignore_above": 256,
"type": "keyword"
},
"version": {
"ignore_above": 256,
"type": "keyword"
},
"windows_server_role": {
"ignore_above": 256,
"type": "keyword"
}
}
},
"omb": {
"properties": {
"additional_notes": {
"fields": {
"keyword": {
"ignore_above": 512,
"type": "keyword"
}
},
"type": "text"
},
"agency_name": {
"ignore_above": 256,
"type": "keyword"
},
"block_cipher_key_lengths": {
"ignore_above": 256,
"type": "keyword"
},
"block_cipher_modes": {
"ignore_above": 256,
"type": "keyword"
},
"block_ciphers": {
"type": "keyword",
"ignore_above": 256
},
"certifications": {
"ignore_above": 256,
"type": "keyword"
},
"cloud_provider": {
"ignore_above": 256,
"type": "keyword"
},
"crqc_vuln_algos": {
"ignore_above": 256,
"type": "keyword"
},
"crqc_vulnerable_algos": {
"ignore_above": 256,
"type": "keyword"
},
"crypto_module_names": {
"ignore_above": 256,
"type": "keyword"
},
"dsa_algorithms": {
"ignore_above": 256,
"type": "keyword"
},
"dsa_hash_algorithms": {
"ignore_above": 256,
"type": "keyword"
},
"dsa_parameters": {
"ignore_above": 256,
"type": "keyword"
},
"fips199_categorization": {
"ignore_above": 256,
"type": "keyword"
},
"fisma_system_id": {
"ignore_above": 256,
"type": "keyword"
},
"hash_algorithm_parameters": {
"ignore_above": 256,
"type": "keyword"
},
"hash_algorithms": {
"type": "keyword",
"ignore_above": 256
},
"hosting_info": {
"ignore_above": 256,
"type": "keyword"
},
"hva_id": {
"ignore_above": 256,
"type": "keyword"
},
"inventory_entry_id": {
"ignore_above": 256,
"type": "keyword"
},
"kem_algorithms": {
"ignore_above": 256,
"type": "keyword"
},
"kem_parameters": {
"ignore_above": 256,
"type": "keyword"
},
"kex_ciphersuites": {
"type": "keyword",
"ignore_above": 256
},
"kex_primary": {
"ignore_above": 256,
"type": "keyword"
},
"kex_primary_quantum_safe": {
"type": "boolean"
},
"kex_protocols": {
"ignore_above": 256,
"type": "keyword"
},
"kex_secondary": {
"ignore_above": 256,
"type": "keyword"
},
"kex_tier": {
"ignore_above": 64,
"type": "keyword"
},
"mac_algorithm_parameters": {
"ignore_above": 256,
"type": "keyword"
},
"mac_algorithms": {
"type": "keyword",
"ignore_above": 256
},
"module_name": {
"ignore_above": 256,
"type": "keyword"
},
"operating_system": {
"ignore_above": 256,
"type": "keyword"
},
"other_crypto_details": {
"fields": {
"keyword": {
"ignore_above": 512,
"type": "keyword"
}
},
"type": "text"
},
"other_crypto_techniques": {
"ignore_above": 256,
"type": "keyword"
},
"other_protocols": {
"type": "keyword",
"ignore_above": 256
},
"other_protocols_params": {
"type": "keyword",
"ignore_above": 256
},
"pqc_algos": {
"ignore_above": 256,
"type": "keyword"
},
"pqc_asymmetric_algorithms": {
"ignore_above": 256,
"type": "keyword"
},
"protocol_tier": {
"ignore_above": 64,
"type": "keyword"
},
"reported_vulnerability_status": {
"ignore_above": 256,
"type": "keyword"
},
"sig_tier": {
"ignore_above": 64,
"type": "keyword"
},
"software_package_name": {
"ignore_above": 256,
"type": "keyword"
},
"software_package_version": {
"ignore_above": 256,
"type": "keyword"
},
"symmetric_algorithms": {
"ignore_above": 256,
"type": "keyword"
},
"symmetric_algos": {
"ignore_above": 256,
"type": "keyword"
},
"system_composition": {
"ignore_above": 256,
"type": "keyword"
},
"system_decommission_fy": {
"ignore_above": 256,
"type": "keyword"
},
"system_name": {
"ignore_above": 512,
"type": "keyword"
},
"system_priority": {
"ignore_above": 256,
"type": "keyword"
},
"system_quantity": {
"ignore_above": 256,
"type": "keyword"
},
"system_replacement_fy": {
"ignore_above": 256,
"type": "keyword"
},
"system_type": {
"ignore_above": 256,
"type": "keyword"
},
"technology_refresh_fy": {
"ignore_above": 256,
"type": "keyword"
},
"vendor": {
"ignore_above": 256,
"type": "keyword"
},
"vendor_developer": {
"ignore_above": 256,
"type": "keyword"
},
"vulnerability_status": {
"ignore_above": 256,
"type": "keyword"
},
"vulnerable_asymmetric_algorithms": {
"ignore_above": 256,
"type": "keyword"
}
}
},
"package": {
"properties": {
"description": {
"type": "keyword",
"ignore_above": 256
},
"install_directory": {
"type": "keyword",
"ignore_above": 256
},
"name": {
"type": "keyword",
"ignore_above": 256
},
"path": {
"type": "keyword",
"ignore_above": 256
},
"version": {
"type": "keyword",
"ignore_above": 256
}
}
},
"pe": {
"properties": {
"company": {
"ignore_above": 256,
"type": "keyword"
},
"description": {
"fields": {
"keyword": {
"ignore_above": 512,
"type": "keyword"
}
},
"type": "text"
},
"file_version": {
"ignore_above": 256,
"type": "keyword"
},
"product": {
"ignore_above": 256,
"type": "keyword"
},
"product_version": {
"ignore_above": 256,
"type": "keyword"
}
}
},
"pki": {
"properties": {
"ca": {
"properties": {
"enrollment_url": {
"ignore_above": 512,
"type": "keyword"
},
"hsm_backed": {
"type": "boolean"
},
"hsm_vendor": {
"ignore_above": 128,
"type": "keyword"
},
"id": {
"ignore_above": 64,
"type": "keyword"
},
"migration_priority": {
"ignore_above": 16,
"type": "keyword"
},
"name": {
"ignore_above": 512,
"type": "keyword"
},
"pqc_vulnerable": {
"type": "boolean"
},
"quantum_ready": {
"type": "boolean"
},
"status": {
"ignore_above": 32,
"type": "keyword"
},
"template_name": {
"ignore_above": 256,
"type": "keyword"
},
"type": {
"ignore_above": 32,
"type": "keyword"
}
}
},
"platform": {
"properties": {
"auth_method": {
"ignore_above": 32,
"type": "keyword"
},
"host": {
"ignore_above": 256,
"type": "keyword"
},
"id": {
"ignore_above": 64,
"type": "keyword"
},
"product": {
"ignore_above": 128,
"type": "keyword"
},
"source_proto": {
"ignore_above": 32,
"type": "keyword"
},
"type": {
"ignore_above": 64,
"type": "keyword"
},
"vendor": {
"ignore_above": 128,
"type": "keyword"
}
}
}
}
},
"port": {
"properties": {
"number": {
"type": "long"
},
"protocol_detected": {
"ignore_above": 256,
"type": "keyword"
},
"status_overall": {
"ignore_above": 256,
"type": "keyword"
}
}
},
"pqc": {
"properties": {
"crypto_library": {
"ignore_above": 256,
"type": "keyword"
},
"key_strength": {
"ignore_above": 256,
"type": "keyword"
},
"last_assessed": {
"type": "date"
},
"migration_priority": {
"ignore_above": 256,
"type": "keyword"
},
"migration_status": {
"ignore_above": 256,
"type": "keyword"
},
"quantum_resistance": {
"ignore_above": 256,
"type": "keyword"
},
"quantum_risk": {
"ignore_above": 256,
"type": "keyword"
},
"readiness": {
"ignore_above": 256,
"type": "keyword"
},
"ready": {
"type": "boolean"
},
"reason": {
"fields": {
"keyword": {
"ignore_above": 512,
"type": "keyword"
}
},
"type": "text"
},
"recommended_action": {
"fields": {
"keyword": {
"ignore_above": 512,
"type": "keyword"
}
},
"type": "text"
},
"supported_algorithms": {
"ignore_above": 256,
"type": "keyword"
},
"vulnerable": {
"type": "boolean"
}
}
},
"pqc_inventory": {
"type": "boolean"
},
"process": {
"properties": {
"app_root": {
"ignore_above": 1024,
"type": "keyword"
},
"command_line": {
"fields": {
"keyword": {
"ignore_above": 1024,
"type": "keyword"
}
},
"type": "text"
},
"error": {
"type": "keyword",
"ignore_above": 256
},
"executable": {
"ignore_above": 1024,
"type": "keyword"
},
"executable_directory": {
"ignore_above": 1024,
"type": "keyword"
},
"executable_file": {
"properties": {
"attributes": {
"type": "keyword",
"ignore_above": 256
},
"company_name": {
"type": "keyword",
"ignore_above": 256
},
"error": {
"type": "keyword",
"ignore_above": 256
},
"extension": {
"type": "keyword",
"ignore_above": 256
},
"file_version": {
"type": "keyword",
"ignore_above": 256
},
"group": {
"type": "keyword",
"ignore_above": 256
},
"md5_hash": {
"type": "keyword",
"ignore_above": 256
},
"name": {
"type": "keyword",
"ignore_above": 256
},
"owner": {
"type": "keyword",
"ignore_above": 256
},
"path": {
"type": "keyword",
"ignore_above": 256
},
"product_name": {
"type": "keyword",
"ignore_above": 256
},
"product_version": {
"type": "keyword",
"ignore_above": 256
},
"sha1_hash": {
"type": "keyword",
"ignore_above": 256
},
"sha256_hash": {
"type": "keyword",
"ignore_above": 256
},
