Flat NDJSON Output Format

Complete Flat NDJSON Schema

Schema Overview

Each line represents a single cryptographic asset event. Different event types share common base fields but include type-specific fields. The checkmark columns indicate which output mode includes each field.

Common Event Fields (All Events)

Field	Type	Required	Description	Example	Full	Standard	Minimal
@timestamp	String	Yes	Event timestamp (ISO 8601)	"2025-09-02T13:45:30.123Z"	✓	✓	✓
event.action	String	Yes	Event type identifier	"cipher_suite_discovered"	✓	✓	✓
event.category	String	Yes	ECS event category	"host", "network"	✓	✓	✓
event.kind	String	Yes	ECS event kind (always "event")	"event"	✓	✓	✓
event.type	String	Yes	ECS event type	"info", "connection"	✓	✓	✓
event.dataset	String	Yes	Dataset name	"port_detail"	✓	✓	✓
tychon.type	String	Yes	Tychon-specific event type	"cipher"	✓	✓	✓
observer.hostname	String	Yes	Scanning system hostname	"scanner-host"	✓	✓	✓
observer.ip	Array	No	Scanner IP addresses	["192.168.1.100"]	✓	✓	✓
observer.id	String	No	Host ID of scanning system	"host-abc123"	✓	✓	✓
observer.os.name	String	Yes	Scanner OS name	"Windows"	✓	✓	✓
observer.os.version	String	No	Scanner OS version	"10.0.19045"	✓	✓	✗
observer.os.family	String	No	OS family	"Darwin"	✓	✓	✗
observer.os.platform	String	No	OS platform name	"darwin"	✓	✓	✗
observer.os.kernel	String	No	Kernel version	"24.5.0"	✓	✓	✗
observer.architecture	String	No	CPU architecture	"x86_64"	✓	✓	✗
observer.cpu_cores	Integer	No	Number of physical CPU cores	8	✓	✓	✗
observer.cpu_logical_cores	Integer	No	Number of logical CPU cores	16	✓	✓	✗
observer.total_ram	Long	No	Total RAM in bytes	34359738368	✓	✓	✗
observer.cpu_vendor_id	String	No	CPU vendor identifier	"GenuineIntel"	✓	✗	✗
observer.cpu_model_name	String	No	CPU model name	"Intel Core i7"	✓	✗	✗
observer.kernel_arch	String	No	Kernel architecture	"x86_64"	✓	✓	✗
observer.virtualization_system	String	No	Virtualization system	"kvm"	✓	✓	✗
observer.virtualization_role	String	No	Virtualization role	"guest"	✓	✓	✗
observer.ram_used_percent	Float	No	RAM used percentage	45.2	✓	✗	✗
observer.system_uptime_seconds	Long	No	System uptime in seconds	3456789	✓	✗	✗
observer.openssl_version_used	String	No	OpenSSL version used	"OpenSSL 3.0.8"	✓	✓	✗
observer.openssl_path_used	String	No	Path to OpenSSL binary	"/usr/bin/openssl"	✓	✗	✗
observer.machine_serial_number	String	No	Machine serial number	"C02XG0F3JG5H"	✓	✗	✗
observer.bios_serial_number	String	No	BIOS serial number	"VMware-56 4d"	✓	✗	✗
observer.organization	String	No	Organization name	"Acme Corp"	✓	✓	✗
observer.domain	String	No	Domain name	"acme.local"	✓	✓	✗
observer.current_user	String	No	Current user	"admin"	✓	✓	✗
observer.user_uid	String	No	User UID	"1000"	✓	✗	✗
observer.user_gid	String	No	User GID	"1000"	✓	✗	✗
observer.user_home_dir	String	No	User home directory	"/home/admin"	✓	✗	✗
observer.fips_mode_enabled	Boolean	Yes	FIPS 140-2 mode status	true	✓	✓	✗
observer.bigfix_client_installed	Boolean	No	BigFix client installed	true	✓	✓	✗
observer.bigfix_client_id	String	No	BigFix client ID	"12345678"	✓	✓	✗
observer.software.name	String	Yes	Tool name	"TYCHON Quantum Readiness"	✓	✓	✗
observer.software.version	String	Yes	Tool version	"2.0.0"	✓	✓	✗
scan.type	String	Yes	Scan mode	"local"	✓	✓	✓
scan.target	String	Yes	Original target specification	"example.com:443"	✓	✓	✓
scan.target_input	String	No	Target input provided	"192.168.1.0/24"	✓	✓	✗
scan.timestamp	Date	No	Scan timestamp	"2025-09-15T10:15:39Z"	✓	✓	✗
scan.tags	String[]	No	Tags applied to scan	["production"]	✓	✓	✗
tags	Array	No	Custom scan tags	["prod", "compliance"]	✓	✓	✗

