Splunk Dashboard: Application Detail

Detailed application inventory, communication details, and cryptographic configuration.

The Application Detail dashboard provides detailed application inventory and cryptographic configuration information. It summarizes application processes, executable directories, ports, versions, key-exchange readiness, TLS protocol readiness, asset presence, communication attributes, and supported ciphers.

Default time range: Last 30 days Primary focus: Application inventory, communication details, and cryptographic configuration

Operational guidance: Start with the application summary to identify the dominant process names, directories, ports, versions, and readiness tiers. Then use the inventory and communication tables to locate affected assets and understand observed connections. Finish with the cipher tables to identify weak, insecure, and supported cipher values.

Panels

Panel Type What It Shows
Process NameTableMost frequently observed application process names.
Directory PathTableExecutable directory paths associated with the filtered applications.
Post-Quantum Cryptography Readiness - Key ExchangeTableKey-exchange technologies grouped into PQC READY, MODERN, CLASSICAL, and LEGACY readiness tiers.
TLS Protocol Version - Preferred ProtocolTablePreferred TLS protocol versions and their readiness classifications.
Ports IdentifiedTableObserved server ports and the number of records and processes associated with each port.
Versions FoundTableObserved software versions and the number of records and processes associated with each version.
Found on AssetsTableHosts or assets on which the applications were observed.
Application Communication DetailsTableApplication communication attributes for the filtered dataset.
Supported Weak CiphersTableWeak cipher values reported by the filtered applications.
Supported Insecure CiphersTableInsecure cipher values reported by the filtered applications.
Supported CiphersTableOverall supported cipher inventory for the filtered applications.

Key Data Fields

Field Description
process.nameApplication process name.
process.executable_directoryDirectory containing the application executable.
server.portObserved server port.
omb.software_package_versionObserved software package version.
host_idAsset identifier used in host inventory.
omb.kex_tierKey-exchange readiness tier.
omb.protocol_tierTLS protocol readiness tier.
tls.weak_ciphers / tls.insecure_ciphers / tls.supported_ciphersWeak, insecure, and supported cipher values used for investigation.

Reading the Dashboard

Review process, directory, port, and version summaries

These panels establish the application footprint before you inspect host and connection-level detail.

Compare key exchange and TLS protocol readiness

Use the readiness tables to see how the filtered application population is classified.

Use Found on Assets for deployment scope

This table identifies where the applications are deployed across the environment.

Finish with the cipher inventories

Review weak, insecure, and supported ciphers to identify concrete remediation work.

Filtering and Implementation Notes

Use the Time Range, Key Exchange, and TLS Protocol controls. Key Exchange and TLS Protocol default to All.

The readiness filters apply together across the dashboard, so selecting both narrows results to records matching both conditions.