"size": {
"type": "long"
}
}
},
"hash": {
"properties": {
"md5": {
"ignore_above": 256,
"type": "keyword"
},
"sha1": {
"ignore_above": 256,
"type": "keyword"
},
"sha256": {
"ignore_above": 256,
"type": "keyword"
}
}
},
"name": {
"ignore_above": 256,
"type": "keyword"
},
"owner": {
"ignore_above": 256,
"type": "keyword"
},
"pid": {
"type": "long"
},
"service_info": {
"properties": {
"description": {
"type": "keyword",
"ignore_above": 256
},
"display_name": {
"type": "keyword",
"ignore_above": 256
},
"name": {
"type": "keyword",
"ignore_above": 256
},
"state": {
"type": "keyword",
"ignore_above": 256
}
}
},
"source": {
"ignore_above": 64,
"type": "keyword"
},
"start": {
"type": "date"
},
"user_name": {
"ignore_above": 256,
"type": "keyword"
},
"username": {
"type": "keyword",
"ignore_above": 256
}
}
},
"quantum": {
"properties": {
"grade": {
"properties": {
"letter": {
"ignore_above": 3,
"type": "keyword"
},
"network_score": {
"type": "integer"
},
"os_bonus": {
"type": "integer"
},
"score": {
"type": "integer"
}
}
}
}
},
"quantum_grade": {
"properties": {
"cert_score": {
"type": "integer"
},
"cipher_score": {
"type": "integer"
},
"grade": {
"ignore_above": 3,
"type": "keyword"
},
"kex_score": {
"type": "integer"
},
"protocol_score": {
"type": "integer"
},
"score": {
"type": "integer"
},
"sig_hash_score": {
"type": "integer"
}
}
},
"quantum_readiness": {
"properties": {
"cost_analysis": {
"properties": {
"app_family": {
"ignore_above": 256,
"type": "keyword"
},
"by_app_family": {
"dynamic": "true",
"properties": {
"0": {
"properties": {
"app_family": {
"ignore_above": 256,
"type": "keyword"
},
"instance_count": {
"type": "integer"
},
"labor_cost_usd": {
"type": "float"
},
"labor_hours": {
"type": "float"
},
"tier": {
"ignore_above": 64,
"type": "keyword"
},
"total_cost_usd": {
"type": "float"
}
}
}
}
},
"by_os_category": {
"dynamic": "true",
"properties": {
"0": {
"properties": {
"hardware_cost_usd": {
"type": "float"
},
"labor_cost_usd": {
"type": "float"
},
"labor_hours": {
"type": "float"
},
"license_cost_usd": {
"type": "float"
},
"os_category": {
"ignore_above": 512,
"type": "keyword"
},
"tier": {
"ignore_above": 64,
"type": "keyword"
},
"total_cost_usd": {
"type": "float"
},
"upgrade_target": {
"ignore_above": 256,
"type": "keyword"
}
}
}
}
},
"instance_count": {
"type": "integer"
},
"labor_cost_usd": {
"type": "float"
},
"labor_hours": {
"type": "float"
},
"labor_rate_used": {
"type": "float"
},
"os_category": {
"ignore_above": 256,
"type": "keyword"
},
"os_hardware_cost_usd": {
"type": "float"
},
"os_labor_cost_usd": {
"type": "float"
},
"os_labor_hours": {
"type": "float"
},
"os_license_cost_usd": {
"type": "float"
},
"os_tier": {
"ignore_above": 64,
"type": "keyword"
},
"os_total_cost_usd": {
"type": "float"
},
"os_upgrade_target": {
"ignore_above": 256,
"type": "keyword"
},
"tier": {
"ignore_above": 64,
"type": "keyword"
},
"total_cost_usd": {
"type": "float"
},
"total_hardware_cost_usd": {
"type": "float"
},
"total_labor_cost_usd": {
"type": "float"
},
"total_labor_hours": {
"type": "float"
},
"total_license_cost_usd": {
"type": "float"
}
}
},
"critical_issues": {
"dynamic": "true",
"properties": {
"0": {
"properties": {
"blocking": {
"type": "boolean"
},
"component": {
"ignore_above": 256,
"type": "keyword"
},
"impact": {
"fields": {
"keyword": {
"ignore_above": 512,
"type": "keyword"
}
},
"type": "text"
},
"issue": {
"fields": {
"keyword": {
"ignore_above": 512,
"type": "keyword"
}
},
"type": "text"
},
"resolution": {
"fields": {
"keyword": {
"ignore_above": 512,
"type": "keyword"
}
},
"type": "text"
},
"severity": {
"ignore_above": 32,
"type": "keyword"
}
}
}
}
},
"hardware": {
"properties": {
"ntlm_lm_compat_level": {
"type": "integer"
},
"ntlm_pqc_vulnerable": {
"type": "boolean"
},
"ntlm_protocol": {
"ignore_above": 64,
"type": "keyword"
},
"pqc_benchmark": {
"properties": {
"measurement_ms": {
"type": "integer"
},
"ml_dsa_44": {
"properties": {
"keygen": {
"properties": {
"latency_microsec": {
"type": "float"
},
"ops_per_sec": {
"type": "float"
},
"passed": {
"type": "boolean"
}
}
},
"sign": {
"properties": {
"latency_microsec": {
"type": "float"
},
"ops_per_sec": {
"type": "float"
},
"passed": {
"type": "boolean"
}
}
},
"verify": {
"properties": {
"latency_microsec": {
"type": "float"
},
"ops_per_sec": {
"type": "float"
},
"passed": {
"type": "boolean"
}
}
}
}
},
"ml_dsa_65": {
"properties": {
"keygen": {
"properties": {
"latency_microsec": {
"type": "float"
},
"ops_per_sec": {
"type": "float"
},
"passed": {
"type": "boolean"
}
}
},
"sign": {
"properties": {
"latency_microsec": {
"type": "float"
},
"ops_per_sec": {
"type": "float"
},
"passed": {
"type": "boolean"
}
}
},
"verify": {
"properties": {
"latency_microsec": {
"type": "float"
},
"ops_per_sec": {
"type": "float"
},
"passed": {
"type": "boolean"
}
}
}
}
},
"ml_dsa_87": {
"properties": {
"keygen": {
"properties": {
"latency_microsec": {
"type": "float"
},
"ops_per_sec": {
"type": "float"
},
"passed": {
"type": "boolean"
}
}
},
"sign": {
"properties": {
"latency_microsec": {
"type": "float"
},
"ops_per_sec": {
"type": "float"
},
"passed": {
"type": "boolean"
}
}
},
"verify": {
"properties": {
"latency_microsec": {
"type": "float"
},
"ops_per_sec": {
"type": "float"
},
"passed": {
"type": "boolean"
}
}
}
}
},
"ml_kem_1024": {
"properties": {
"decap": {
"properties": {
"latency_microsec": {
"type": "float"
},
"ops_per_sec": {
"type": "float"
},
"passed": {
"type": "boolean"
}
}
},
"encap": {
"properties": {
"latency_microsec": {
"type": "float"
},
"ops_per_sec": {
"type": "float"
},
"passed": {
"type": "boolean"
}
}
},
"keygen": {
"properties": {
"latency_microsec": {
"type": "float"
},
"ops_per_sec": {
"type": "float"
},
"passed": {
"type": "boolean"
}
}
}
}
},
"ml_kem_768": {
"properties": {
"decap": {
"properties": {
"latency_microsec": {
"type": "float"
},
"ops_per_sec": {
"type": "float"
},
"passed": {
"type": "boolean"
}
}
},
"encap": {
"properties": {
"latency_microsec": {
"type": "float"
},
"ops_per_sec": {
"type": "float"
},
"passed": {
"type": "boolean"
}
}
},
"keygen": {
"properties": {
"latency_microsec": {
"type": "float"
},
"ops_per_sec": {
"type": "float"
},
"passed": {
"type": "boolean"
}
}
}
}
},
"overall_passed": {
"type": "boolean"
},
"timestamp_utc": {
"type": "date"
}
}
},
"secure_boot_firmware": {
"ignore_above": 32,
"type": "keyword"
}
}
},
"kerberos": {
"properties": {
"config_source": {
"ignore_above": 64,
"type": "keyword"
},
"has_aes128": {
"type": "boolean"
},
"has_aes256": {
"type": "boolean"
},
"has_des": {
"type": "boolean"
},
"has_rc4": {
"type": "boolean"
},
"is_explicitly_configured": {
"type": "boolean"
},
"is_quantum_safe": {
"type": "boolean"
},
"raw_bitmask": {
"type": "long"
},
"supported_types": {
"ignore_above": 256,
"type": "keyword"
}
}
},
"network": {
"properties": {
"wifi_cipher": {
"ignore_above": 32,
"type": "keyword"
},
"wifi_key_mgmt": {
"ignore_above": 32,
"type": "keyword"
},
"wifi_pqc_vulnerable": {
"type": "boolean"
},
"wifi_present": {
"type": "boolean"
},
"wifi_protocol": {
"ignore_above": 64,
"type": "keyword"
},
"wifi_quantum_risk": {
"ignore_above": 16,
"type": "keyword"
},
"wifi_ssid": {
"ignore_above": 256,
"type": "keyword"
}
}
}
}
},
"quantum_ready": {
"type": "boolean"
},
"quantum_ready_cert": {
"type": "boolean"
},
"quantum_ready_cipher": {
"type": "boolean"
},
"quantum_ready_kx": {
"type": "boolean"
},
"scan": {
"properties": {
"target_input": {
"ignore_above": 256,
"type": "keyword"
},
"timestamp": {
"type": "date"
},
"type": {
"ignore_above": 256,
"type": "keyword"
}
}
},
"scan_mode": {
"ignore_above": 256,
"type": "keyword"
},
"scan_timestamp": {
"type": "date"
},
"scan_type": {
"ignore_above": 256,
"type": "keyword"
},
"security": {
"properties": {
"known_vulnerabilities": {
"ignore_above": 256,
"type": "keyword"
},
"last_assessed": {
"type": "date"
},
"perfect_forward_secrecy": {
"type": "boolean"
},
"pqc_support": {
"type": "boolean"
},
"pqc_vulnerable": {
