Newline-delimited JSON optimized for streaming and log analysis
The Flat NDJSON format outputs one JSON record per line, with each line representing a single cipher suite, certificate, crypto library, or other cryptographic asset. All nested structures are flattened using dot notation.
./certscanner -host example.com \
-outputformat flatndjson \
-output stream.ndjsonEach line represents a single cryptographic asset event. Different event types share common base fields but include type-specific fields. The checkmark columns indicate which output mode includes each field.
| Field | Type | Required | Description | Example | Full | Standard | Minimal |
|---|---|---|---|---|---|---|---|
| @timestamp | String | Yes | Event timestamp (ISO 8601) | "2025-09-02T13:45:30.123Z" | ✓ | ✓ | ✓ |
| event.action | String | Yes | Event type identifier | "cipher_suite_discovered" | ✓ | ✓ | ✓ |
| event.category | String | Yes | ECS event category | "host", "network" | ✓ | ✓ | ✓ |
| event.kind | String | Yes | ECS event kind (always "event") | "event" | ✓ | ✓ | ✓ |
| event.type | String | Yes | ECS event type | "info", "connection" | ✓ | ✓ | ✓ |
| event.dataset | String | Yes | Dataset name | "port_detail" | ✓ | ✓ | ✓ |
| tychon.type | String | Yes | Tychon-specific event type | "cipher" | ✓ | ✓ | ✓ |
| tychon.index | String | Yes | Elasticsearch index routing slug. Full index name = tychon-pqc-{tychon.index}. Stamped on every event so consumers can route documents without their own mapping table. | "ciphers" | ✓ | ✓ | ✓ |
| observer.hostname | String | Yes | Scanning system hostname | "scanner-host" | ✓ | ✓ | ✓ |
| observer.ip | Array | No | Scanner IP addresses | ["192.168.1.100"] | ✓ | ✓ | ✓ |
| observer.id | String | No | Host ID of scanning system | "host-abc123" | ✓ | ✓ | ✓ |
| observer.os.name | String | Yes | Scanner OS name | "Windows" | ✓ | ✓ | ✓ |
| observer.os.version | String | No | Scanner OS version | "10.0.19045" | ✓ | ✓ | ✗ |
| observer.os.family | String | No | OS family | "Darwin" | ✓ | ✓ | ✗ |
| observer.os.platform | String | No | OS platform name | "darwin" | ✓ | ✓ | ✗ |
| observer.os.kernel | String | No | Kernel version | "24.5.0" | ✓ | ✓ | ✗ |
| observer.os.build | String | No | OS build number (Windows only — e.g., "19045") | "19045" | ✓ | ✓ | ✗ |
| observer.architecture | String | No | CPU architecture | "x86_64" | ✓ | ✓ | ✗ |
| observer.cpu_cores | Integer | No | Number of physical CPU cores | 8 | ✓ | ✓ | ✗ |
| observer.cpu_logical_cores | Integer | No | Number of logical CPU cores | 16 | ✓ | ✓ | ✗ |
| observer.total_ram | Long | No | Total RAM in bytes | 34359738368 | ✓ | ✓ | ✗ |
| observer.cpu_vendor_id | String | No | CPU vendor identifier | "GenuineIntel" | ✓ | ✗ | ✗ |
| observer.cpu_model_name | String | No | CPU model name | "Intel Core i7" | ✓ | ✗ | ✗ |
| observer.kernel_arch | String | No | Kernel architecture | "x86_64" | ✓ | ✓ | ✗ |
| observer.virtualization_system | String | No | Virtualization system | "kvm" | ✓ | ✓ | ✗ |
| observer.virtualization_role | String | No | Virtualization role | "guest" | ✓ | ✓ | ✗ |
| observer.ram_used_percent | Float | No | RAM used percentage | 45.2 | ✓ | ✗ | ✗ |
| observer.system_uptime_seconds | Long | No | System uptime in seconds | 3456789 | ✓ | ✗ | ✗ |
| observer.openssl_version_used | String | No | OpenSSL version used | "OpenSSL 3.0.8" | ✓ | ✓ | ✗ |
| observer.openssl_path_used | String | No | Path to OpenSSL binary | "/usr/bin/openssl" | ✓ | ✗ | ✗ |
| observer.machine_serial_number | String | No | Machine serial number | "C02XG0F3JG5H" | ✓ | ✗ | ✗ |
| observer.bios_serial_number | String | No | BIOS serial number | "VMware-56 4d" | ✓ | ✗ | ✗ |
| observer.organization | String | No | Organization name | "Acme Corp" | ✓ | ✓ | ✗ |
| observer.domain | String | No | Domain name | "acme.local" | ✓ | ✓ | ✗ |
| observer.current_user | String | No | Current user | "admin" | ✓ | ✓ | ✗ |
| observer.user_uid | String | No | User UID | "1000" | ✓ | ✗ | ✗ |
| observer.user_gid | String | No | User GID | "1000" | ✓ | ✗ | ✗ |
| observer.user_home_dir | String | No | User home directory | "/home/admin" | ✓ | ✗ | ✗ |
| observer.fips_mode_enabled | Boolean | Yes | FIPS 140-2 mode status | true | ✓ | ✓ | ✗ |
| observer.bigfix_client_installed | Boolean | No | BigFix client installed | true | ✓ | ✓ | ✗ |
| observer.bigfix_client_id | String | No | BigFix client ID | "12345678" | ✓ | ✓ | ✗ |
| observer.is_vdi_environment | Boolean | No | True when scanner runs in a non-persistent VDI session (VMware Horizon, Citrix, AVD) | true | ✓ | ✓ | ✗ |
| observer.vdi_identity_source | String | No | Method used to resolve stable host identity in VDI mode: cli_override, profile_file, username_hash, or gopsutil | "profile_file" | ✓ | ✓ | ✗ |
| observer.output_schema_version | String | Yes | Version of the flat NDJSON output schema. | "3.0" | ✓ | ✓ | ✓ |
| observer.software.name | String | Yes | Tool name | "TYCHON Quantum Readiness" | ✓ | ✓ | ✗ |
| observer.software.version | String | Yes | Tool version | "2.0.0" | ✓ | ✓ | ✗ |
| scan.type | String | Yes | Scan mode | "local" | ✓ | ✓ | ✓ |
| scan.target | String | Yes | Original target specification | "example.com:443" | ✓ | ✓ | ✓ |
| scan.target_input | String | No | Target input provided | "192.168.1.0/24" | ✓ | ✓ | ✗ |
| scan.timestamp | Date | No | Scan timestamp | "2025-09-15T10:15:39Z" | ✓ | ✓ | ✗ |
| scan.tags | String[] | No | Tags applied to scan | ["production"] | ✓ | ✓ | ✗ |
| tags | Array | No | Custom scan tags | ["prod", "compliance"] | ✓ | ✓ | ✗ |
For events with event.dataset="port_detail". One row per (host, port) — upserted on each scan using a stable id derived from SHA-256(port_detail | hostname | host | port). When a server is upgraded from TLS 1.2 to TLS 1.3, the document is updated in-place rather than creating a new one. The preferred (highest-priority) cipher appears in tls.server.cipher; the full supported set is comma-joined in tls.server.supported_ciphers.
