Newline-delimited JSON optimized for streaming and log analysis
The Flat NDJSON format outputs one JSON record per line, with each line representing a single cipher suite, certificate, crypto library, or other cryptographic asset. All nested structures are flattened using dot notation.
./certscanner -host example.com \
-outputformat flatndjson \
-output stream.ndjsonEach line represents a single cryptographic asset event. Different event types share common base fields but include type-specific fields. The checkmark columns indicate which output mode includes each field.
| Field | Type | Required | Description | Example | Full | Standard | Minimal |
|---|---|---|---|---|---|---|---|
| @timestamp | String | Yes | Event timestamp (ISO 8601) | "2025-09-02T13:45:30.123Z" | ✓ | ✓ | ✓ |
| event.action | String | Yes | Event type identifier | "cipher_suite_discovered" | ✓ | ✓ | ✓ |
| event.category | String | Yes | ECS event category | "host", "network" | ✓ | ✓ | ✓ |
| event.kind | String | Yes | ECS event kind (always "event") | "event" | ✓ | ✓ | ✓ |
| event.type | String | Yes | ECS event type | "info", "connection" | ✓ | ✓ | ✓ |
| event.dataset | String | Yes | Dataset name | "port_detail" | ✓ | ✓ | ✓ |
| tychon.type | String | Yes | Tychon-specific event type | "cipher" | ✓ | ✓ | ✓ |
| tychon.index | String | Yes | Elasticsearch index routing slug. Full index name = tychon-pqc-{tychon.index}. Stamped on every event so consumers can route documents without their own mapping table. | "ciphers" | ✓ | ✓ | ✓ |
| observer.hostname | String | Yes | Scanning system hostname | "scanner-host" | ✓ | ✓ | ✓ |
| observer.ip | Array | No | Scanner IP addresses | ["192.168.1.100"] | ✓ | ✓ | ✓ |
| observer.id | String | No | Host ID of scanning system | "host-abc123" | ✓ | ✓ | ✓ |
| observer.os.name | String | Yes | Scanner OS name | "Windows" | ✓ | ✓ | ✓ |
| observer.os.version | String | No | Scanner OS version | "10.0.19045" | ✓ | ✓ | ✗ |
| observer.os.family | String | No | OS family | "Darwin" | ✓ | ✓ | ✗ |
| observer.os.platform | String | No | OS platform name | "darwin" | ✓ | ✓ | ✗ |
| observer.os.kernel | String | No | Kernel version | "24.5.0" | ✓ | ✓ | ✗ |
| observer.os.build | String | No | OS build number (Windows only — e.g., "19045") | "19045" | ✓ | ✓ | ✗ |
| observer.architecture | String | No | CPU architecture | "x86_64" | ✓ | ✓ | ✗ |
| observer.cpu_cores | Integer | No | Number of physical CPU cores | 8 | ✓ | ✓ | ✗ |
| observer.cpu_logical_cores | Integer | No | Number of logical CPU cores | 16 | ✓ | ✓ | ✗ |
| observer.total_ram | Long | No | Total RAM in bytes | 34359738368 | ✓ | ✓ | ✗ |
| observer.cpu_vendor_id | String | No | CPU vendor identifier | "GenuineIntel" | ✓ | ✗ | ✗ |
| observer.cpu_model_name | String | No | CPU model name | "Intel Core i7" | ✓ | ✗ | ✗ |
| observer.kernel_arch | String | No | Kernel architecture | "x86_64" | ✓ | ✓ | ✗ |
| observer.virtualization_system | String | No | Virtualization system | "kvm" | ✓ | ✓ | ✗ |