"type": "boolean"
},
"risk_level": {
"ignore_above": 256,
"type": "keyword"
},
"score": {
"type": "long"
},
"vulnerable": {
"type": "boolean"
},
"weak_crypto": {
"type": "boolean"
},
"weak_dh_group": {
"type": "boolean"
}
}
},
"security_association": {
"properties": {
"add_time": {
"type": "long"
},
"auth_algorithm": {
"ignore_above": 256,
"type": "keyword"
},
"current_bytes": {
"type": "long"
},
"current_packets": {
"type": "long"
},
"encryption_algorithm": {
"ignore_above": 256,
"type": "keyword"
},
"hard_byte_limit": {
"type": "long"
},
"hard_packet_limit": {
"type": "long"
},
"lifetime_seconds": {
"type": "long"
},
"mode": {
"ignore_above": 256,
"type": "keyword"
},
"replay_window": {
"type": "long"
},
"soft_byte_limit": {
"type": "long"
},
"soft_packet_limit": {
"type": "long"
},
"spi": {
"ignore_above": 256,
"type": "keyword"
},
"state": {
"ignore_above": 256,
"type": "keyword"
},
"use_time": {
"type": "long"
}
}
},
"server": {
"properties": {
"address": {
"ignore_above": 256,
"type": "keyword"
},
"domain": {
"ignore_above": 256,
"type": "keyword"
},
"ip": {
"type": "ip"
},
"port": {
"type": "long"
},
"protocol": {
"type": "keyword",
"ignore_above": 256
}
}
},
"service": {
"properties": {
"name": {
"ignore_above": 256,
"type": "keyword"
},
"type": {
"ignore_above": 256,
"type": "keyword"
},
"version": {
"ignore_above": 256,
"type": "keyword"
}
}
},
"source": {
"properties": {
"ip": {
"type": "keyword",
"ignore_above": 256
}
}
},
"ssh": {
"properties": {
"algorithms": {
"properties": {
"client_offered_ciphers": {
"type": "keyword",
"ignore_above": 256
},
"client_offered_host_key_algos": {
"type": "keyword",
"ignore_above": 256
},
"client_offered_kex": {
"type": "keyword",
"ignore_above": 256
},
"client_offered_macs": {
"type": "keyword",
"ignore_above": 256
},
"negotiated_cipher_c2s": {
"type": "keyword",
"ignore_above": 256
},
"negotiated_cipher_s2c": {
"type": "keyword",
"ignore_above": 256
},
"negotiated_host_key_algo": {
"type": "keyword",
"ignore_above": 256
},
"negotiated_kex": {
"type": "keyword",
"ignore_above": 256
},
"negotiated_mac_c2s": {
"type": "keyword",
"ignore_above": 256
},
"negotiated_mac_s2c": {
"type": "keyword",
"ignore_above": 256
},
"server_offered_ciphers_c2s": {
"type": "keyword",
"ignore_above": 256
},
"server_offered_ciphers_s2c": {
"type": "keyword",
"ignore_above": 256
},
"server_offered_host_key_algos": {
"type": "keyword",
"ignore_above": 256
},
"server_offered_kex": {
"type": "keyword",
"ignore_above": 256
},
"server_offered_macs_c2s": {
"type": "keyword",
"ignore_above": 256
},
"server_offered_macs_s2c": {
"type": "keyword",
"ignore_above": 256
}
}
},
"banner": {
"ignore_above": 256,
"type": "keyword"
},
"client_algorithms_offered": {
"dynamic": "true",
"type": "object"
},
"handshake_error": {
"fields": {
"keyword": {
"ignore_above": 512,
"type": "keyword"
}
},
"type": "text"
},
"host_key": {
"properties": {
"bits": {
"type": "long"
},
"fingerprint_sha256": {
"type": "keyword",
"ignore_above": 256
},
"public_key": {
"type": "keyword",
"ignore_above": 256
},
"type": {
"type": "keyword",
"ignore_above": 256
},
"x509_certificate": {
"properties": {
"is_csr": {
"type": "boolean"
},
"is_private_key": {
"type": "boolean"
},
"is_self_signed": {
"type": "boolean"
},
"issuer": {
"properties": {
"common_name": {
"type": "keyword",
"ignore_above": 256
}
}
},
"pqc_vulnerable": {
"type": "boolean"
},
"serial_number": {
"type": "keyword",
"ignore_above": 256
},
"source_file_path": {
"type": "keyword",
"ignore_above": 256
},
"subject": {
"properties": {
"common_name": {
"type": "keyword",
"ignore_above": 256
}
}
},
"subject_public_key_info": {
"properties": {
"algorithm": {
"type": "keyword",
"ignore_above": 256
},
"bit_size": {
"type": "long"
}
}
}
}
}
}
},
"server": {
"properties": {
"encryption_ciphers": {
"type": "keyword",
"ignore_above": 256
},
"host_key": {
"properties": {
"bits": {
"type": "long"
},
"fingerprint_sha256": {
"ignore_above": 256,
"type": "keyword"
},
"type": {
"ignore_above": 256,
"type": "keyword"
}
}
},
"host_key_algorithms": {
"type": "keyword",
"ignore_above": 256
},
"kex_algorithms": {
"type": "keyword",
"ignore_above": 256
},
"mac_algorithms": {
"type": "keyword",
"ignore_above": 256
}
}
},
"status": {
"type": "keyword",
"ignore_above": 256
}
}
},
"tags": {
"ignore_above": 256,
"type": "keyword"
},
"target_host": {
"properties": {
"address": {
"ignore_above": 256,
"type": "keyword"
},
"domain": {
"ignore_above": 256,
"type": "keyword"
},
"ip": {
"ignore_above": 256,
"type": "keyword"
},
"ipv4": {
"ignore_above": 256,
"type": "keyword"
}
}
},
"tls": {
"properties": {
"certificate": {
"properties": {
"alias": {
"ignore_above": 256,
"type": "keyword"
},
"chain_complete": {
"type": "boolean"
},
"chain_length": {
"type": "long"
},
"extended_key_usage": {
"ignore_above": 256,
"type": "keyword"
},
"has_private_key": {
"type": "boolean"
},
"is_ca": {
"type": "boolean"
},
"is_self_signed": {
"type": "boolean"
},
"issuer": {
"ignore_above": 1024,
"type": "keyword"
},
"issuer_common_name": {
"ignore_above": 256,
"type": "keyword"
},
"key_usage": {
"ignore_above": 256,
"type": "keyword"
},
"not_after": {
"type": "date"
},
"not_before": {
"type": "date"
},
"serial_number": {
"ignore_above": 256,
"type": "keyword"
},
"subject": {
"ignore_above": 1024,
"type": "keyword"
},
"subject_common_name": {
"ignore_above": 256,
"type": "keyword"
},
"version": {
"type": "long"
}
}
},
"cipher": {
"ignore_above": 256,
"type": "keyword"
},
"curve": {
"ignore_above": 256,
"type": "keyword"
},
"duration_ms": {
"type": "long"
},
"first_seen": {
"type": "date"
},
"insecure_cipher_count": {
"type": "integer"
},
"insecure_ciphers": {
"ignore_above": 256,
"type": "keyword"
},
"last_changed": {
"type": "date"
},
"preferred_cipher": {
"ignore_above": 256,
"type": "keyword"
},
"preferred_key_exchange": {
"ignore_above": 256,
"type": "keyword"
},
"preferred_protocol": {
"ignore_above": 64,
"type": "keyword"
},
"previous_preferred_cipher": {
"ignore_above": 256,
"type": "keyword"
},
"previous_preferred_key_exchange": {
"ignore_above": 256,
"type": "keyword"
},
"previous_preferred_protocol": {
"ignore_above": 64,
"type": "keyword"
},
"previous_supported_ciphers": {
"ignore_above": 256,
"type": "keyword"
},
"previous_supported_key_exchanges": {
"ignore_above": 256,
"type": "keyword"
},
"previous_supported_protocols": {
"ignore_above": 64,
"type": "keyword"
},
"private_key": {
"properties": {
"algorithm": {
"ignore_above": 256,
"type": "keyword"
},
"bit_size": {
"type": "long"
},
"curve": {
"ignore_above": 256,
"type": "keyword"
}
}
},
"quantum": {
"properties": {
"grade": {
"properties": {
"letter": {
"ignore_above": 3,
"type": "keyword"
},
"score": {
"type": "integer"
}
}
}
}
},
"requires_client_cert": {
"type": "boolean"
},
"server": {
"properties": {
"cipher": {
"ignore_above": 256,
"type": "keyword"
},
"cipher_count": {
"type": "long"
},
"host_key": {
"properties": {
"bits": {
"type": "long"
},
"fingerprint_sha256": {
"ignore_above": 256,
"type": "keyword"
},
"type": {
"ignore_above": 256,
"type": "keyword"
}
}
},
"negotiated_group": {
"ignore_above": 256,
"type": "keyword"
},
"protocol_version": {
"ignore_above": 256,
"type": "keyword"
},
"supported_ciphers": {
"type": "keyword",
"ignore_above": 256
},
"supported_protocols": {
"type": "keyword",
"ignore_above": 256
}
}
},
"supported_cipher_count": {
"type": "integer"
},
"supported_ciphers": {
"ignore_above": 256,
"type": "keyword"
},
"supported_key_exchange_count": {
"type": "integer"
},
"supported_key_exchanges": {
"ignore_above": 256,
"type": "keyword"
},
"supported_protocol_count": {
"type": "integer"
},
"supported_protocols": {
"ignore_above": 64,
"type": "keyword"
},
"total_probes": {
"type": "long"
},
"unknown_cipher_count": {
"type": "integer"
},
"unknown_cipher_ids": {
"ignore_above": 10,
"type": "keyword"
},
"unknown_group_count": {
"type": "integer"
},
"unknown_group_ids": {
"ignore_above": 10,
"type": "keyword"
},
"version": {