| Field | Type | Description | Example | Full | Standard | Minimal |
|---|---|---|---|---|---|---|
| target_host.address | String | Target host address | "192.168.1.10" | ✓ | ✓ | ✓ |
| target_host.domain | String | Target host domain | "server.acme.local" | ✓ | ✓ | ✗ |
| target_host.ip | IP | Target host IP | "192.168.1.10" | ✓ | ✓ | ✗ |
| target_host.ipv4 | IP | Target host IPv4 | "192.168.1.10" | ✓ | ✓ | ✗ |
| target_host.ipv6 | IP | Target host IPv6 | "fe80::1" | ✓ | ✓ | ✗ |
| server.address | String | Server address | "192.168.1.10" | ✓ | ✓ | ✓ |
| server.port | Integer | Server port | 443 | ✓ | ✓ | ✓ |
| server.ip | IP | Server IP | "192.168.1.10" | ✓ | ✓ | ✗ |
| port.number | Integer | Port number | 443 | ✓ | ✓ | ✓ |
| port.status_overall | String | Port status | "open" | ✓ | ✓ | ✓ |
| port.protocol_detected | String | Detected protocol | "https" | ✓ | ✓ | ✗ |
| error.message | String | Error message if failed | "Connection timeout" | ✓ | ✓ | ✗ |
| network.protocol | String | Network protocol | "tls" | ✓ | ✓ | ✗ |
| network.transport | String | Network transport | "tcp" | ✓ | ✓ | ✗ |
| service.name | String | Service name | "https" | ✓ | ✓ | ✗ |
| service.version | String | Service version | "nginx/1.21.0" | ✓ | ✓ | ✗ |
| Field | Type | Description | Example | Full | Standard | Minimal | |
|---|---|---|---|---|---|---|---|
| quantum_ready | Boolean | Overall quantum readiness | true | ✓ | ✓ | ✓ | |
| quantum_ready_kx | Boolean | Key exchange quantum-ready | true | ✓ | ✓ | ✓ | |
| quantum_ready_cipher | Boolean | Cipher quantum-ready | true | ✓ | ✓ | ✓ | |
| quantum_ready_cert | Boolean | Certificate quantum-ready | false | ✓ | ✓ | ✓ | |
| tychon.crypto.protocol | String | No | Canonical protocol name — always TLS for cipher events | "TLS" | ✓ | ✓ | ✓ |
| tychon.crypto.protocol_version | String | No | TLS version number (e.g. 1.3, 1.2) | "1.3" | ✓ | ✓ | ✗ |
| tychon.crypto.key_exchange | String | No | Negotiated key exchange group (e.g. x25519, X25519MLKEM768) | "X25519MLKEM768" | ✓ | ✓ | ✗ |
| tychon.crypto.cipher | String | No | Bulk cipher extracted from cipher suite (e.g. AES-256-GCM) | "AES-256-GCM" | ✓ | ✓ | ✗ |
| tychon.crypto.mac | String | No | MAC / AEAD tag algorithm (e.g. SHA-384) | "SHA-384" | ✓ | ✓ | ✗ |
| tychon.crypto.auth | String | No | Server authentication / signature digest (e.g. RSA-SHA256) | "RSA-SHA256" | ✓ | ✓ | ✗ |
| tychon.crypto.pqc_vulnerable | Boolean | No | True when key exchange or cipher is vulnerable to a quantum computer | false | ✓ | ✓ | ✓ |
| tychon.crypto.pqc_readiness | String | No | Canonical readiness: ready, transitional, vulnerable, or critical | "ready" | ✓ | ✓ | ✓ |
| tychon.crypto.quantum_risk | String | No | Canonical risk: none, low, medium, high, or critical | "none" | ✓ | ✓ | ✓ |
Preferred cipher is the server's top choice; full enumeration is comma-joined for easy querying without array handling.
| Field | Type | Description | Example | Full | Standard | Minimal |
|---|---|---|---|---|---|---|
| id | String | Stable upsert ID — SHA-256(cipher_suite | host | port | cipher | protocol | kex_group | [observerID]) truncated to 16 hex chars. One record per unique (host, port, cipher suite, protocol, key exchange group). Local scans include observerID; remote scans exclude it so the same cipher on two different scanners yields the same ID. | "a3f1bc920d4e8f12" | ✓ | ✓ | ✗ |
| tls.server.cipher | String | Preferred cipher suite name | "TLS_AES_256_GCM_SHA384" | ✓ | ✓ | ✗ |
| tls.server.protocol_version | String | Preferred TLS protocol version | "TLSv1.3" | ✓ | ✓ | ✗ |
| tls.server.negotiated_group | String | Preferred key exchange group | "X25519MLKEM768" | ✓ | ✓ | ✗ |
| tls.server.supported_ciphers | String | Comma-joined list of all supported cipher suites | "TLS_AES_256_GCM_SHA384, TLS_AES_128_GCM_SHA256" | ✓ | ✓ | ✗ |
| tls.server.cipher_count | Integer | Number of supported cipher suites discovered | 2 | ✓ | ✓ | ✗ |
| tls.server.supported_protocols | String | Comma-joined list of all supported TLS protocol versions | "TLSv1.3, TLSv1.2" | ✓ | ✓ | ✗ |
| tls.server.supported_key_exchanges | String | Comma-joined list of all key exchange groups offered | "X25519MLKEM768, x25519, secp256r1" | ✓ | ✓ | ✗ |
| Field | Type | Description | Example | Full | Standard | Minimal |
|---|---|---|---|---|---|---|
| tychon.cipher_negotiation.intel.encryption_algorithm | String | Encryption algorithm | "AES-GCM" | ✓ | ✓ | ✗ |
| tychon.cipher_negotiation.intel.key_exchange_algorithm | String | Key exchange algorithm | "ECDHE" | ✓ | ✓ | ✗ |
| tychon.cipher_negotiation.intel.authentication_algorithm | String | Authentication algorithm | "RSA" | ✓ | ✓ | ✗ |
| tychon.cipher_negotiation.intel.mac_algorithm | String | MAC algorithm | "AEAD" | ✓ | ✓ | ✗ |
| tychon.cipher_negotiation.intel.encryption_bits | Integer | Encryption bit strength | 256 | ✓ | ✓ | ✗ |
| tychon.cipher_negotiation.intel.key_exchange_bits | Integer | Key exchange bits | 256 | ✓ | ✓ | ✗ |
| tychon.cipher_negotiation.intel.authentication_bits | Integer | Authentication bits | 2048 | ✓ | ✓ | ✗ |
| tychon.cipher_negotiation.intel.overall_risk | String | Overall risk | "low" | ✓ | ✓ | ✗ |
| tychon.cipher_negotiation.intel.security_level | String | Security level | "high" | ✓ | ✓ | ✗ |
| tychon.cipher_negotiation.intel.is_quantum_ready | Boolean | Is quantum ready | false | ✓ | ✓ | ✗ |