Port Scan / Cipher Negotiation Fields

For events with event.dataset="port_detail"

Target & Server Fields

Field	Type	Description	Example	Full	Standard	Minimal
target_host.address	String	Target host address	"192.168.1.10"	✓	✓	✓
target_host.domain	String	Target host domain	"server.acme.local"	✓	✓	✗
target_host.ip	IP	Target host IP	"192.168.1.10"	✓	✓	✗
target_host.ipv4	IP	Target host IPv4	"192.168.1.10"	✓	✓	✗
target_host.ipv6	IP	Target host IPv6	"fe80::1"	✓	✓	✗
server.address	String	Server address	"192.168.1.10"	✓	✓	✓
server.port	Integer	Server port	443	✓	✓	✓
server.ip	IP	Server IP	"192.168.1.10"	✓	✓	✗
port.number	Integer	Port number	443	✓	✓	✓
port.status_overall	String	Port status	"open"	✓	✓	✓
port.protocol_detected	String	Detected protocol	"https"	✓	✓	✗
error.message	String	Error message if failed	"Connection timeout"	✓	✓	✗
network.protocol	String	Network protocol	"tls"	✓	✓	✗
network.transport	String	Network transport	"tcp"	✓	✓	✗
service.name	String	Service name	"https"	✓	✓	✗
service.version	String	Service version	"nginx/1.21.0"	✓	✓	✗

Quantum Readiness Flags

Field	Type	Description	Example	Full	Standard	Minimal
quantum_ready	Boolean	Overall quantum readiness	true	✓	✓	✓
quantum_ready_kx	Boolean	Key exchange quantum-ready	true	✓	✓	✓
quantum_ready_cipher	Boolean	Cipher quantum-ready	true	✓	✓	✓
quantum_ready_cert	Boolean	Certificate quantum-ready	false	✓	✓	✓

Cipher Negotiation Details

Field	Type	Description	Example	Full	Standard	Minimal
id	String	Universal document ID	"cn_abc123_443_tls13"	✓	✓	✗
_id	String	Elasticsearch document ID	"cn_abc123_443_tls13"	✓	✓	✗
tychon.cipher_negotiation.universal_id	String	Universal ID	"cn_abc123_443_tls13"	✓	✓	✗
tychon.cipher_negotiation.protocol	String	TLS protocol version	"TLSv1.3"	✓	✓	✗
tychon.cipher_negotiation.cipher_suite	String	Cipher suite name	"TLS_AES_256_GCM_SHA384"	✓	✓	✗
tychon.cipher_negotiation.key_length_bits	Integer	Key length in bits	256	✓	✓	✗
tychon.cipher_negotiation.negotiated_group	String	Negotiated group	"x25519"	✓	✓	✗
tychon.cipher_negotiation.ephemeral_key_length_bits	Integer	Ephemeral key length	253	✓	✓	✗
tychon.cipher_negotiation.peer_signing_digest	String	Peer signing digest	"SHA256"	✓	✓	✗
tychon.cipher_negotiation.alpn_protocol	String	ALPN protocol	"h2"	✓	✓	✗
tychon.cipher_negotiation.session_id	String	TLS session ID	"a1b2c3d4..."	✓	✗	✗
tychon.cipher_negotiation.session_ticket_lifetime_hint_seconds	Integer	Session ticket lifetime	7200	✓	✗	✗
tychon.cipher_negotiation.extended_master_secret_supported	Boolean	Extended master secret	true	✓	✓	✗
tychon.cipher_negotiation.tls13_early_data_supported	Boolean	TLS 1.3 early data	false	✓	✓	✗
tychon.cipher_negotiation.renegotiation_forbidden	Boolean	Renegotiation forbidden	true	✓	✓	✗
tychon.cipher_negotiation.compression_method	String	Compression method	"none"	✓	✓	✗
tychon.cipher_negotiation.is_preferred	Boolean	Is preferred cipher	true	✓	✓	✗
tychon.cipher_negotiation.source	String	Source of cipher info	"anchor"	✓	✓	✗
tychon.cipher_negotiation.probe_method	String	Probe method used	"utls_standard"	✓	✓	✗
tls.server.negotiated_group	String	Negotiated group (dashboard compat)	"x25519"	✓	✓	✗