"ignore_above": 256,
"type": "keyword"
},
"version_protocol": {
"ignore_above": 256,
"type": "keyword"
},
"weak_cipher_count": {
"type": "integer"
},
"weak_ciphers": {
"ignore_above": 256,
"type": "keyword"
}
}
},
"tunnel_details": {
"properties": {
"additional_params": {
"dynamic": "true",
"type": "object"
},
"auth_method": {
"ignore_above": 256,
"type": "keyword"
},
"bytes_received": {
"type": "long"
},
"bytes_sent": {
"type": "long"
},
"dh_group": {
"ignore_above": 256,
"type": "keyword"
},
"encryption_algorithm": {
"ignore_above": 256,
"type": "keyword"
},
"established_time": {
"type": "date"
},
"expiry_time": {
"type": "date"
},
"integrity_algorithm": {
"ignore_above": 256,
"type": "keyword"
},
"local_endpoint": {
"ignore_above": 256,
"type": "keyword"
},
"local_subnet": {
"ignore_above": 256,
"type": "keyword"
},
"mode": {
"ignore_above": 256,
"type": "keyword"
},
"nat_traversal": {
"type": "boolean"
},
"perfect_forward_secrecy": {
"type": "boolean"
},
"protocol": {
"ignore_above": 256,
"type": "keyword"
},
"remote_endpoint": {
"ignore_above": 256,
"type": "keyword"
},
"remote_subnet": {
"ignore_above": 256,
"type": "keyword"
}
}
},
"tychon": {
"dynamic": "true",
"properties": {
"active": {
"type": "boolean"
},
"application": {
"properties": {
"app_root": {
"ignore_above": 1024,
"type": "keyword"
},
"company_name": {
"ignore_above": 256,
"type": "keyword"
},
"connected_to": {
"ignore_above": 1024,
"type": "keyword"
},
"connected_to_count": {
"type": "integer"
},
"crypto_library_count": {
"type": "integer"
},
"file_version": {
"ignore_above": 256,
"type": "keyword"
},
"in_memory_cert_count": {
"type": "integer"
},
"insecure_ciphers": {
"type": "keyword",
"ignore_above": 256
},
"keychain_identity_count": {
"type": "integer"
},
"keystore_count": {
"type": "integer"
},
"name": {
"ignore_above": 256,
"type": "keyword"
},
"path": {
"ignore_above": 1024,
"type": "keyword"
},
"pid": {
"type": "long"
},
"port": {
"type": "long"
},
"port_count": {
"type": "integer"
},
"port_quantum_grade": {
"properties": {
"grade": {
"type": "keyword",
"ignore_above": 256
},
"score": {
"type": "long"
}
}
},
"ports": {
"dynamic": "true",
"properties": {
"0": {
"properties": {
"insecure_ciphers": {
"ignore_above": 512,
"type": "keyword"
},
"port": {
"type": "long"
},
"preferred_cipher": {
"ignore_above": 256,
"type": "keyword"
},
"preferred_key_exchange": {
"ignore_above": 256,
"type": "keyword"
},
"preferred_protocol": {
"ignore_above": 64,
"type": "keyword"
},
"protocol_detected": {
"ignore_above": 64,
"type": "keyword"
},
"quantum_ready": {
"type": "boolean"
},
"supported_protocols": {
"ignore_above": 256,
"type": "keyword"
}
}
}
}
},
"preferred_cipher": {
"type": "keyword",
"ignore_above": 256
},
"preferred_key_exchange": {
"type": "keyword",
"ignore_above": 256
},
"preferred_protocol": {
"type": "keyword",
"ignore_above": 256
},
"private_key_count": {
"type": "integer"
},
"product_name": {
"ignore_above": 256,
"type": "keyword"
},
"product_version": {
"ignore_above": 256,
"type": "keyword"
},
"protocol_detected": {
"type": "keyword",
"ignore_above": 256
},
"quantum_grade": {
"properties": {
"best_port_score": {
"type": "integer"
},
"grade": {
"ignore_above": 3,
"type": "keyword"
},
"os_deductions": {
"type": "integer"
},
"score": {
"type": "integer"
},
"worst_port_score": {
"type": "integer"
}
}
},
"quantum_ready": {
"type": "boolean"
},
"service_display_name": {
"ignore_above": 256,
"type": "keyword"
},
"service_name": {
"ignore_above": 256,
"type": "keyword"
},
"source": {
"ignore_above": 64,
"type": "keyword"
},
"supported_cipher_suites": {
"type": "keyword",
"ignore_above": 256
},
"supported_key_exchanges": {
"type": "keyword",
"ignore_above": 256
},
"supported_protocols": {
"type": "keyword",
"ignore_above": 256
},
"weak_ciphers": {
"type": "keyword",
"ignore_above": 256
}
}
},
"asset_type": {
"ignore_above": 256,
"type": "keyword"
},
"certificate_leaf_details": {
"properties": {
"authority_key_id": {
"type": "keyword",
"ignore_above": 256
},
"basic_constraints": {
"properties": {
"is_ca": {
"type": "boolean"
},
"max_path_len_zero": {
"type": "boolean"
}
}
},
"extended_key_usage": {
"type": "keyword",
"ignore_above": 256
},
"is_csr": {
"type": "boolean"
},
"is_private_key": {
"type": "boolean"
},
"is_self_signed": {
"type": "boolean"
},
"issuer": {
"properties": {
"common_name": {
"type": "keyword",
"ignore_above": 256
},
"country": {
"type": "keyword",
"ignore_above": 256
},
"locality": {
"type": "keyword",
"ignore_above": 256
},
"organization": {
"type": "keyword",
"ignore_above": 256
},
"organizational_unit": {
"type": "keyword",
"ignore_above": 256
},
"province": {
"type": "keyword",
"ignore_above": 256
},
"raw_string": {
"type": "keyword",
"ignore_above": 256
}
}
},
"key_strength_assessment": {
"type": "keyword",
"ignore_above": 256
},
"key_usage": {
"type": "keyword",
"ignore_above": 256
},
"migration_priority": {
"type": "keyword",
"ignore_above": 256
},
"pqc_readiness": {
"type": "keyword",
"ignore_above": 256
},
"pqc_vulnerable": {
"type": "boolean"
},
"quantum_risk": {
"type": "keyword",
"ignore_above": 256
},
"raw_pem_certificate": {
"type": "keyword",
"ignore_above": 256
},
"recommended_action": {
"type": "keyword",
"ignore_above": 256
},
"serial_number": {
"type": "keyword",
"ignore_above": 256
},
"sha1_fingerprint": {
"type": "keyword",
"ignore_above": 256
},
"sha256_fingerprint": {
"type": "keyword",
"ignore_above": 256
},
"signature_algorithm": {
"type": "keyword",
"ignore_above": 256
},
"signature_hex": {
"type": "keyword",
"ignore_above": 256
},
"source_file_path": {
"type": "keyword",
"ignore_above": 256
},
"source_id": {
"type": "keyword",
"ignore_above": 256
},
"subject": {
"properties": {
"common_name": {
"type": "keyword",
"ignore_above": 256
},
"country": {
"type": "keyword",
"ignore_above": 256
},
"locality": {
"type": "keyword",
"ignore_above": 256
},
"organization": {
"type": "keyword",
"ignore_above": 256
},
"organizational_unit": {
"type": "keyword",
"ignore_above": 256
},
"province": {
"type": "keyword",
"ignore_above": 256
},
"raw_string": {
"type": "keyword",
"ignore_above": 256
}
}
},
"subject_alternative_names": {
"properties": {
"dns_names": {
"type": "keyword",
"ignore_above": 256
},
"ip_addresses": {
"type": "keyword",
"ignore_above": 256
}
}
},
"subject_key_id": {
"type": "keyword",
"ignore_above": 256
},
"subject_public_key_info": {
"properties": {
"algorithm": {
"type": "keyword",
"ignore_above": 256
},
"bit_size": {
"type": "long"
},
"curve": {
"type": "keyword",
"ignore_above": 256
},
"ecdsa_x_hex": {
"type": "keyword",
"ignore_above": 256
},
"ecdsa_y_hex": {
"type": "keyword",
"ignore_above": 256
},
"rsa_exponent": {
"type": "long"
},
"rsa_modulus_hex": {
"type": "keyword",
"ignore_above": 256
}
}
},
"validity": {
"properties": {
"duration_days": {
"type": "keyword",
"ignore_above": 256
}
}
},
"version": {
"type": "long"
}
}
},
"connection": {
"properties": {
"cis_compliant": {
"type": "boolean"
},
"cnsa_20_level": {
"ignore_above": 32,
"type": "keyword"
},
"findings": {
"type": "text"
},
"fips140_2_compliant": {
"type": "boolean"
},
"fips140_3_compliant": {
"type": "boolean"
},
"hipaa_compliant": {
"type": "boolean"
},
"nist_800_131a_compliant": {
"type": "boolean"
},
"overall_risk": {
"ignore_above": 32,
"type": "keyword"
},
"pci_dss_compliant": {
"type": "boolean"
},
"quantum_safe": {
"type": "boolean"
},
"security_score": {
"type": "integer"
}
}
},
"crypto": {
"properties": {
"auth": {
"ignore_above": 128,
"type": "keyword"
},
"certificate": {
"type": "keyword",
"ignore_above": 256
},
"certificate_grade": {
"ignore_above": 3,
"type": "keyword"
},
"certificate_score": {
"type": "integer"
},
"cipher": {
"ignore_above": 128,
"type": "keyword"
},
"grade": {
"ignore_above": 3,
"type": "keyword"
},
"grade_score": {
"type": "integer"
},
"key_exchange": {
"ignore_above": 128,
"type": "keyword"
},
"mac": {
"ignore_above": 128,
"type": "keyword"
},
"ntlm": {
"properties": {