| tychon.cipher_negotiation.intel.is_pqc | Boolean | Is post-quantum | false | ✓ | ✓ | ✗ |
| tychon.cipher_negotiation.intel.is_fips140_2_compliant | Boolean | FIPS 140-2 compliant | true | ✓ | ✓ | ✗ |
| tychon.cipher_negotiation.intel.is_nist_approved | Boolean | NIST approved | true | ✓ | ✓ | ✗ |
| tychon.cipher_negotiation.intel.nist_security_category | String | NIST category | "recommended" | ✓ | ✓ | ✗ |
| tychon.cipher_negotiation.intel.cve_list | String | Known CVEs | "" | ✓ | ✓ | ✗ |
| tychon.cipher_negotiation.intel.vulnerabilities | String | Known vulnerabilities | "" | ✓ | ✓ | ✗ |
| tychon.cipher_negotiation.intel.recommendations | String | Recommendations | "Use for production" | ✓ | ✓ | ✗ |
| tychon.cipher_negotiation.intel.description | String | Cipher description | "Modern AEAD cipher" | ✓ | ✓ | ✗ |
| tychon.cipher_negotiation.intel.openssl_name | String | OpenSSL name | "TLS_AES_256_GCM_SHA384" | ✓ | ✓ | ✗ |
| tychon.cipher_negotiation.intel.iana_name | String | IANA name | "TLS_AES_256_GCM_SHA384" | ✓ | ✓ | ✗ |
| tychon.cipher_negotiation.intel.tls_version_min | String | Minimum TLS version | "TLSv1.3" | ✓ | ✓ | ✗ |
For events with event.dataset="certificate" or event.dataset="private_key"
| Field | Type | Description | Example | Full | Standard | Minimal | |
|---|---|---|---|---|---|---|---|
| file.path | String | Full path to certificate | "/etc/ssl/certs/server.pem" | ✓ | ✓ | ✗ | |
| file.name | String | Certificate filename | "server.pem" | ✓ | ✓ | ✗ | |
| file.extension | String | File extension | "pem" | ✓ | ✓ | ✗ | |
| file.size | Integer | File size in bytes | 4096 | ✓ | ✓ | ✗ | |
| file.mtime | Date | File modification time | "2024-01-15T12:30:00Z" | ✓ | ✓ | ✗ | |
| file.owner.name | String | File owner | "root" | ✓ | ✓ | ✗ | |
| file.group.name | String | File group | "root" | ✓ | ✓ | ✗ | |
| file.permissions | String | File permissions | "0600" | ✓ | ✓ | ✗ | |
| certificate.subject | String | Subject DN (raw) | "CN=example.com,O=Acme" | ✓ | ✓ | ✗ | |
| certificate.subject_common_name | String | Subject CN | "example.com" | ✓ | ✓ | ✗ | |
| certificate.subject_country | String[] | Subject country | ["US"] | ✓ | ✓ | ✗ | |
| certificate.subject_organization | String[] | Subject organization | ["Acme"] | ✓ | ✓ | ✗ | |
| certificate.subject_organizational_unit | String[] | Subject OU | ["IT"] | ✓ | ✓ | ✗ | |
| certificate.subject_locality | String[] | Subject locality | ["SF"] | ✓ | ✓ | ✗ | |
| certificate.subject_province | String[] | Subject province | ["CA"] | ✓ | ✓ | ✗ | |
| certificate.issuer | String | Issuer DN (raw) | "CN=Root CA" | ✓ | ✓ | ✗ | |
| certificate.issuer_common_name | String | Issuer CN | "Root CA" | ✓ | ✓ | ✗ | |
| certificate.issuer_country | String[] | Issuer country | ["US"] | ✓ | ✓ | ✗ | |
| certificate.issuer_organization | String[] | Issuer organization | ["Acme"] | ✓ | ✓ | ✗ | |
| certificate.issuer_organizational_unit | String[] | Issuer OU | ["CA"] | ✓ | ✓ | ✗ | |
| certificate.issuer_locality | String[] | Issuer locality | ["SF"] | ✓ | ✓ | ✗ | |
| certificate.issuer_province | String[] | Issuer province | ["CA"] | ✓ | ✓ | ✗ | |
| certificate.not_before | Date | Valid from | "2024-01-01T00:00:00Z" | ✓ | ✓ | ✗ | |
| certificate.not_after | Date | Valid until | "2025-01-01T00:00:00Z" | ✓ | ✓ | ✗ | |
| certificate.is_private_key | Boolean | Is private key file | false | ✓ | ✓ | ✗ | |
| x509.subject.distinguished_name | String | Subject DN | "CN=example.com" | ✓ | ✓ | ✗ | |
| x509.issuer.distinguished_name | String | Issuer DN | "CN=Root CA" | ✓ | ✓ | ✗ | |
| x509.public_key_size | Integer | Public key size | 2048 | ✓ | ✓ | ✗ | |
| crypto.key_algorithm | String | Key algorithm | "RSA" | ✓ | ✓ | ✗ | |
| crypto.key_size | Integer | Key size in bits | 2048 | ✓ | ✓ | ✗ | |
| crypto.signature_algorithm | String | Signature algorithm | "SHA256withRSA" | ✓ | ✓ | ✗ | |
| hash.sha256_certificate | String | SHA-256 fingerprint | "a1b2c3..." | ✓ | ✓ | ✗ | |
| tychon.crypto.protocol | String | No | Always X.509 for filesystem certificate events | "X.509" | ✓ | ✓ | ✓ |
| tychon.crypto.cipher | String | No | Public key algorithm (e.g. RSA-2048, ECDSA-P256) | "RSA-2048" | ✓ | ✓ | ✗ |
| tychon.crypto.pqc_vulnerable | Boolean | No | True when the certificate's public key algorithm is vulnerable to a quantum computer | true | ✓ | ✓ | ✓ |
| tychon.crypto.pqc_readiness | String | No | Canonical readiness: ready, transitional, vulnerable, or critical | "vulnerable" | ✓ | ✓ | ✓ |
| tychon.crypto.quantum_risk | String | No | Canonical risk: none, low, medium, high, or critical | "high" | ✓ | ✓ | ✓ |
| Field | Type | Description | Example | Full | Standard | Minimal |
|---|---|---|---|---|---|---|
| pqc.vulnerable | Boolean | Vulnerable to quantum attacks | true | ✓ | ✓ | ✓ |
| pqc.readiness | String | PQC readiness status | "not_ready" | ✓ | ✓ | ✓ |
| pqc.key_strength | String | Key strength assessment | "weak" | ✓ | ✓ | ✗ |
| pqc.quantum_risk | String | Quantum risk level | "high" | ✓ | ✓ | ✗ |
| pqc.recommended_action | String | Recommended action | "upgrade" | ✓ | ✓ | ✗ |
| pqc.migration_priority | String | Migration priority | "high" | ✓ | ✓ | ✗ |
| pqc.crypto_library | String | Crypto library used | "OpenSSL" | ✓ | ✓ | ✗ |
| pqc.reason | String | Vulnerability reason | "RSA-2048 vulnerable" | ✓ | ✓ | ✗ |
Pattern: certificate.chain.N.* where N = 0, 1, 2... Standard mode includes only chain.0 fields.