Cipher Intelligence Fields

Field	Type	Description	Example	Full	Standard	Minimal
tychon.cipher_negotiation.intel.encryption_algorithm	String	Encryption algorithm	"AES-GCM"	✓	✓	✗
tychon.cipher_negotiation.intel.key_exchange_algorithm	String	Key exchange algorithm	"ECDHE"	✓	✓	✗
tychon.cipher_negotiation.intel.authentication_algorithm	String	Authentication algorithm	"RSA"	✓	✓	✗
tychon.cipher_negotiation.intel.mac_algorithm	String	MAC algorithm	"AEAD"	✓	✓	✗
tychon.cipher_negotiation.intel.encryption_bits	Integer	Encryption bit strength	256	✓	✓	✗
tychon.cipher_negotiation.intel.key_exchange_bits	Integer	Key exchange bits	256	✓	✓	✗
tychon.cipher_negotiation.intel.authentication_bits	Integer	Authentication bits	2048	✓	✓	✗
tychon.cipher_negotiation.intel.overall_risk	String	Overall risk	"low"	✓	✓	✗
tychon.cipher_negotiation.intel.security_level	String	Security level	"high"	✓	✓	✗
tychon.cipher_negotiation.intel.is_quantum_ready	Boolean	Is quantum ready	false	✓	✓	✗
tychon.cipher_negotiation.intel.is_pqc	Boolean	Is post-quantum	false	✓	✓	✗
tychon.cipher_negotiation.intel.is_fips140_2_compliant	Boolean	FIPS 140-2 compliant	true	✓	✓	✗
tychon.cipher_negotiation.intel.is_nist_approved	Boolean	NIST approved	true	✓	✓	✗
tychon.cipher_negotiation.intel.nist_security_category	String	NIST category	"recommended"	✓	✓	✗
tychon.cipher_negotiation.intel.cve_list	String	Known CVEs	""	✓	✓	✗
tychon.cipher_negotiation.intel.vulnerabilities	String	Known vulnerabilities	""	✓	✓	✗
tychon.cipher_negotiation.intel.recommendations	String	Recommendations	"Use for production"	✓	✓	✗
tychon.cipher_negotiation.intel.description	String	Cipher description	"Modern AEAD cipher"	✓	✓	✗
tychon.cipher_negotiation.intel.openssl_name	String	OpenSSL name	"TLS_AES_256_GCM_SHA384"	✓	✓	✗
tychon.cipher_negotiation.intel.iana_name	String	IANA name	"TLS_AES_256_GCM_SHA384"	✓	✓	✗
tychon.cipher_negotiation.intel.tls_version_min	String	Minimum TLS version	"TLSv1.3"	✓	✓	✗

Filesystem Certificate Fields

For events with event.dataset="certificate" or event.dataset="private_key"