"auth": {
"ignore_above": 64,
"type": "keyword"
},
"pqc_readiness": {
"ignore_above": 32,
"type": "keyword"
},
"protocol": {
"ignore_above": 64,
"type": "keyword"
},
"quantum_risk": {
"ignore_above": 32,
"type": "keyword"
}
}
},
"pqc_readiness": {
"ignore_above": 32,
"type": "keyword"
},
"protocol": {
"ignore_above": 64,
"type": "keyword"
},
"protocol_version": {
"ignore_above": 32,
"type": "keyword"
},
"quantum_risk": {
"ignore_above": 32,
"type": "keyword"
},
"wifi": {
"properties": {
"cipher": {
"ignore_above": 64,
"type": "keyword"
},
"key_exchange": {
"ignore_above": 64,
"type": "keyword"
},
"pqc_readiness": {
"ignore_above": 32,
"type": "keyword"
},
"protocol": {
"ignore_above": 64,
"type": "keyword"
},
"quantum_risk": {
"ignore_above": 32,
"type": "keyword"
}
}
}
}
},
"index": {
"ignore_above": 256,
"type": "keyword"
},
"kex": {
"properties": {
"cis_compliant": {
"type": "boolean"
},
"cnsa_20_level": {
"ignore_above": 32,
"type": "keyword"
},
"display_name": {
"ignore_above": 128,
"type": "keyword"
},
"family": {
"ignore_above": 64,
"type": "keyword"
},
"fips140_2_compliant": {
"type": "boolean"
},
"fips140_3_compliant": {
"type": "boolean"
},
"hipaa_compliant": {
"type": "boolean"
},
"is_pqc_hybrid": {
"type": "boolean"
},
"nist_800_131a_compliant": {
"type": "boolean"
},
"nist_standard": {
"ignore_above": 32,
"type": "keyword"
},
"overall_risk": {
"ignore_above": 32,
"type": "keyword"
},
"pci_dss_compliant": {
"type": "boolean"
},
"pqc_component": {
"ignore_above": 64,
"type": "keyword"
},
"quantum_safe": {
"type": "boolean"
},
"security_bits_pqc": {
"type": "integer"
}
}
},
"key_strength": {
"ignore_above": 256,
"type": "keyword"
},
"last_seen": {
"type": "date"
},
"library": {
"properties": {
"apple_security_pqc_status": {
"type": "keyword",
"ignore_above": 256
},
"crypt32_pqc_status": {
"type": "keyword",
"ignore_above": 256
},
"crypt32_version": {
"type": "keyword",
"ignore_above": 256
},
"generic_pqc_status": {
"type": "keyword",
"ignore_above": 256
},
"gnutls_pqc_status": {
"type": "keyword",
"ignore_above": 256
},
"gnutls_version": {
"type": "keyword",
"ignore_above": 256
},
"libressl_pqc_status": {
"type": "keyword",
"ignore_above": 256
},
"libressl_version": {
"type": "keyword",
"ignore_above": 256
},
"nss_pqc_status": {
"type": "keyword",
"ignore_above": 256
},
"nss_version": {
"type": "keyword",
"ignore_above": 256
},
"openssl_pqc_status": {
"type": "keyword",
"ignore_above": 256
},
"openssl_version": {
"type": "keyword",
"ignore_above": 256
},
"schannel_pqc_status": {
"type": "keyword",
"ignore_above": 256
},
"schannel_version": {
"type": "keyword",
"ignore_above": 256
},
"uses_apple_security": {
"type": "boolean"
},
"uses_crypt32": {
"type": "boolean"
},
"uses_generic": {
"type": "boolean"
},
"uses_gnutls": {
"type": "boolean"
},
"uses_libressl": {
"type": "boolean"
},
"uses_nss": {
"type": "boolean"
},
"uses_openssl": {
"type": "boolean"
},
"uses_schannel": {
"type": "boolean"
},
"uses_windows_cng": {
"type": "boolean"
},
"uses_wolfssl": {
"type": "boolean"
},
"windows_cng_pqc_status": {
"type": "keyword",
"ignore_above": 256
},
"windows_cng_version": {
"type": "keyword",
"ignore_above": 256
},
"wolfssl_pqc_status": {
"type": "keyword",
"ignore_above": 256
}
}
},
"migration_priority": {
"ignore_above": 256,
"type": "keyword"
},
"pipeline": {
"properties": {
"processed": {
"type": "boolean"
}
}
},
"pki": {
"type": "object",
"properties": {
"platform": {
"type": "object",
"properties": {
"auth_method": {
"type": "keyword"
},
"host": {
"type": "keyword"
},
"id": {
"type": "keyword"
},
"product": {
"type": "keyword"
},
"source_proto": {
"type": "keyword"
},
"type": {
"type": "keyword"
},
"vendor": {
"type": "keyword"
}
}
},
"ca": {
"type": "object",
"properties": {
"id": {
"type": "keyword"
},
"name": {
"type": "keyword"
},
"type": {
"type": "keyword"
},
"status": {
"type": "keyword"
},
"quantum_ready": {
"type": "boolean"
},
"pqc_vulnerable": {
"type": "boolean"
},
"migration_priority": {
"type": "keyword"
},
"template_name": {
"type": "keyword"
},
"enrollment_url": {
"type": "keyword",
"ignore_above": 2048
},
"hsm_backed": {
"type": "boolean"
},
"hsm_vendor": {
"type": "keyword"
}
}
}
}
},
"pqc_readiness": {
"ignore_above": 256,
"type": "keyword"
},
"pqc_vulnerable": {
"type": "boolean"
},
"quantum_risk": {
"ignore_above": 256,
"type": "keyword"
},
"recommended_action": {
"fields": {
"keyword": {
"ignore_above": 512,
"type": "keyword"
}
},
"type": "text"
},
"scan_mode": {
"ignore_above": 256,
"type": "keyword"
},
"scan_timestamp": {
"type": "date"
},
"scanner_version": {
"ignore_above": 256,
"type": "keyword"
},
"type": {
"ignore_above": 256,
"type": "keyword"
}
}
},
"url": {
"properties": {
"domain": {
"ignore_above": 256,
"type": "keyword"
},
"full": {
"ignore_above": 1024,
"type": "keyword"
},
"path": {
"ignore_above": 1024,
"type": "keyword"
},
"port": {
"type": "long"
},
"scheme": {
"ignore_above": 256,
"type": "keyword"
}
}
},
"vpn_client": {
"properties": {
"active": {
"type": "boolean"
},
"config_path": {
"ignore_above": 1024,
"type": "keyword"
},
"detection_confidence": {
"ignore_above": 256,
"type": "keyword"
},
"detection_method": {
"ignore_above": 256,
"type": "keyword"
},
"executable_path": {
"ignore_above": 1024,
"type": "keyword"
},
"first_detected": {
"type": "date"
},
"install_path": {
"ignore_above": 1024,
"type": "keyword"
},
"last_seen": {
"type": "date"
},
"name": {
"ignore_above": 256,
"type": "keyword"
},
"process_id": {
"type": "long"
},
"service_name": {
"ignore_above": 256,
"type": "keyword"
},
"status": {
"ignore_above": 256,
"type": "keyword"
},
"vendor": {
"ignore_above": 256,
"type": "keyword"
},
"version": {
"ignore_above": 256,
"type": "keyword"
}
}
},
"vpn_config": {
"properties": {
"authentication_method": {
"ignore_above": 256,
"type": "keyword"
},
"auto_reconnect": {
"type": "boolean"
},
"config_encrypted": {
"type": "boolean"
},
"dns_leak_protection": {
"type": "boolean"
},
"ipv6_leak_protection": {
"type": "boolean"
},
"kill_switch": {
"type": "boolean"
},
"logging_enabled": {
"type": "boolean"
},
"split_tunneling": {
"type": "boolean"
},
"weak_settings": {
"ignore_above": 256,
"type": "keyword"
}
}
},
"vpn_connection": {
"properties": {
"authentication_algorithm": {
"ignore_above": 256,
"type": "keyword"
},
"bytes_received": {
"type": "long"
},
"bytes_sent": {
"type": "long"
},
"cipher_suite": {
"ignore_above": 256,
"type": "keyword"
},
"connected_since": {
"type": "date"
},
"control_channel_auth": {
"ignore_above": 256,
"type": "keyword"
},
"dh_group": {
"ignore_above": 256,
"type": "keyword"
},
"dns_servers": {
"type": "ip"
},
"encryption_algorithm": {
"ignore_above": 256,
"type": "keyword"
},
"key_exchange_algorithm": {
"ignore_above": 256,
"type": "keyword"
},
"local_ip": {
"ignore_above": 256,
"type": "keyword"
},
"protocol": {
"ignore_above": 256,
"type": "keyword"
},
"remote_ip": {
"ignore_above": 256,
"type": "keyword"
},
"server_address": {
"ignore_above": 256,
"type": "keyword"
},
"server_port": {
"type": "long"
},
"tunnel_interface": {
"ignore_above": 256,
"type": "keyword"
}
}
},
"vulnerability": {
"properties": {
"category": {
"ignore_above": 256,
"type": "keyword"
},
"cve_list": {
"ignore_above": 256,
"type": "keyword"
},
"description": {
"fields": {
"keyword": {
"ignore_above": 512,
"type": "keyword"
}
},
"type": "text"
},
"fixed_in_version": {
"ignore_above": 256,
"type": "keyword"
},
"id": {
"ignore_above": 256,
"type": "keyword"
},
"is_vulnerable": {
"type": "boolean"
},
"name": {
"ignore_above": 256,
"type": "keyword"
},
"risk_level": {
"ignore_above": 256,
"type": "keyword"
},
"risk_reason": {
"fields": {
"keyword": {
"ignore_above": 512,
"type": "keyword"
}
},
"type": "text"
},
"scanner": {
"properties": {
"vendor": {
"ignore_above": 256,
"type": "keyword"
}
}
}
}
},
"x509": {
"properties": {
"enhanced_key_usage": {
"ignore_above": 256,
"type": "keyword"
},
"hash": {
"ignore_above": 256,
"type": "keyword"
},