| Field | Type | Description | Example | Full | Standard | Minimal |
|---|---|---|---|---|---|---|
| certificate.chain.0.subject | String | Chain cert #0 subject DN | "CN=Cert 0" | ✓ | ✓ | ✗ |
| certificate.chain.0.issuer | String | Chain cert #0 issuer DN | "CN=Issuer 0" | ✓ | ✓ | ✗ |
| certificate.chain.0.serial_number | String | Chain cert #0 serial | "00:23:45" | ✓ | ✓ | ✗ |
| certificate.chain.0.not_before | Date | Chain cert #0 valid from | "2024-01-01T00:00:00Z" | ✓ | ✓ | ✗ |
| certificate.chain.0.not_after | Date | Chain cert #0 valid until | "2025-01-01T00:00:00Z" | ✓ | ✓ | ✗ |
| certificate.chain.0.signature_algorithm | String | Chain cert #0 sig algo | "SHA256withRSA" | ✓ | ✓ | ✗ |
| certificate.chain.0.public_key_algorithm | String | Chain cert #0 key algo | "RSA" | ✓ | ✓ | ✗ |
| certificate.chain.0.public_key_size | Integer | Chain cert #0 key size | 2048 | ✓ | ✓ | ✗ |
| certificate.chain.0.version | Integer | Chain cert #0 X.509 version | 3 | ✓ | ✓ | ✗ |
| certificate.chain.0.is_ca | Boolean | Chain cert #0 is CA | false | ✓ | ✓ | ✗ |
| certificate.chain.0.subject_common_name | String | Chain cert #0 subject CN | "CN 0" | ✓ | ✓ | ✗ |
| certificate.chain.0.issuer_common_name | String | Chain cert #0 issuer CN | "Issuer 0" | ✓ | ✓ | ✗ |
| certificate.chain.0.sha256_fingerprint | String | Chain cert #0 SHA-256 | "sha256_0..." | ✓ | ✓ | ✗ |
| certificate.chain.0.sha1_fingerprint | String | Chain cert #0 SHA-1 | "sha1_0..." | ✓ | ✓ | ✗ |
| certificate.chain.0.dns_names | String[] | Chain cert #0 DNS names | [] | ✓ | ✓ | ✗ |
| certificate.chain.1.subject | String | Chain cert #1 subject DN | "CN=Cert 1" | ✓ | ✗ | ✗ |
| certificate.chain.1.issuer | String | Chain cert #1 issuer DN | "CN=Issuer 1" | ✓ | ✗ | ✗ |
| certificate.chain.1.serial_number | String | Chain cert #1 serial | "01:23:45" | ✓ | ✗ | ✗ |
| certificate.chain.1.not_before | Date | Chain cert #1 valid from | "2024-02-01T00:00:00Z" | ✓ | ✗ | ✗ |
| certificate.chain.1.not_after | Date | Chain cert #1 valid until | "2025-02-01T00:00:00Z" | ✓ | ✗ | ✗ |
| certificate.chain.1.signature_algorithm | String | Chain cert #1 sig algo | "SHA256withRSA" | ✓ | ✗ | ✗ |
| certificate.chain.1.public_key_algorithm | String | Chain cert #1 key algo | "RSA" | ✓ | ✗ | ✗ |
| certificate.chain.1.public_key_size | Integer | Chain cert #1 key size | 2048 | ✓ | ✗ | ✗ |
| certificate.chain.1.version | Integer | Chain cert #1 X.509 version | 3 | ✓ | ✗ | ✗ |
| certificate.chain.1.is_ca | Boolean | Chain cert #1 is CA | true | ✓ | ✗ | ✗ |
| certificate.chain.1.subject_common_name | String | Chain cert #1 subject CN | "CN 1" | ✓ | ✗ | ✗ |
| certificate.chain.1.issuer_common_name | String | Chain cert #1 issuer CN | "Issuer 1" | ✓ | ✗ | ✗ |
| certificate.chain.1.sha256_fingerprint | String | Chain cert #1 SHA-256 | "sha256_1..." | ✓ | ✗ | ✗ |
| certificate.chain.1.sha1_fingerprint | String | Chain cert #1 SHA-1 | "sha1_1..." | ✓ | ✗ | ✗ |
| certificate.chain.1.dns_names | String[] | Chain cert #1 DNS names | [] | ✓ | ✗ | ✗ |
| certificate.chain.2.subject | String | Chain cert #2 subject DN | "CN=Cert 2" | ✓ | ✗ | ✗ |
| certificate.chain.2.issuer | String | Chain cert #2 issuer DN | "CN=Issuer 2" | ✓ | ✗ | ✗ |
| certificate.chain.2.serial_number | String | Chain cert #2 serial | "02:23:45" | ✓ | ✗ | ✗ |
| certificate.chain.2.not_before | Date | Chain cert #2 valid from | "2024-03-01T00:00:00Z" | ✓ | ✗ | ✗ |
| certificate.chain.2.not_after | Date | Chain cert #2 valid until | "2025-03-01T00:00:00Z" | ✓ | ✗ | ✗ |
| certificate.chain.2.signature_algorithm | String | Chain cert #2 sig algo | "SHA256withRSA" | ✓ | ✗ | ✗ |
| certificate.chain.2.public_key_algorithm | String | Chain cert #2 key algo | "RSA" | ✓ | ✗ | ✗ |
| certificate.chain.2.public_key_size | Integer | Chain cert #2 key size | 2048 | ✓ | ✗ | ✗ |
| certificate.chain.2.version | Integer | Chain cert #2 X.509 version | 3 | ✓ | ✗ | ✗ |
| certificate.chain.2.is_ca | Boolean | Chain cert #2 is CA | true | ✓ | ✗ | ✗ |
| certificate.chain.2.subject_common_name | String | Chain cert #2 subject CN | "CN 2" | ✓ | ✗ | ✗ |
| certificate.chain.2.issuer_common_name | String | Chain cert #2 issuer CN | "Issuer 2" | ✓ | ✗ | ✗ |
| certificate.chain.2.sha256_fingerprint | String | Chain cert #2 SHA-256 | "sha256_2..." | ✓ | ✗ | ✗ |
| certificate.chain.2.sha1_fingerprint | String | Chain cert #2 SHA-1 | "sha1_2..." | ✓ | ✗ | ✗ |
| certificate.chain.2.dns_names | String[] | Chain cert #2 DNS names | [] | ✓ | ✗ | ✗ |
For events with event.dataset="keystore_certificate"
| Field | Type | Description | Example | Full | Standard | Minimal |
|---|---|---|---|---|---|---|
| keystore.path | String | Path to keystore | "/home/user/keystore.p12" | ✓ | ✓ | ✓ |
| keystore.type | String | Keystore type | "PKCS12" | ✓ | ✓ | ✓ |
| keystore.accessible | Boolean | Is accessible | true | ✓ | ✓ | ✓ |
| keystore.requires_auth | Boolean | Requires authentication | true | ✓ | ✓ | ✗ |