| observer.virtualization_role | String | No | Virtualization role | "guest" | ✓ | ✓ | ✗ |
| observer.ram_used_percent | Float | No | RAM used percentage | 45.2 | ✓ | ✗ | ✗ |
| observer.system_uptime_seconds | Long | No | System uptime in seconds | 3456789 | ✓ | ✗ | ✗ |
| observer.openssl_version_used | String | No | OpenSSL version used | "OpenSSL 3.0.8" | ✓ | ✓ | ✗ |
| observer.openssl_path_used | String | No | Path to OpenSSL binary | "/usr/bin/openssl" | ✓ | ✗ | ✗ |
| observer.machine_serial_number | String | No | Machine serial number | "C02XG0F3JG5H" | ✓ | ✗ | ✗ |
| observer.bios_serial_number | String | No | BIOS serial number | "VMware-56 4d" | ✓ | ✗ | ✗ |
| observer.organization | String | No | Organization name | "Acme Corp" | ✓ | ✓ | ✗ |
| observer.domain | String | No | Domain name | "acme.local" | ✓ | ✓ | ✗ |
| observer.current_user | String | No | Current user | "admin" | ✓ | ✓ | ✗ |
| observer.user_uid | String | No | User UID | "1000" | ✓ | ✗ | ✗ |
| observer.user_gid | String | No | User GID | "1000" | ✓ | ✗ | ✗ |
| observer.user_home_dir | String | No | User home directory | "/home/admin" | ✓ | ✗ | ✗ |
| observer.fips_mode_enabled | Boolean | Yes | FIPS 140-2 mode status | true | ✓ | ✓ | ✗ |
| observer.bigfix_client_installed | Boolean | No | BigFix client installed | true | ✓ | ✓ | ✗ |
| observer.bigfix_client_id | String | No | BigFix client ID | "12345678" | ✓ | ✓ | ✗ |
| observer.is_vdi_environment | Boolean | No | True when scanner runs in a non-persistent VDI session (VMware Horizon, Citrix, AVD) | true | ✓ | ✓ | ✗ |
| observer.vdi_identity_source | String | No | Method used to resolve stable host identity in VDI mode: cli_override, profile_file, username_hash, or gopsutil | "profile_file" | ✓ | ✓ | ✗ |
| observer.output_schema_version | String | Yes | Version of the flat NDJSON output schema. | "3.0" | ✓ | ✓ | ✓ |
| observer.software.name | String | Yes | Tool name | "TYCHON Quantum Readiness" | ✓ | ✓ | ✗ |
| observer.software.version | String | Yes | Tool version | "2.0.0" | ✓ | ✓ | ✗ |
| scan.type | String | Yes | Scan mode | "local" | ✓ | ✓ | ✓ |
| scan.target | String | Yes | Original target specification | "example.com:443" | ✓ | ✓ | ✓ |
| scan.target_input | String | No | Target input provided | "192.168.1.0/24" | ✓ | ✓ | ✗ |
| scan.timestamp | Date | No | Scan timestamp | "2025-09-15T10:15:39Z" | ✓ | ✓ | ✗ |
| scan.tags | String[] | No | Tags applied to scan | ["production"] | ✓ | ✓ | ✗ |
| tags | Array | No | Custom scan tags | ["prod", "compliance"] | ✓ | ✓ | ✗ |
For events with event.dataset="port_detail". One row per (host, port) — upserted on each scan using a stable id derived from SHA-256(port_detail | hostname | host | port). When a server is upgraded from TLS 1.2 to TLS 1.3, the document is updated in-place rather than creating a new one. The preferred (highest-priority) cipher appears in tls.server.cipher; the full supported set is comma-joined in tls.server.supported_ciphers.