"is_self_signed": {
"type": "boolean"
},
"is_valid": {
"type": "boolean"
},
"issuer": {
"properties": {
"common_name": {
"ignore_above": 256,
"type": "keyword"
},
"country": {
"ignore_above": 256,
"type": "keyword"
},
"distinguished_name": {
"ignore_above": 1024,
"type": "keyword"
},
"locality": {
"ignore_above": 256,
"type": "keyword"
},
"organization": {
"ignore_above": 256,
"type": "keyword"
},
"organizational_unit": {
"ignore_above": 256,
"type": "keyword"
},
"state_or_province": {
"ignore_above": 256,
"type": "keyword"
}
}
},
"issuer_cn": {
"ignore_above": 256,
"type": "keyword"
},
"key_bits": {
"type": "integer"
},
"key_type": {
"ignore_above": 256,
"type": "keyword"
},
"key_usage": {
"ignore_above": 256,
"type": "keyword"
},
"not_after": {
"type": "date"
},
"not_before": {
"type": "date"
},
"public_key_algorithm": {
"ignore_above": 256,
"type": "keyword"
},
"public_key_curve": {
"ignore_above": 256,
"type": "keyword"
},
"public_key_size": {
"type": "long"
},
"san": {
"type": "keyword",
"ignore_above": 256
},
"serial_number": {
"ignore_above": 256,
"type": "keyword"
},
"sha256_fingerprint": {
"type": "keyword",
"ignore_above": 256
},
"sig_algorithm": {
"ignore_above": 256,
"type": "keyword"
},
"signature_algorithm": {
"ignore_above": 256,
"type": "keyword"
},
"subject": {
"properties": {
"common_name": {
"ignore_above": 256,
"type": "keyword"
},
"country": {
"ignore_above": 256,
"type": "keyword"
},
"distinguished_name": {
"ignore_above": 1024,
"type": "keyword"
},
"locality": {
"ignore_above": 256,
"type": "keyword"
},
"organization": {
"ignore_above": 256,
"type": "keyword"
},
"organizational_unit": {
"ignore_above": 256,
"type": "keyword"
},
"state_or_province": {
"ignore_above": 256,
"type": "keyword"
}
}
},
"subject_cn": {
"ignore_above": 256,
"type": "keyword"
},
"subject_key_identifier": {
"ignore_above": 256,
"type": "keyword"
},
"validity": {
"properties": {
"not_after": {
"type": "date"
},
"not_before": {
"type": "date"
}
}
},
"version_number": {
"type": "long"
}
}
}
}
}
}
}
The full mapping template matches numeric rollover indices tychon-pki-*, applies tychon-pki-policy, and uses tychon-pki-write as the rollover alias. A companion source-index template attaches the self-contained routing pipeline to tychon-pqc-pki so ILM does not manage the scanner source index.
Apply the companion source-index template:
PUT /_index_template/tychon-pqc-pki-routing
{
"index_patterns": ["tychon-pqc-pki"],
"priority": 400,
"template": {
"settings": {
"index.default_pipeline": "tychon-pki-route-to-rollover"
}
}
}Purpose: preserve the scanner’s flat-field normalization before routing each document into the rollover chain. The routing pipeline contains dot_expander, list splitting, routing-field rehydration, failure markers, and rollover routing. It does not depend on another pipeline being installed by the scanner.
The following is the complete self-contained pipeline body. It explicitly includes the scanner normalization and date processors, dot_expander for flat JSON fields, list normalization, routing-field rehydration, rollover routing, and the full failure-diagnostics body.
PUT /_ingest/pipeline/tychon-pki-route-to-rollover
{
"description": "Self-contained combined scanner normalization, dot expansion, list normalization, routing, and rollover pipeline for tychon-pqc-pki",
"on_failure": [
{
"set": {
"description": "Set error flag on pipeline failure",
"field": "error.pipeline",
"value": "Pipeline processing failed: {{_ingest.on_failure_message}}"
}
},
{
"set": {
"description": "Preserve the failed processor",
"field": "error.processor",
"value": "{{_ingest.on_failure_processor_type}}"
}
},
{
"set": {
"field": "tychon.pipeline.failed",
"value": true
}
},
{
"set": {
"field": "tychon.pipeline.route_failed",
"value": true
}
},
{
"set": {
"field": "error.message",
"value": "{{{ _ingest.on_failure_message }}}"
}
},
{
"set": {
"field": "error.processor_type",
"value": "{{{ _ingest.on_failure_processor_type }}}"
}
},
{
"set": {
"field": "error.processor_tag",
"value": "{{{ _ingest.on_failure_processor_tag }}}"
}
},
{
"set": {
"field": "error.pipeline",
"value": "{{{ _ingest.on_failure_pipeline }}}"
}
}
],
"processors": [
{
"set": {
"field": "tychon.pipeline.processed",
"value": true
}
},
{
"remove": {
"field": "host.ipv4",
"if": "ctx?.host?.ipv4 instanceof String && ctx.host.ipv4.trim().length() == 0",
"ignore_missing": true
}
},
{
"remove": {
"field": "host.ipv6",
"if": "ctx?.host?.ipv6 instanceof String && ctx.host.ipv6.trim().length() == 0",
"ignore_missing": true
}
},
{
"dot_expander": {
"field": "*",
"ignore_failure": true
}
},
{
"set": {
"description": "Set event.ingested timestamp",
"field": "event.ingested",
"value": "{{_ingest.timestamp}}"
}
},
{
"set": {
"description": "Ensure @timestamp exists, copy from scan timestamp if missing",
"field": "@timestamp",
"if": "ctx['@timestamp'] == null && ctx?.scan?.timestamp != null",
"value": "{{scan.timestamp}}"
}
},
{
"set": {
"description": "Set @timestamp to ingest time if still missing",
"field": "@timestamp",
"if": "ctx['@timestamp'] == null",
"value": "{{_ingest.timestamp}}"
}
},
{
"script": {
"description": "Determine event type for routing based on fields present",
"lang": "painless",
"source": "if (ctx?.cipher?.cipher_suite != null) { ctx.event_type_routing = 'cipher'; } else if (ctx?.event?.action != null && ctx.event.action.contains('certificate')) { ctx.event_type_routing = 'certificate'; } else if (ctx?.event?.action != null && ctx.event.action.contains('keystore')) { ctx.event_type_routing = 'keystore'; } else if (ctx?.event?.action != null && ctx.event.action.contains('crypto_library')) { ctx.event_type_routing = 'process'; } else if (ctx?.event?.action != null && ctx.event.action.contains('vpn')) { ctx.event_type_routing = 'vpn'; } else if (ctx?.event?.action != null && ctx.event.action.contains('ipsec')) { ctx.event_type_routing = 'ipsec'; } else if (ctx?.quantum?.overall_score != null && ctx?.cipher?.cipher_suite == null) { ctx.event_type_routing = 'quantum'; }"
}
},
{
"script": {
"description": "Reconstruct tychon.certificate_leaf_details nested object from certificate.leaf.* flat fields",
"if": "ctx?.certificate?.leaf != null",
"lang": "painless",
"source": "if (ctx?.certificate?.leaf != null) { if (ctx.tychon == null) { ctx.tychon = [:]; } Map leafDetails = [:]; if (ctx.certificate.leaf.subject != null) { leafDetails.subject = ctx.certificate.leaf.subject; } if (ctx.certificate.leaf.issuer != null) { leafDetails.issuer = ctx.certificate.leaf.issuer; } if (ctx.certificate.leaf.validity != null) { leafDetails.validity = ctx.certificate.leaf.validity; } if (ctx.certificate.leaf.serial_number != null) { leafDetails.serial_number = ctx.certificate.leaf.serial_number; } if (ctx.certificate.leaf.signature_algorithm != null) { leafDetails.signature_algorithm = ctx.certificate.leaf.signature_algorithm; } if (ctx.certificate.leaf.version != null) { leafDetails.version = ctx.certificate.leaf.version; } if (ctx.certificate.leaf.is_self_signed != null) { leafDetails.is_self_signed = ctx.certificate.leaf.is_self_signed; } if (ctx.certificate.leaf.key_usage != null) { leafDetails.key_usage = ctx.certificate.leaf.key_usage; } if (ctx.certificate.leaf.extended_key_usage != null) { leafDetails.extended_key_usage = ctx.certificate.leaf.extended_key_usage; } if (ctx.certificate.leaf.basic_constraints != null) { leafDetails.basic_constraints = ctx.certificate.leaf.basic_constraints; } if (ctx.certificate.leaf.subject_public_key_info != null) { leafDetails.subject_public_key_info = ctx.certificate.leaf.subject_public_key_info; } if (ctx.certificate.leaf.sha256_fingerprint != null) { leafDetails.sha256_fingerprint = ctx.certificate.leaf.sha256_fingerprint; } if (ctx.certificate.leaf.sha1_fingerprint != null) { leafDetails.sha1_fingerprint = ctx.certificate.leaf.sha1_fingerprint; } if (ctx.certificate.leaf.pqc_vulnerable != null) { leafDetails.pqc_vulnerable = ctx.certificate.leaf.pqc_vulnerable; } if (ctx.certificate.leaf.raw_pem_certificate != null) { leafDetails.raw_pem_certificate = ctx.certificate.leaf.raw_pem_certificate; } if (ctx.certificate.leaf.source_id != null) { leafDetails.source_id = ctx.certificate.leaf.source_id; } ctx.tychon.certificate_leaf_details = leafDetails; }"