| keystore.cert_count | Integer | Number of certificates | 10 | ✓ | ✓ | ✓ |
| keystore.owner | String | Keystore owner | "root" | ✓ | ✓ | ✗ |
| keystore.permissions | String | File permissions | "600" | ✓ | ✓ | ✗ |
| keystore.error_message | String | Error message | "" | ✓ | ✓ | ✗ |
| keystore.encryption.algorithm | String | Encryption algorithm | "PBEWithHmacSHA256" | ✓ | ✓ | ✗ |
| keystore.encryption.kdf | String | Key derivation function | "PBKDF2" | ✓ | ✓ | ✗ |
| keystore.encryption.iterations | Integer | KDF iterations | 10000 | ✓ | ✓ | ✗ |
| keystore.encryption.mac | String | MAC algorithm | "HmacSHA256" | ✓ | ✓ | ✗ |
| keystore.encryption.vulnerable | Boolean | Is encryption vulnerable | false | ✓ | ✓ | ✗ |
| keystore.encryption.reason | String | Vulnerability reason | "" | ✓ | ✓ | ✗ |
| keystore.encryption.iv_length | Integer | IV length in bytes | 16 | ✓ | ✗ | ✗ |
| keystore.encryption.salt_length | Integer | Salt length in bytes | 16 | ✓ | ✗ | ✗ |
| file.size | Long | File size in bytes | 4096 | ✓ | ✓ | ✗ |
| file.mtime | Date | Last modified | "2024-12-15T10:30:00Z" | ✓ | ✓ | ✗ |
| Field | Type | Description | Example | Full | Standard | Minimal | |
|---|---|---|---|---|---|---|---|
| certificate.alias | String | Certificate alias | "server-cert" | ✓ | ✓ | ✗ | |
| certificate.is_ca | Boolean | Is CA certificate | false | ✓ | ✓ | ✗ | |
| certificate.is_self_signed | Boolean | Is self-signed | false | ✓ | ✓ | ✗ | |
| certificate.has_private_key | Boolean | Has private key | true | ✓ | ✓ | ✗ | |
| tls.certificate.subject | String | Certificate subject | "CN=example.com" | ✓ | ✓ | ✗ | |
| tls.certificate.issuer | String | Certificate issuer | "CN=Root CA" | ✓ | ✓ | ✗ | |
| tls.certificate.not_before | Date | Valid from | "2024-01-01T00:00:00Z" | ✓ | ✓ | ✗ | |
| tls.certificate.not_after | Date | Valid until | "2025-01-01T00:00:00Z" | ✓ | ✓ | ✗ | |
| tls.certificate.serial_number | String | Serial number | "01:23:45" | ✓ | ✓ | ✗ | |
| tls.certificate.extended_key_usage | String[] | Extended key usage | ["serverAuth"] | ✓ | ✓ | ✗ | |
| tls.server.subject | String | Subject (compat) | "CN=example.com" | ✓ | ✓ | ✗ | |
| tls.server.issuer | String | Issuer (compat) | "CN=Root CA" | ✓ | ✓ | ✗ | |
| tls.server.not_before | Date | Valid from (compat) | "2024-01-01T00:00:00Z" | ✓ | ✓ | ✗ | |
| tls.server.not_after | Date | Valid until (compat) | "2025-01-01T00:00:00Z" | ✓ | ✓ | ✗ | |
| tls.server.serial_number | String | Serial (compat) | "01:23:45" | ✓ | ✓ | ✗ | |
| tls.server.hash.sha1 | String | SHA-1 thumbprint | "abc123..." | ✓ | ✓ | ✗ | |
| vulnerability.is_vulnerable | Boolean | Is vulnerable | true | ✓ | ✓ | ✓ | |
| vulnerability.risk_level | String | Risk level | "high" | ✓ | ✓ | ✓ | |
| vulnerability.risk_reason | String | Risk reason | "RSA-2048" | ✓ | ✓ | ✗ | |
| vulnerability.cve_list | String[] | CVE list | [] | ✓ | ✓ | ✗ | |
| active | Boolean | Is active | true | ✓ | ✓ | ✗ | |
| last_seen | Date | Last seen | "2025-01-16T10:15:39Z" | ✓ | ✓ | ✗ | |
| tychon.crypto.protocol | String | No | Always X.509 for keystore certificate events | "X.509" | ✓ | ✓ | ✓ |
| tychon.crypto.cipher | String | No | Key algorithm (e.g. RSA-2048, EC) | "RSA-2048" | ✓ | ✓ | ✗ |
| tychon.crypto.pqc_vulnerable | Boolean | No | True when the certificate's key algorithm is vulnerable to a quantum computer | true | ✓ | ✓ | ✓ |
| tychon.crypto.pqc_readiness | String | No | vulnerable or transitional based on pqc_vulnerable flag | "vulnerable" | ✓ | ✓ | ✓ |
| tychon.crypto.quantum_risk | String | No | high or low based on pqc_vulnerable flag | "high" | ✓ | ✓ | ✓ |
For events with event.dataset="keystore" (summary events)
| Field | Type | Description | Example | Full | Standard | Minimal |
|---|---|---|---|---|---|---|
| keystore.stats.vulnerable_certificates | Integer | Count of vulnerable certs | 2 | ✓ | ✓ | ✗ |
| keystore.stats.pqc_vulnerable_certificates | Integer | Count of PQC vulnerable | 5 | ✓ | ✓ | ✗ |
| keystore.stats.expired_certificates | Integer | Count of expired | 1 | ✓ | ✓ | ✗ |
| keystore.stats.certificate_types.ca | Integer | Count of CA certs | 3 | ✓ | ✓ | ✗ |
| keystore.stats.certificate_types.end_entity | Integer | Count of end-entity | 7 | ✓ | ✓ | ✗ |
| keystore.stats.key_algorithms.RSA | Integer | Count of RSA keys | 8 | ✓ | ✓ | ✗ |
| keystore.stats.key_algorithms.ECDSA | Integer | Count of ECDSA keys | 2 | ✓ | ✓ | ✗ |
For events with event.dataset="memory_scan" or event.dataset="java_crypto"
Native memory_scan events include tychon.library.path (String) when the detected library path is nonempty. Full, Standard, and Minimal output retain this path so libraries with the same display name can be distinguished. The path is a library identity input used to generate the ID. Full, Standard, and Minimal output include the same top-level id for each native memory library asset.