Certificate Subject & Issuer

Field	Type	Description	Example	Full	Standard	Minimal
file.path	String	Full path to certificate	"/etc/ssl/certs/server.pem"	✓	✓	✗
file.name	String	Certificate filename	"server.pem"	✓	✓	✗
file.extension	String	File extension	"pem"	✓	✓	✗
file.size	Integer	File size in bytes	4096	✓	✓	✗
file.mtime	Date	File modification time	"2024-01-15T12:30:00Z"	✓	✓	✗
file.owner.name	String	File owner	"root"	✓	✓	✗
file.group.name	String	File group	"root"	✓	✓	✗
file.permissions	String	File permissions	"0600"	✓	✓	✗
certificate.subject	String	Subject DN (raw)	"CN=example.com,O=Acme"	✓	✓	✗
certificate.subject_common_name	String	Subject CN	"example.com"	✓	✓	✗
certificate.subject_country	String[]	Subject country	["US"]	✓	✓	✗
certificate.subject_organization	String[]	Subject organization	["Acme"]	✓	✓	✗
certificate.subject_organizational_unit	String[]	Subject OU	["IT"]	✓	✓	✗
certificate.subject_locality	String[]	Subject locality	["SF"]	✓	✓	✗
certificate.subject_province	String[]	Subject province	["CA"]	✓	✓	✗
certificate.issuer	String	Issuer DN (raw)	"CN=Root CA"	✓	✓	✗
certificate.issuer_common_name	String	Issuer CN	"Root CA"	✓	✓	✗
certificate.issuer_country	String[]	Issuer country	["US"]	✓	✓	✗
certificate.issuer_organization	String[]	Issuer organization	["Acme"]	✓	✓	✗
certificate.issuer_organizational_unit	String[]	Issuer OU	["CA"]	✓	✓	✗
certificate.issuer_locality	String[]	Issuer locality	["SF"]	✓	✓	✗
certificate.issuer_province	String[]	Issuer province	["CA"]	✓	✓	✗
certificate.not_before	Date	Valid from	"2024-01-01T00:00:00Z"	✓	✓	✗
certificate.not_after	Date	Valid until	"2025-01-01T00:00:00Z"	✓	✓	✗
certificate.is_private_key	Boolean	Is private key file	false	✓	✓	✗
x509.subject.distinguished_name	String	Subject DN	"CN=example.com"	✓	✓	✗
x509.issuer.distinguished_name	String	Issuer DN	"CN=Root CA"	✓	✓	✗
x509.public_key_size	Integer	Public key size	2048	✓	✓	✗
crypto.key_algorithm	String	Key algorithm	"RSA"	✓	✓	✗
crypto.key_size	Integer	Key size in bits	2048	✓	✓	✗
crypto.signature_algorithm	String	Signature algorithm	"SHA256withRSA"	✓	✓	✗
hash.sha256_certificate	String	SHA-256 fingerprint	"a1b2c3..."	✓	✓	✗

PQC Assessment

Field	Type	Description	Example	Full	Standard	Minimal
pqc.vulnerable	Boolean	Vulnerable to quantum attacks	true	✓	✓	✓
pqc.readiness	String	PQC readiness status	"not_ready"	✓	✓	✓
pqc.key_strength	String	Key strength assessment	"weak"	✓	✓	✗
pqc.quantum_risk	String	Quantum risk level	"high"	✓	✓	✗
pqc.recommended_action	String	Recommended action	"upgrade"	✓	✓	✗
pqc.migration_priority	String	Migration priority	"high"	✓	✓	✗
pqc.crypto_library	String	Crypto library used	"OpenSSL"	✓	✓	✗
pqc.reason	String	Vulnerability reason	"RSA-2048 vulnerable"	✓	✓	✗

Certificate Chain Fields

Pattern: certificate.chain.N.* where N = 0, 1, 2... Standard mode includes only chain.0 fields.