}
},
{
"script": {
"description": "Reconstruct tychon.cipher_negotiation nested object from cipher.* flat fields",
"if": "ctx?.cipher != null",
"lang": "painless",
"source": "if (ctx?.cipher != null) { if (ctx.tychon == null) { ctx.tychon = [:]; } Map cipherNeg = [:]; if (ctx.cipher.cipher_suite != null) { cipherNeg.cipher_suite = ctx.cipher.cipher_suite; } if (ctx.cipher.protocol != null) { cipherNeg.protocol = ctx.cipher.protocol; } if (ctx.cipher.key_length_bits != null) { cipherNeg.key_length_bits = ctx.cipher.key_length_bits; } if (ctx.cipher.is_preferred != null) { cipherNeg.is_preferred = ctx.cipher.is_preferred; } if (ctx.cipher.active != null) { cipherNeg.active = ctx.cipher.active; } if (ctx.cipher.source != null) { cipherNeg.source = ctx.cipher.source; } if (ctx.cipher.source_id != null) { cipherNeg.source_id = ctx.cipher.source_id; } if (ctx.cipher.universal_id != null) { cipherNeg.universal_id = ctx.cipher.universal_id; } if (ctx.cipher.session_id != null) { cipherNeg.session_id = ctx.cipher.session_id; } if (ctx.cipher.compression_method != null) { cipherNeg.compression_method = ctx.cipher.compression_method; } if (ctx.cipher.alpn_protocol != null) { cipherNeg.alpn_protocol = ctx.cipher.alpn_protocol; } if (ctx.cipher.last_seen != null) { cipherNeg.last_seen = ctx.cipher.last_seen; } if (ctx.cipher.session_ticket_lifetime_hint_seconds != null) { cipherNeg.session_ticket_lifetime_hint_seconds = ctx.cipher.session_ticket_lifetime_hint_seconds; } if (ctx.cipher.intel != null) { cipherNeg.intel = ctx.cipher.intel; } ctx.tychon.cipher_negotiation = cipherNeg; }"
}
},
{
"script": {
"description": "Convert cipher vulnerabilities from comma-separated string to array",
"if": "ctx?.tychon?.cipher_negotiation?.intel?.vulnerabilities != null",
"lang": "painless",
"source": "if (ctx?.tychon?.cipher_negotiation?.intel?.vulnerabilities != null && ctx.tychon.cipher_negotiation.intel.vulnerabilities instanceof String) { String vulnString = ctx.tychon.cipher_negotiation.intel.vulnerabilities; List vulnList = new ArrayList(); String[] parts = vulnString.splitOnToken(','); for (String part : parts) { String trimmed = part.trim(); if (trimmed.length() > 0) { vulnList.add(trimmed); } } ctx.tychon.cipher_negotiation.intel.vulnerabilities = vulnList; }"
}
},
{
"set": {
"description": "Map certificate.leaf fields to x509 namespace for ECS compliance",
"field": "x509.subject.common_name",
"if": "ctx?.certificate?.leaf?.subject?.common_name != null",
"value": "{{certificate.leaf.subject.common_name}}"
}
},
{
"set": {
"description": "Map certificate issuer common name to x509",
"field": "x509.issuer.common_name",
"if": "ctx?.certificate?.leaf?.issuer?.common_name != null",
"value": "{{certificate.leaf.issuer.common_name}}"
}
},
{
"set": {
"description": "Map certificate issuer organization to x509",
"field": "x509.issuer.organization",
"if": "ctx?.certificate?.leaf?.issuer?.organization != null",
"value": "{{certificate.leaf.issuer.organization}}"
}
},
{
"set": {
"description": "Map certificate subject organization to x509",
"field": "x509.subject.organization",
"if": "ctx?.certificate?.leaf?.subject?.organization != null",
"value": "{{certificate.leaf.subject.organization}}"
}
},
{
"set": {
"description": "Map certificate serial number to x509",
"field": "x509.serial_number",
"if": "ctx?.certificate?.leaf?.serial_number != null",
"value": "{{certificate.leaf.serial_number}}"
}
},
{
"set": {
"description": "Map certificate signature algorithm to x509",
"field": "x509.signature_algorithm",
"if": "ctx?.certificate?.leaf?.signature_algorithm != null",
"value": "{{certificate.leaf.signature_algorithm}}"
}
},
{
"set": {
"description": "Map certificate validity not_before to x509",
"field": "x509.not_before",
"if": "ctx?.certificate?.leaf?.validity?.not_before != null",
"value": "{{certificate.leaf.validity.not_before}}"
}
},
{
"set": {
"description": "Map certificate validity not_after to x509",
"field": "x509.not_after",
"if": "ctx?.certificate?.leaf?.validity?.not_after != null",
"value": "{{certificate.leaf.validity.not_after}}"
}
},
{
"set": {
"description": "Map certificate public key algorithm to x509",
"field": "x509.public_key_algorithm",
"if": "ctx?.certificate?.leaf?.subject_public_key_info?.algorithm != null",
"value": "{{certificate.leaf.subject_public_key_info.algorithm}}"
}
},
{
"set": {
"description": "Map certificate public key size to x509",
"field": "x509.public_key_size",
"if": "ctx?.certificate?.leaf?.subject_public_key_info?.bit_size != null",
"value": "{{certificate.leaf.subject_public_key_info.bit_size}}"
}
},
{
"set": {
"description": "Map certificate public key curve to x509",
"field": "x509.public_key_curve",
"if": "ctx?.certificate?.leaf?.subject_public_key_info?.curve != null",
"value": "{{certificate.leaf.subject_public_key_info.curve}}"
}
},
{
"date": {
"description": "Parse certificate not_before date",
"field": "certificate.leaf.validity.not_before",
"formats": [
"ISO8601",
"yyyy-MM-dd'T'HH:mm:ssXXX",
"yyyy-MM-dd'T'HH:mm:ss.SSSXXX",
"yyyy-MM-dd HH:mm:ss",
"MMM dd HH:mm:ss yyyy 'GMT'"
],
"if": "ctx?.certificate?.leaf?.validity?.not_before != null",
"on_failure": [
{
"append": {
"field": "error.pipeline",
"value": "Failed to parse certificate.leaf.validity.not_before: {{_ingest.on_failure_message}}"
}
}
],
"target_field": "certificate.leaf.validity.not_before"
}
},
{
"date": {
"description": "Parse certificate not_after date",
"field": "certificate.leaf.validity.not_after",
"formats": [
"ISO8601",
"yyyy-MM-dd'T'HH:mm:ssXXX",
"yyyy-MM-dd'T'HH:mm:ss.SSSXXX",
"yyyy-MM-dd HH:mm:ss",
"MMM dd HH:mm:ss yyyy 'GMT'"
],
"if": "ctx?.certificate?.leaf?.validity?.not_after != null",
"on_failure": [
{
"append": {
"field": "error.pipeline",
"value": "Failed to parse certificate.leaf.validity.not_after: {{_ingest.on_failure_message}}"
}
}
],
"target_field": "certificate.leaf.validity.not_after"
}
},
{
"date": {
"description": "Parse cipher last_seen date",
"field": "cipher.last_seen",
"formats": [
"ISO8601",
"yyyy-MM-dd'T'HH:mm:ssXXX",
"yyyy-MM-dd'T'HH:mm:ss.SSSXXX"
],
"if": "ctx?.cipher?.last_seen != null",
"on_failure": [
{
"append": {
"field": "error.pipeline",
"value": "Failed to parse cipher.last_seen: {{_ingest.on_failure_message}}"
}
}
],
"target_field": "cipher.last_seen"
}
},
{
"set": {
"description": "Set event.dataset to default if missing",
"field": "event.dataset",
"if": "ctx?.event?.dataset == null",
"value": "tychon.pqc"
}
},
{
"set": {
"description": "Set event.kind to event if missing",
"field": "event.kind",
"if": "ctx?.event?.kind == null",
"value": "event"
}
},
{
"split": {
"field": "tls.supported_protocols",
"if": "ctx?.tls?.supported_protocols instanceof String",
"ignore_missing": true,
"separator": ",\\s*"
}
},
{
"split": {
"field": "tls.supported_ciphers",
"if": "ctx?.tls?.supported_ciphers instanceof String",
"ignore_missing": true,
"separator": ",\\s*"
}
},
{
"split": {
"field": "tls.supported_key_exchanges",
"if": "ctx?.tls?.supported_key_exchanges instanceof String",
"ignore_missing": true,
"separator": ",\\s*"
}
},
{
"split": {
"field": "tls.previous_supported_protocols",
"if": "ctx?.tls?.previous_supported_protocols instanceof String",
"ignore_missing": true,
"separator": ",\\s*"
}
},
{
"split": {
"field": "tls.previous_supported_ciphers",
"if": "ctx?.tls?.previous_supported_ciphers instanceof String",
"ignore_missing": true,
"separator": ",\\s*"
}
},
{
"split": {
"field": "tls.previous_supported_key_exchanges",
"if": "ctx?.tls?.previous_supported_key_exchanges instanceof String",
"ignore_missing": true,
"separator": ",\\s*"
}
},
{
"split": {