| Field | Type | Description | Example | Full | Standard | Minimal | |
|---|---|---|---|---|---|---|---|
| id | String | Stable upsert ID — SHA-256(process_crypto_library | processName | processPath | libraryName | libraryPath | observerID) truncated to 16 hex chars. One record per unique (host, process binary, crypto library) tuple. PID is intentionally excluded — the same library running in multiple PIDs shares one ID, enabling ES upsert deduplication. | "mem_abc123_libssl" | ✓ | ✓ | ✓ | |
| event.kind | String | ECS event kind | "event" | ✓ | ✓ | ✓ | |
| vulnerability.is_vulnerable | Boolean | Is library vulnerable | true | ✓ | ✓ | ✓ | |
| vulnerability.risk_level | String | Risk level | "high" | ✓ | ✓ | ✓ | |
| vulnerability.risk_reason | String | Risk reason | "Known CVE" | ✓ | ✓ | ✗ | |
| vulnerability.cve_list | String[] | List of CVEs | ["CVE-2023-1234"] | ✓ | ✓ | ✗ | |
| vulnerability.fixed_in_version | String | Fixed in version | "1.1.1t" | ✓ | ✓ | ✗ | |
| vulnerability.assessed_at | Date | Assessment timestamp | "2025-01-16T10:15:39Z" | ✓ | ✓ | ✗ | |
| tychon.library.uses_openssl | Boolean | Process links against OpenSSL | true | ✓ | ✓ | ✗ | |
| tychon.library.openssl_version | String | OpenSSL version in use by this process | "OpenSSL 3.0.8" | ✓ | ✓ | ✗ | |
| tychon.library.openssl_pqc_status | String | PQC readiness of the OpenSSL version | "not_supported" | ✓ | ✓ | ✗ | |
| tychon.library.uses_libressl | Boolean | Process links against LibreSSL | false | ✓ | ✓ | ✗ | |
| tychon.library.libressl_version | String | LibreSSL version in use (if applicable) | "LibreSSL 3.7.2" | ✓ | ✓ | ✗ | |
| tychon.library.libressl_pqc_status | String | PQC readiness of the LibreSSL version | "not_supported" | ✓ | ✓ | ✗ | |
| tychon.library.uses_apple_security | Boolean | Process uses Apple Security framework (macOS only) | true | ✓ | ✓ | ✗ | |
| tychon.library.apple_security_pqc_status | String | PQC readiness of the Apple Security framework version | "partial" | ✓ | ✓ | ✗ | |
| java.vendor | String | Java vendor (Java only) | "Oracle Corporation" | ✓ | ✓ | ✗ | |
| java.version | String | Java version (Java only) | "11.0.16" | ✓ | ✓ | ✗ | |
| tychon.crypto.protocol | String | No | Always library for crypto library events | "library" | ✓ | ✓ | ✓ |
| tychon.crypto.cipher | String | No | Library name (e.g. OpenSSL, LibreSSL) | "OpenSSL" | ✓ | ✓ | ✗ |
| tychon.crypto.pqc_vulnerable | Boolean | No | True when the library is not quantum-ready | true | ✓ | ✓ | ✓ |
| tychon.crypto.pqc_readiness | String | No | Canonical readiness: ready, transitional, vulnerable, or critical | "vulnerable" | ✓ | ✓ | ✓ |
| tychon.crypto.quantum_risk | String | No | Canonical risk: none, low, medium, high, or critical | "high" | ✓ | ✓ | ✓ |
Note: Additional library.* fields are dynamically flattened from the CryptoLibrary structure.
For events with event.dataset="vpn"
| Field | Type | Description | Example | Full | Standard | Minimal | |
|---|---|---|---|---|---|---|---|
| id | String | Stable upsert ID — SHA-256(vpn_client | clientName | vendor | installPath | observerID) truncated to 16 hex chars. One record per unique VPN client installation on this host. Re-emitted records from polling loops share the same ID and upsert in Elasticsearch. | "vpn_abc123_openvpn" | ✓ | ✓ | ✗ | |
| event.kind | String | ECS event kind | "event" | ✓ | ✓ | ✓ | |
| file.path | String | VPN install path | "C:\Program Files\VPN" | ✓ | ✓ | ✗ | |
| service.name | String | VPN service name | "OpenVPN" | ✓ | ✓ | ✗ | |
| service.state | String | VPN service state | "running" | ✓ | ✓ | ✗ | |
| vpn_client.name | String | VPN client product name | "OpenVPN" | ✓ | ✓ | ✓ | |
| vpn_client.version | String | Installed client version | "2.6.1" | ✓ | ✓ | ✗ | |
| vpn_client.status | String | Current client status | "connected" | ✓ | ✓ | ✓ | |
| vpn_client.vendor | String | Vendor / publisher name | "OpenVPN Inc." | ✓ | ✓ | ✗ | |
| vpn_client.install_path | String | Installation directory | "C:\Program Files\OpenVPN" | ✓ | ✓ | ✗ | |
| vpn_connection.server_address | String | VPN server address | "vpn.example.com" | ✓ | ✓ | ✓ | |
| vpn_connection.server_port | Integer | VPN server port | 1194 | ✓ | ✓ | ✗ | |
| vpn_connection.protocol | String | VPN tunnel protocol | "UDP" | ✓ | ✓ | ✗ | |
| vpn_connection.encryption_algorithm | String | Negotiated encryption algorithm | "AES-256-GCM" | ✓ | ✓ | ✓ | |
| vpn_connection.key_exchange_algorithm | String | Key exchange algorithm | "ECDH" | ✓ | ✓ | ✓ | |
| vpn_connection.dh_group | String | Diffie-Hellman group used | "Group-20" | ✓ | ✓ | ✗ | |
| security.score | Integer | Overall security score (0-100) | 72 | ✓ | ✓ | ✓ | |
| security.pqc_support | Boolean | Supports post-quantum crypto | false | ✓ | ✓ | ✓ | |
| security.weak_crypto | Boolean | Uses weak/deprecated crypto | false | ✓ | ✓ | ✗ | |
| vpn_config.authentication_method | String | Auth method (password, certificate, MFA) | "certificate" | ✓ | ✓ | ✗ | |
| vpn_config.dns_leak_protection | Boolean | DNS leak protection enabled | true | ✓ | ✓ | ✗ | |
| vpn_config.kill_switch | Boolean | Kill switch enabled | true | ✓ | ✓ | ✗ | |
| vpn_config.split_tunneling | Boolean | Split tunneling enabled | false | ✓ | ✓ | ✗ | |
| pqc.is_pqc_ready | Boolean | Whether client is PQC-ready | false | ✓ | ✓ | ✓ | |
| pqc.supported_algorithms | String[] | List of PQC algorithms supported | [] | ✓ | ✓ | ✗ | |
| pqc.quantum_resistance | String | Quantum resistance level: none, partial, full | "none" | ✓ | ✓ | ✓ | |
| pqc.pqc_migration_status | String | Migration status: not_started, in_progress, complete | "not_started" | ✓ | ✓ | ✗ | |
| tychon.crypto.protocol | String | No | VPN protocol (e.g. WireGuard, OpenVPN) from the connection's Protocol field | "OpenVPN" | ✓ | ✓ | ✓ |
| tychon.crypto.key_exchange | String | No | Key exchange algorithm from connection | "ECDH" | ✓ | ✓ | ✗ |
| tychon.crypto.cipher | String | No | Encryption algorithm from connection (e.g. AES-256-GCM) | "AES-256-GCM" | ✓ | ✓ | ✗ |
| tychon.crypto.mac | String | No | Authentication algorithm from connection (e.g. HMAC-SHA2-256) | "HMAC-SHA2-256" | ✓ | ✓ | ✗ |
| tychon.crypto.auth | String | No | Authentication method (e.g. PSK, Certificate) | "Certificate" | ✓ | ✓ | ✗ |
| tychon.crypto.pqc_vulnerable | Boolean | No | True when key exchange or cipher is vulnerable to a quantum computer | true | ✓ | ✓ | ✓ |
| tychon.crypto.pqc_readiness | String | No | Canonical readiness: ready, transitional, vulnerable, or critical | "vulnerable" | ✓ | ✓ | ✓ |
| tychon.crypto.quantum_risk | String | No | Canonical risk: none, low, medium, high, or critical | "high" | ✓ | ✓ | ✓ |
For events with event.dataset="ipsec"
| Field | Type | Description | Example | Full | Standard | Minimal | |
|---|---|---|---|---|---|---|---|
| source.ip | IP | Local endpoint IP | "10.0.0.1" | ✓ | ✓ | ✗ | |
| destination.ip | IP | Remote endpoint IP | "10.0.1.1" | ✓ | ✓ | ✗ | |
| source.network | String | Local subnet | "10.0.0.0/24" | ✓ | ✓ | ✗ | |
| destination.network | String | Remote subnet | "10.0.1.0/24" | ✓ | ✓ | ✗ | |
| tychon.crypto.protocol | String | No | Always IPSec for IPSec tunnel events | "IPSec" | ✓ | ✓ | ✓ |
| tychon.crypto.key_exchange | String | No | Key exchange group (e.g. modp14) | "modp14" | ✓ | ✓ | ✗ |
| tychon.crypto.cipher | String | No | Encryption algorithm (e.g. AES-256-GCM) | "AES-256-GCM" | ✓ | ✓ | ✗ |
| tychon.crypto.mac | String | No | Integrity algorithm (e.g. HMAC-SHA2-256) | "HMAC-SHA2-256" | ✓ | ✓ | ✗ |
| tychon.crypto.auth | String | No | Authentication method (e.g. PSK, Certificate) | "PSK" | ✓ | ✓ | ✗ |
| tychon.crypto.pqc_vulnerable | Boolean | No | True when key exchange or cipher is vulnerable to a quantum computer | true | ✓ | ✓ | ✓ |
| tychon.crypto.pqc_readiness | String | No | Canonical readiness: ready, transitional, vulnerable, or critical | "vulnerable" | ✓ | ✓ | ✓ |
| tychon.crypto.quantum_risk | String | No | Canonical risk: none, low, medium, high, or critical | "high" | ✓ | ✓ | ✓ |
Note: Additional ipsec_tunnel.* fields are dynamically flattened from the IPSecTunnelInfo structure.