Field	Type	Description	Example	Full	Standard	Minimal
certificate.chain.0.subject	String	Chain cert #0 subject DN	"CN=Cert 0"	✓	✓	✗
certificate.chain.0.issuer	String	Chain cert #0 issuer DN	"CN=Issuer 0"	✓	✓	✗
certificate.chain.0.serial_number	String	Chain cert #0 serial	"00:23:45"	✓	✓	✗
certificate.chain.0.not_before	Date	Chain cert #0 valid from	"2024-01-01T00:00:00Z"	✓	✓	✗
certificate.chain.0.not_after	Date	Chain cert #0 valid until	"2025-01-01T00:00:00Z"	✓	✓	✗
certificate.chain.0.signature_algorithm	String	Chain cert #0 sig algo	"SHA256withRSA"	✓	✓	✗
certificate.chain.0.public_key_algorithm	String	Chain cert #0 key algo	"RSA"	✓	✓	✗
certificate.chain.0.public_key_size	Integer	Chain cert #0 key size	2048	✓	✓	✗
certificate.chain.0.version	Integer	Chain cert #0 X.509 version	3	✓	✓	✗
certificate.chain.0.is_ca	Boolean	Chain cert #0 is CA	false	✓	✓	✗
certificate.chain.0.subject_common_name	String	Chain cert #0 subject CN	"CN 0"	✓	✓	✗
certificate.chain.0.issuer_common_name	String	Chain cert #0 issuer CN	"Issuer 0"	✓	✓	✗
certificate.chain.0.sha256_fingerprint	String	Chain cert #0 SHA-256	"sha256_0..."	✓	✓	✗
certificate.chain.0.sha1_fingerprint	String	Chain cert #0 SHA-1	"sha1_0..."	✓	✓	✗
certificate.chain.0.dns_names	String[]	Chain cert #0 DNS names	[]	✓	✓	✗
certificate.chain.1.subject	String	Chain cert #1 subject DN	"CN=Cert 1"	✓	✗	✗
certificate.chain.1.issuer	String	Chain cert #1 issuer DN	"CN=Issuer 1"	✓	✗	✗
certificate.chain.1.serial_number	String	Chain cert #1 serial	"01:23:45"	✓	✗	✗
certificate.chain.1.not_before	Date	Chain cert #1 valid from	"2024-02-01T00:00:00Z"	✓	✗	✗
certificate.chain.1.not_after	Date	Chain cert #1 valid until	"2025-02-01T00:00:00Z"	✓	✗	✗
certificate.chain.1.signature_algorithm	String	Chain cert #1 sig algo	"SHA256withRSA"	✓	✗	✗
certificate.chain.1.public_key_algorithm	String	Chain cert #1 key algo	"RSA"	✓	✗	✗
certificate.chain.1.public_key_size	Integer	Chain cert #1 key size	2048	✓	✗	✗
certificate.chain.1.version	Integer	Chain cert #1 X.509 version	3	✓	✗	✗
certificate.chain.1.is_ca	Boolean	Chain cert #1 is CA	true	✓	✗	✗
certificate.chain.1.subject_common_name	String	Chain cert #1 subject CN	"CN 1"	✓	✗	✗
certificate.chain.1.issuer_common_name	String	Chain cert #1 issuer CN	"Issuer 1"	✓	✗	✗
certificate.chain.1.sha256_fingerprint	String	Chain cert #1 SHA-256	"sha256_1..."	✓	✗	✗
certificate.chain.1.sha1_fingerprint	String	Chain cert #1 SHA-1	"sha1_1..."	✓	✗	✗
certificate.chain.1.dns_names	String[]	Chain cert #1 DNS names	[]	✓	✗	✗
certificate.chain.2.subject	String	Chain cert #2 subject DN	"CN=Cert 2"	✓	✗	✗
certificate.chain.2.issuer	String	Chain cert #2 issuer DN	"CN=Issuer 2"	✓	✗	✗
certificate.chain.2.serial_number	String	Chain cert #2 serial	"02:23:45"	✓	✗	✗
certificate.chain.2.not_before	Date	Chain cert #2 valid from	"2024-03-01T00:00:00Z"	✓	✗	✗
certificate.chain.2.not_after	Date	Chain cert #2 valid until	"2025-03-01T00:00:00Z"	✓	✗	✗
certificate.chain.2.signature_algorithm	String	Chain cert #2 sig algo	"SHA256withRSA"	✓	✗	✗
certificate.chain.2.public_key_algorithm	String	Chain cert #2 key algo	"RSA"	✓	✗	✗
certificate.chain.2.public_key_size	Integer	Chain cert #2 key size	2048	✓	✗	✗
certificate.chain.2.version	Integer	Chain cert #2 X.509 version	3	✓	✗	✗
certificate.chain.2.is_ca	Boolean	Chain cert #2 is CA	true	✓	✗	✗
certificate.chain.2.subject_common_name	String	Chain cert #2 subject CN	"CN 2"	✓	✗	✗
certificate.chain.2.issuer_common_name	String	Chain cert #2 issuer CN	"Issuer 2"	✓	✗	✗
certificate.chain.2.sha256_fingerprint	String	Chain cert #2 SHA-256	"sha256_2..."	✓	✗	✗
certificate.chain.2.sha1_fingerprint	String	Chain cert #2 SHA-1	"sha1_2..."	✓	✗	✗
certificate.chain.2.dns_names	String[]	Chain cert #2 DNS names	[]	✓	✗	✗

Keystore Certificate Fields

For events with event.dataset="keystore_certificate"