"field": "tychon.cipher_quick.supported_protocols",
"if": "ctx?.tychon?.cipher_quick?.supported_protocols instanceof String",
"ignore_missing": true,
"separator": ",\\s*"
}
},
{
"split": {
"field": "tychon.cipher_quick.supported_cipher_suites",
"if": "ctx?.tychon?.cipher_quick?.supported_cipher_suites instanceof String",
"ignore_missing": true,
"separator": ",\\s*"
}
},
{
"split": {
"field": "tychon.cipher_quick.supported_key_exchanges",
"if": "ctx?.tychon?.cipher_quick?.supported_key_exchanges instanceof String",
"ignore_missing": true,
"separator": ",\\s*"
}
},
{
"split": {
"field": "tls.insecure_ciphers",
"if": "ctx?.tls?.insecure_ciphers instanceof String",
"ignore_missing": true,
"separator": ",\\s*"
}
},
{
"split": {
"field": "tls.weak_ciphers",
"if": "ctx?.tls?.weak_ciphers instanceof String",
"ignore_missing": true,
"separator": ",\\s*"
}
},
{
"split": {
"field": "tychon.cipher_quick.insecure_ciphers",
"if": "ctx?.tychon?.cipher_quick?.insecure_ciphers instanceof String",
"ignore_missing": true,
"separator": ",\\s*"
}
},
{
"split": {
"field": "tychon.cipher_quick.weak_ciphers",
"if": "ctx?.tychon?.cipher_quick?.weak_ciphers instanceof String",
"ignore_missing": true,
"separator": ",\\s*"
}
},
{
"split": {
"field": "host.ip",
"if": "ctx?.host?.ip instanceof String",
"ignore_missing": true,
"separator": ",\\s*"
}
},
{
"split": {
"field": "tychon.routing.original.host_ip",
"if": "ctx?.tychon?.routing?.original?.host_ip instanceof String",
"ignore_missing": true,
"separator": ",\\s*"
}
},
{
"split": {
"field": "tychon.routing.target.ip",
"if": "ctx?.tychon?.routing?.target?.ip instanceof String",
"ignore_missing": true,
"separator": ",\\s*"
}
},
{
"split": {
"field": "tychon.tags",
"ignore_missing": true,
"separator": ",\\s*"
}
},
{
"split": {
"field": "tychon.installed_app.crypto_libraries",
"ignore_missing": true,
"separator": ",\\s*"
}
},
{
"set": {
"field": "host.hostname",
"if": "ctx?.tychon?.routing?.original?.host_hostname != null && ctx.tychon.routing.original.host_hostname != ''",
"ignore_empty_value": true,
"value": "{{tychon.routing.original.host_hostname}}"
}
},
{
"set": {
"field": "host.id",
"if": "ctx?.tychon?.routing?.original?.host_id != null && ctx.tychon.routing.original.host_id != ''",
"ignore_empty_value": true,
"value": "{{tychon.routing.original.host_id}}"
}
},
{
"set": {
"copy_from": "tychon.routing.original.host_ip",
"field": "host.ip",
"if": "ctx?.tychon?.routing?.original?.host_ip != null",
"ignore_empty_value": true
}
},
{
"set": {
"field": "host.ipv4",
"if": "ctx?.tychon?.routing?.original?.host_ipv4 != null && ctx.tychon.routing.original.host_ipv4 != ''",
"ignore_empty_value": true,
"value": "{{tychon.routing.original.host_ipv4}}"
}
},
{
"set": {
"field": "host.ipv6",
"if": "ctx?.tychon?.routing?.original?.host_ipv6 != null && ctx.tychon.routing.original.host_ipv6 != ''",
"ignore_empty_value": true,
"value": "{{tychon.routing.original.host_ipv6}}"
}
},
{
"set": {
"field": "host.architecture",
"if": "ctx?.tychon?.routing?.original?.host_architecture != null && ctx.tychon.routing.original.host_architecture != ''",
"ignore_empty_value": true,
"value": "{{tychon.routing.original.host_architecture}}"
}
},
{
"set": {
"field": "host.os.name",
"if": "ctx?.tychon?.routing?.original?.host_os_name != null && ctx.tychon.routing.original.host_os_name != ''",
"ignore_empty_value": true,
"value": "{{tychon.routing.original.host_os_name}}"
}
},
{
"set": {
"field": "host.os.platform",
"if": "ctx?.tychon?.routing?.original?.host_os_platform != null && ctx.tychon.routing.original.host_os_platform != ''",
"ignore_empty_value": true,
"value": "{{tychon.routing.original.host_os_platform}}"
}
},
{
"set": {
"field": "host.os.family",
"if": "ctx?.tychon?.routing?.original?.host_os_family != null && ctx.tychon.routing.original.host_os_family != ''",
"ignore_empty_value": true,
"value": "{{tychon.routing.original.host_os_family}}"
}
},
{
"set": {
"field": "host.os.version",
"if": "ctx?.tychon?.routing?.original?.host_os_version != null && ctx.tychon.routing.original.host_os_version != ''",
"ignore_empty_value": true,
"value": "{{tychon.routing.original.host_os_version}}"
}
},
{
"set": {
"field": "source.user.id",
"if": "ctx?.tychon?.routing?.source?.observer_id != null && ctx.tychon.routing.source.observer_id != ''",
"ignore_empty_value": true,
"value": "{{tychon.routing.source.observer_id}}"
}
},
{
"set": {
"field": "source.domain",
"if": "ctx?.tychon?.routing?.source?.hostname != null && ctx.tychon.routing.source.hostname != ''",
"ignore_empty_value": true,
"value": "{{tychon.routing.source.hostname}}"
}
},
{
"set": {
"field": "destination.address",
"if": "ctx?.tychon?.routing?.target?.address != null && ctx.tychon.routing.target.address != ''",
"ignore_empty_value": true,
"value": "{{tychon.routing.target.address}}"
}
},
{
"set": {
"copy_from": "tychon.routing.target.ip",
"field": "destination.ip",
"if": "ctx?.tychon?.routing?.target?.ip != null",
"ignore_empty_value": true
}
},
{
"set": {
"field": "_index",
"value": "tychon-pki-write"
}
}
]
}Paste the complete JSON body from elasticsearch/pki/ingest-pipeline.json. This is a self-contained pipeline and does not depend on tychon-pqc-flat-ndjson-pipeline existing separately.
Only run this settings request if tychon-pqc-pki already exists and predates the source-index template. If the source index does not exist, skip this request; the source-index template applies the setting when Elasticsearch creates it.
PUT /tychon-pqc-pki/_settings
{
"index.default_pipeline": "tychon-pki-route-to-rollover"
}Purpose: Verify template selection before creating the next generation.
POST /_index_template/_simulate_index/tychon-pki-000002Do not send a request body for this endpoint. If Elasticsearch returns Required [index_patterns], verify that the template exists and includes its pattern:
GET /_index_template/tychon-pkiThe response must contain "index_patterns": ["tychon-pki-*"].
Purpose: Create the initial numeric generation managed by ILM.
PUT /tychon-pki-000001
{
"aliases": {
"tychon-pki-write": {
"is_write_index": true
},
"tychon-pki-read": {}
}
}The index template adds tychon-pki-read to every new rollover generation. The bootstrap request adds it to the first generation.
If numbered PKI indices already exist, adding the alias to the template does not update those existing indices. Repair the existing read path once, after applying the template:
POST /_aliases
{
"actions": [
{
"add": {
"index": "tychon-pki-*",
"alias": "tychon-pki-read"
}
}
]
}Use an explicit list of PKI generation indices instead of tychon-pki-* if unrelated indices share that prefix.
GET /_ilm/policy/tychon-pki-policy
GET /_index_template/tychon-pki
GET /_alias/tychon-pki-write
GET /_alias/tychon-pki-read
GET /tychon-pki-000001/_ilm/explain
GET /tychon-pki-read/_countAfter rollover, repeat GET /_alias/tychon-pki-read and confirm that every numbered tychon-pki-* generation is present. The read alias must cover all generations, not only the current write index.
Purpose: Give analysts read-only PKI and dashboard access without index-management privileges.
PUT /_security/role/tychon-pki-viewer
{
"cluster": [],
"indices": [
{
"names": ["tychon-pki-*"],
"privileges": ["read"]
}
],
"applications": [
{
"application": "kibana-.kibana",
"privileges": [
"feature_dashboard.read",
"feature_discover.read"
],
"resources": ["space:default"]
}
],
"run_as": [],
"metadata": {
"description": "Read-only access to TYCHON PKI dashboards and PKI indices"
}
}Import the supplied Kibana saved-object package through Kibana. The package includes the data view, runtime fields, dashboards, and the PKI Platform Stale SIEM rule. Do not create the rule separately through the Kibana API.
tychon-pki matches tychon-pki-*; source template tychon-pqc-pki-routing matches tychon-pqc-pki.tychon-pki-000001 exists and exactly one generation is writable.tychon-pqc-pki to tychon-pki-write.Mock data and credentials are intentionally excluded.