Local mode only. The quantum assessment produces three separate flat datasets — all routed to tychon.index="system-readiness" — so that NDJSON consumers (Elasticsearch, Splunk, NoSQL stores) can query each dimension without handling nested arrays.
quantum_assessment — one row per host: OS info, overall scores, hardware, network, crypto libraries, cost analysis totals, and OS-level cost breakdownquantum_assessment.app_group — one row per application family: remediation cost by app family (labor hours, cost, tier)quantum_assessment.critical_issue — one row per critical finding: severity, component, issue text, impact, resolution, blocking flagquantum_assessment — Top-Level FieldsStable ID: SHA-256(quantum_readiness | hostname | observerID) truncated to 16 hex chars.
| Field | Type | Description | Example |
|---|---|---|---|
| quantum_readiness.overall_score | Integer | Overall score (0–100) | 64 |
| quantum_readiness.readiness_status | String | Readiness status label | "Update Required" |
| quantum_readiness.ready_timeline | String | Estimated timeline to readiness | "2-6 months" |
| quantum_readiness.cost_analysis.total_labor_hours | Float | Total estimated remediation labor hours | 48.0 |
| quantum_readiness.cost_analysis.total_cost_usd | Float | Total estimated remediation cost (USD) | 9600.0 |
| quantum_readiness.cost_analysis.os_category | String | OS upgrade category (flattened from single-entry OS list) | "Windows Server" |
| quantum_readiness.cost_analysis.os_upgrade_target | String | Target OS version for PQC readiness | "Windows Server 2025" |
| quantum_readiness.cost_analysis.os_total_cost_usd | Float | OS upgrade total cost estimate (USD) | 2400.0 |
Additional sub-namespaces: quantum_readiness.hardware.* (22 fields), quantum_readiness.operating_system.* (16 fields), quantum_readiness.crypto_libraries.* (8+ fields), quantum_readiness.network.* (12 fields), quantum_readiness.upgrade_pathway.* (6 fields), quantum_readiness.compliance.* (4 fields).
quantum_assessment.app_group — Per-App-Family CostOne row per application family. Stable ID: SHA-256(quantum_assessment_app_group | hostname | appFamily | observerID) truncated to 16 hex chars.
| Field | Type | Description | Example |
|---|---|---|---|
| quantum_readiness.cost_analysis.app_family | String | Application family name | "Web Servers" |
| quantum_readiness.cost_analysis.tier | String | Remediation tier (e.g. standard, complex) | "standard" |
| quantum_readiness.cost_analysis.instance_count | Integer | Number of instances in this family | 3 |
| quantum_readiness.cost_analysis.labor_hours | Float | Estimated labor hours for this family | 16.0 |
| quantum_readiness.cost_analysis.labor_cost_usd | Float | Estimated labor cost (USD) for this family | 3200.0 |
| quantum_readiness.cost_analysis.total_cost_usd | Float | Total estimated cost (USD) for this family | 3200.0 |
quantum_assessment.critical_issue — Per-Issue FindingsOne row per critical finding. Stable ID: SHA-256(quantum_assessment_critical_issue | hostname | component | severity | issue | observerID) truncated to 16 hex chars.
| Field | Type | Description | Example |
|---|---|---|---|
| quantum_readiness.issue.severity | String | Issue severity level | "critical" |
| quantum_readiness.issue.component | String | Affected component name | "TLS Configuration" |
| quantum_readiness.issue.issue | String | Issue description | "TLSv1.0 still enabled" |
| quantum_readiness.issue.impact | String | Business / security impact | "Vulnerable to POODLE and BEAST attacks" |
| quantum_readiness.issue.resolution | String | Recommended resolution action | "Disable TLSv1.0 in server configuration" |
| quantum_readiness.issue.blocking | Boolean | True when this issue blocks PQC readiness | true |
For events with event.dataset="tychon.application" (local mode with -cipherscanquick only). One row per (application × port) — each listening port on a process gets its own document. Applications with no detected ports emit a single app-level row with no port fields. The stable id is SHA-256(tychon_application | hostname | name | path | port) truncated to 16 hex chars, so an IIS cipher upgrade updates the existing document rather than creating a new one.