Keystore Metadata & Encryption

Field	Type	Description	Example	Full	Standard	Minimal
keystore.path	String	Path to keystore	"/home/user/keystore.p12"	✓	✓	✓
keystore.type	String	Keystore type	"PKCS12"	✓	✓	✓
keystore.accessible	Boolean	Is accessible	true	✓	✓	✓
keystore.requires_auth	Boolean	Requires authentication	true	✓	✓	✗
keystore.cert_count	Integer	Number of certificates	10	✓	✓	✓
keystore.owner	String	Keystore owner	"root"	✓	✓	✗
keystore.permissions	String	File permissions	"600"	✓	✓	✗
keystore.error_message	String	Error message	""	✓	✓	✗
keystore.encryption.algorithm	String	Encryption algorithm	"PBEWithHmacSHA256"	✓	✓	✗
keystore.encryption.kdf	String	Key derivation function	"PBKDF2"	✓	✓	✗
keystore.encryption.iterations	Integer	KDF iterations	10000	✓	✓	✗
keystore.encryption.mac	String	MAC algorithm	"HmacSHA256"	✓	✓	✗
keystore.encryption.vulnerable	Boolean	Is encryption vulnerable	false	✓	✓	✗
keystore.encryption.reason	String	Vulnerability reason	""	✓	✓	✗
keystore.encryption.iv_length	Integer	IV length in bytes	16	✓	✗	✗
keystore.encryption.salt_length	Integer	Salt length in bytes	16	✓	✗	✗
file.size	Long	File size in bytes	4096	✓	✓	✗
file.mtime	Date	Last modified	"2024-12-15T10:30:00Z"	✓	✓	✗

Certificate Details in Keystore

Field	Type	Description	Example	Full	Standard	Minimal
certificate.alias	String	Certificate alias	"server-cert"	✓	✓	✗
certificate.is_ca	Boolean	Is CA certificate	false	✓	✓	✗
certificate.is_self_signed	Boolean	Is self-signed	false	✓	✓	✗
certificate.has_private_key	Boolean	Has private key	true	✓	✓	✗
tls.certificate.subject	String	Certificate subject	"CN=example.com"	✓	✓	✗
tls.certificate.issuer	String	Certificate issuer	"CN=Root CA"	✓	✓	✗
tls.certificate.not_before	Date	Valid from	"2024-01-01T00:00:00Z"	✓	✓	✗
tls.certificate.not_after	Date	Valid until	"2025-01-01T00:00:00Z"	✓	✓	✗
tls.certificate.serial_number	String	Serial number	"01:23:45"	✓	✓	✗
tls.certificate.extended_key_usage	String[]	Extended key usage	["serverAuth"]	✓	✓	✗
tls.server.subject	String	Subject (compat)	"CN=example.com"	✓	✓	✗
tls.server.issuer	String	Issuer (compat)	"CN=Root CA"	✓	✓	✗
tls.server.not_before	Date	Valid from (compat)	"2024-01-01T00:00:00Z"	✓	✓	✗
tls.server.not_after	Date	Valid until (compat)	"2025-01-01T00:00:00Z"	✓	✓	✗
tls.server.serial_number	String	Serial (compat)	"01:23:45"	✓	✓	✗
tls.server.hash.sha1	String	SHA-1 thumbprint	"abc123..."	✓	✓	✗
vulnerability.is_vulnerable	Boolean	Is vulnerable	true	✓	✓	✓
vulnerability.risk_level	String	Risk level	"high"	✓	✓	✓
vulnerability.risk_reason	String	Risk reason	"RSA-2048"	✓	✓	✗
vulnerability.cve_list	String[]	CVE list	[]	✓	✓	✗
active	Boolean	Is active	true	✓	✓	✗
last_seen	Date	Last seen	"2025-01-16T10:15:39Z"	✓	✓	✗

Keystore Statistics

For events with event.dataset="keystore" (summary events)

Field	Type	Description	Example	Full	Standard	Minimal
keystore.stats.vulnerable_certificates	Integer	Count of vulnerable certs	2	✓	✓	✗
keystore.stats.pqc_vulnerable_certificates	Integer	Count of PQC vulnerable	5	✓	✓	✗
keystore.stats.expired_certificates	Integer	Count of expired	1	✓	✓	✗
keystore.stats.certificate_types.ca	Integer	Count of CA certs	3	✓	✓	✗
keystore.stats.certificate_types.end_entity	Integer	Count of end-entity	7	✓	✓	✗
keystore.stats.key_algorithms.RSA	Integer	Count of RSA keys	8	✓	✓	✗
keystore.stats.key_algorithms.ECDSA	Integer	Count of ECDSA keys	2	✓	✓	✗

Crypto Library Fields

For events with event.dataset="memory_scan" or event.dataset="java_crypto"

Field	Type	Description	Example	Full	Standard	Minimal
vulnerability.is_vulnerable	Boolean	Is library vulnerable	true	✓	✓	✓
vulnerability.risk_level	String	Risk level	"high"	✓	✓	✓
vulnerability.risk_reason	String	Risk reason	"Known CVE"	✓	✓	✗
vulnerability.cve_list	String[]	List of CVEs	["CVE-2023-1234"]	✓	✓	✗
vulnerability.fixed_in_version	String	Fixed in version	"1.1.1t"	✓	✓	✗
vulnerability.assessed_at	Date	Assessment timestamp	"2025-01-16T10:15:39Z"	✓	✓	✗
java.vendor	String	Java vendor (Java only)	"Oracle Corporation"	✓	✓	✗
java.version	String	Java version (Java only)	"11.0.16"	✓	✓	✗

Note: Additional library.* fields are dynamically flattened from the CryptoLibrary structure.

VPN Client & IPSec Tunnel Fields

VPN Client Fields

For events with event.dataset="vpn"

Field	Type	Description	Example	Full	Standard	Minimal
file.path	String	VPN install path	"C:\Program Files\VPN"	✓	✓	✗
service.name	String	VPN service name	"OpenVPN"	✓	✓	✗
service.state	String	VPN service state	"running"	✓	✓	✗

Note: Additional vpn_client.* fields are dynamically flattened from the VPNClientInfo structure.

IPSec Tunnel Fields

For events with event.dataset="ipsec"

Field	Type	Description	Example	Full	Standard	Minimal
source.ip	IP	Local endpoint IP	"10.0.0.1"	✓	✓	✗
destination.ip	IP	Remote endpoint IP	"10.0.1.1"	✓	✓	✗
source.network	String	Local subnet	"10.0.0.0/24"	✓	✓	✗
destination.network	String	Remote subnet	"10.0.1.0/24"	✓	✓	✗

Note: Additional ipsec_tunnel.* fields are dynamically flattened from the IPSecTunnelInfo structure.

Quantum Readiness Assessment Fields

For events with event.dataset="quantum_assessment" (local mode only)

Note: This section contains 70+ fields. Only top-level fields are shown for brevity. Refer to the source code for complete field documentation.

Top-Level Assessment Fields

Field	Type	Description	Example	Full	Standard	Minimal
quantum_readiness.assessment_id	String	Assessment ID	"qr_20250915_abc123"	✓	✓	✗
quantum_readiness.timestamp	String	Assessment timestamp	"2025-09-15T10:15:39Z"	✓	✓	✗
quantum_readiness.assessment_type	String	Assessment type	"comprehensive"	✓	✓	✗
quantum_readiness.overall_score	Integer	Overall score (0-100)	64	✓	✓	✓
quantum_readiness.readiness_status	String	Readiness status	"Update Required"	✓	✓	✓
quantum_readiness.status_color	String	Status color	"orange"	✓	✓	✗
quantum_readiness.ready_timeline	String	Timeline to readiness	"2-6 months"	✓	✓	✗

Additional Quantum Readiness Sections:

quantum_readiness.hardware.* - 22 fields covering CPU, memory, security hardware
quantum_readiness.operating_system.* - 16 fields covering OS, crypto APIs, PQC support
quantum_readiness.crypto_libraries.* - 8+ fields covering OpenSSL, system libraries
quantum_readiness.network.* - 12 fields covering bandwidth, protocols, TLS
quantum_readiness.upgrade_pathway.* - 6 fields for first upgrade step
quantum_readiness.compliance.* - 4 fields for compliance status
quantum_readiness.system_classification.* - 4 fields

Overview

Output Modes

Best For

Usage