| Field | Type | Description | Example | Full | Standard | Minimal |
|---|---|---|---|---|---|---|
| event.dataset | String | Always "tychon.application" | "tychon.application" | ✓ | ✓ | ✓ |
| event.category | String | Always "process" | "process" | ✓ | ✓ | ✓ |
| event.type | String | Always "info" | "info" | ✓ | ✓ | ✓ |
| process.name | String | Process name | "nginx" | ✓ | ✓ | ✓ |
| process.pid | Integer | Process ID | 1234 | ✓ | ✓ | ✓ |
| process.executable | String | Full path to the executable | "/usr/sbin/nginx" | ✓ | ✓ | ✗ |
| process.command_line | String | Launch command line | "nginx -g daemon off;" | ✓ | ✓ | ✗ |
| process.working_directory | String | Working directory of the process | "/etc/nginx" | ✓ | ✓ | ✗ |
| process.source | String | How the application was discovered: "process", "port", "connected", etc. | "process" | ✓ | ✓ | ✗ |
| crypto_library_count | Integer | Count of crypto libraries found for this application | 3 | ✓ | ✓ | ✗ |
| keystore_count | Integer | Count of keystores found for this application | 1 | ✓ | ✓ | ✗ |
| in_memory_cert_count | Integer | Count of in-memory certificates found for this application | 2 | ✓ | ✓ | ✗ |
| tychon.application.port | Integer | Listening port for this row. Absent if the application has no detected ports. | 443 | ✓ | ✓ | ✗ |
| tychon.application.protocol_detected | String | Protocol detected on this port (e.g. "https", "tls") | "https" | ✓ | ✓ | ✗ |
| tychon.application.preferred_protocol | String | Best TLS protocol version negotiated on this port | "TLSv1.3" | ✓ | ✓ | ✗ |
| tychon.application.preferred_cipher | String | Preferred cipher suite on this port | "TLS_AES_256_GCM_SHA384" | ✓ | ✓ | ✗ |
| tychon.application.preferred_key_exchange | String | Preferred key exchange group on this port | "X25519MLKEM768" | ✓ | ✓ | ✗ |
| tychon.application.quantum_ready | Boolean | True when this port's cipher configuration is quantum-ready | true | ✓ | ✓ | ✓ |
| tychon.application.supported_protocols | String | Comma-joined list of all TLS versions supported on this port | "TLSv1.3, TLSv1.2" | ✓ | ✓ | ✗ |
| tychon.application.supported_cipher_suites | String | Comma-joined list of all cipher suites on this port | "TLS_AES_256_GCM_SHA384, TLS_AES_128_GCM_SHA256" | ✓ | ✓ | ✗ |
| tychon.application.connected_to | String | Comma-joined list of outbound TLS destinations (ip:port pairs). Only present when -scanconnected is active. | "10.0.1.5:443, 10.0.1.6:8443" | ✓ | ✓ | ✗ |
| tychon.library.uses_openssl | Boolean | Application links against OpenSSL | true | ✓ | ✓ | ✗ |
| tychon.library.openssl_version | String | OpenSSL version used by this application | "OpenSSL 3.0.8" | ✓ | ✓ | ✗ |
| tychon.library.openssl_pqc_status | String | PQC readiness of the OpenSSL version | "not_supported" | ✓ | ✓ | ✗ |
| tychon.library.uses_libressl | Boolean | Application links against LibreSSL | false | ✓ | ✓ | ✗ |
| tychon.library.libressl_version | String | LibreSSL version used by this application | "LibreSSL 3.7.2" | ✓ | ✓ | ✗ |
| tychon.library.libressl_pqc_status | String | PQC readiness of the LibreSSL version | "not_supported" | ✓ | ✓ | ✗ |
| tychon.library.uses_apple_security | Boolean | Application uses Apple Security framework (macOS only) | true | ✓ | ✓ | ✗ |
| tychon.library.apple_security_pqc_status | String | PQC readiness of the Apple Security framework version | "partial" | ✓ | ✓ | ✗ |
Note: All fields are flat scalars. Multi-value fields (supported protocols, cipher suites, key exchanges, connected destinations) are emitted as comma-joined strings for compatibility with all NDJSON consumers. The application-level quantum grade fields (tychon.application.quantum_grade.*) are on each port row.
For events with event.dataset="tychon.app_certificate". Each event represents a certificate discovered in connection with a specific running application (process).
| Field | Type | Description | Example | Full | Standard | Minimal |
|---|---|---|---|---|---|---|
| id | String | Stable upsert ID — SHA-256(keystore_certificate | keystorePath | serialNumber | thumbprint | observerID) truncated to 16 hex chars. One record per unique certificate within a keystore on this host. | "appcert_abc123" | ✓ | ✓ | ✗ |
| event.kind | String | ECS event kind | "event" | ✓ | ✓ | ✓ |
| process.name | String | Owning process name | "nginx" | ✓ | ✓ | ✓ |
| process.pid | Integer | Owning process ID | 1234 | ✓ | ✓ | ✓ |
| x509.subject.distinguished_name | String | Certificate subject DN | "CN=example.com,O=Acme" | ✓ | ✓ | ✗ |
| x509.issuer.distinguished_name | String | Certificate issuer DN | "CN=Root CA" | ✓ | ✓ | ✗ |
| x509.not_before | Date | Certificate valid from | "2024-01-01T00:00:00Z" | ✓ | ✓ | ✗ |
| x509.not_after | Date | Certificate valid until | "2025-01-01T00:00:00Z" | ✓ | ✓ | ✗ |
| x509.serial_number | String | Certificate serial number | "01:23:45:67" | ✓ | ✓ | ✗ |
| x509.public_key_algorithm | String | Public key algorithm | "RSA" | ✓ | ✓ | ✓ |
| x509.public_key_size | Integer | Public key size in bits | 2048 | ✓ | ✓ | ✓ |
| x509.signature_algorithm | String | Signature algorithm | "SHA256withRSA" | ✓ | ✓ | ✗ |
| tychon.application.name | String | Application name (mirrors process.name) | "nginx" | ✓ | ✓ | ✓ |
| tychon.application.executable | String | Full path to the executable | "/usr/sbin/nginx" | ✓ | ✓ | ✗ |
| vulnerability.is_vulnerable | Boolean | Certificate is quantum-vulnerable | true | ✓ | ✓ | ✓ |
| vulnerability.risk_level | String | Risk level: low, medium, high, critical | "high" | ✓ | ✓ | ✓ |
For events with event.dataset="tychon.pqc_inventory". Summary inventory events emitted at the end of a scan, grouping cryptographic assets by host.
| Field | Type | Description | Example | Full | Standard | Minimal |
|---|---|---|---|---|---|---|
| id | String | Stable upsert ID — SHA-256(pqc_inventory | hostname | appPath | port | observerID) truncated to 16 hex chars. One record per unique (host, application, port) tuple for the OMB/PQC inventory event. | "pqcinv_abc123" | ✓ | ✓ | ✗ |
| event.kind | String | ECS event kind | "event" | ✓ | ✓ | ✓ |
| host.hostname | String | Target hostname | "server01.acme.local" | ✓ | ✓ | ✓ |
| host.ip | String | Target IP address | "192.168.1.10" | ✓ | ✓ | ✓ |
| inventory.total_assets | Integer | Total cryptographic assets discovered | 42 | ✓ | ✓ | ✓ |
| inventory.vulnerable_assets | Integer | Count of quantum-vulnerable assets | 28 | ✓ | ✓ | ✓ |
| inventory.pqc_ready_assets | Integer | Count of PQC-ready assets | 5 | ✓ | ✓ | ✓ |
| inventory.certificates | Integer | Count of certificates discovered | 15 | ✓ | ✓ | ✗ |
| inventory.keystores | Integer | Count of keystores discovered | 3 | ✓ | ✓ | ✗ |
| inventory.crypto_libraries | Integer | Count of unique crypto libraries in use | 8 | ✓ | ✓ | ✗ |
| inventory.vpn_clients | Integer | Count of VPN clients detected | 1 | ✓ | ✓ | ✗ |