| Field | Type | Description | Example | Full | Standard | Minimal |
|---|---|---|---|---|---|---|
| target_host.address | String | Target host address | "192.168.1.10" | ✓ | ✓ | ✓ |
| target_host.domain | String | Target host domain | "server.acme.local" | ✓ | ✓ | ✗ |
| target_host.ip | IP | Target host IP | "192.168.1.10" | ✓ | ✓ | ✗ |
| target_host.ipv4 | IP | Target host IPv4 | "192.168.1.10" | ✓ | ✓ | ✗ |
| target_host.ipv6 | IP | Target host IPv6 | "fe80::1" | ✓ | ✓ | ✗ |
| server.address | String | Server address | "192.168.1.10" | ✓ | ✓ | ✓ |
| server.port | Integer | Server port | 443 | ✓ | ✓ | ✓ |
| server.ip | IP | Server IP | "192.168.1.10" | ✓ | ✓ | ✗ |
| port.number | Integer | Port number | 443 | ✓ | ✓ | ✓ |
| port.status_overall | String | Port status | "open" | ✓ | ✓ | ✓ |
| port.protocol_detected | String | Detected protocol | "https" | ✓ | ✓ | ✗ |
| error.message | String | Error message if failed | "Connection timeout" | ✓ | ✓ | ✗ |
| network.protocol | String | Network protocol | "tls" | ✓ | ✓ | ✗ |
| network.transport | String | Network transport | "tcp" | ✓ | ✓ | ✗ |
| service.name | String | Service name | "https" | ✓ | ✓ | ✗ |
| service.version | String | Service version | "nginx/1.21.0" | ✓ | ✓ | ✗ |
| Field | Type | Description | Example | Full | Standard | Minimal | |
|---|---|---|---|---|---|---|---|
| quantum_ready | Boolean | Overall quantum readiness | true | ✓ | ✓ | ✓ | |
| quantum_ready_kx | Boolean | Key exchange quantum-ready | true | ✓ | ✓ | ✓ | |
| quantum_ready_cipher | Boolean | Cipher quantum-ready | true | ✓ | ✓ | ✓ | |
| quantum_ready_cert | Boolean | Certificate quantum-ready | false | ✓ | ✓ | ✓ | |
| tychon.crypto.protocol | String | No | Canonical protocol name — always TLS for cipher events | "TLS" | ✓ | ✓ | ✓ |
| tychon.crypto.protocol_version | String | No | TLS version number (e.g. 1.3, 1.2) | "1.3" | ✓ | ✓ | ✗ |
| tychon.crypto.key_exchange | String | No | Negotiated key exchange group (e.g. x25519, X25519MLKEM768) | "X25519MLKEM768" | ✓ | ✓ | ✗ |
| tychon.crypto.cipher | String | No | Bulk cipher extracted from cipher suite (e.g. AES-256-GCM) | "AES-256-GCM" | ✓ | ✓ | ✗ |
| tychon.crypto.mac | String | No | MAC / AEAD tag algorithm (e.g. SHA-384) | "SHA-384" | ✓ | ✓ | ✗ |
| tychon.crypto.auth | String | No | Server authentication / signature digest (e.g. RSA-SHA256) | "RSA-SHA256" | ✓ | ✓ | ✗ |
| tychon.crypto.pqc_vulnerable | Boolean | No | True when key exchange or cipher is vulnerable to a quantum computer | false | ✓ | ✓ | ✓ |
| tychon.crypto.pqc_readiness | String | No | Canonical readiness: ready, transitional, vulnerable, or critical | "ready" | ✓ | ✓ | ✓ |
| tychon.crypto.quantum_risk | String | No | Canonical risk: none, low, medium, high, or critical | "none" | ✓ | ✓ | ✓ |
Preferred cipher is the server's top choice; full enumeration is comma-joined for easy querying without array handling.
| Field | Type | Description | Example | Full | Standard | Minimal |
|---|---|---|---|---|---|---|
| id | String | Stable upsert ID — SHA-256(port_detail | hostname | host | port) truncated to 16 hex chars. Remote scans exclude observer ID for cross-scanner deduplication. | "a3f1bc920d4e8f12" | ✓ | ✓ | ✗ |
| tls.server.cipher | String | Preferred cipher suite name | "TLS_AES_256_GCM_SHA384" | ✓ | ✓ | ✗ |
| tls.server.protocol_version | String | Preferred TLS protocol version | "TLSv1.3" | ✓ | ✓ | ✗ |
| tls.server.negotiated_group | String | Preferred key exchange group | "X25519MLKEM768" | ✓ | ✓ | ✗ |
| tls.server.supported_ciphers | String | Comma-joined list of all supported cipher suites | "TLS_AES_256_GCM_SHA384, TLS_AES_128_GCM_SHA256" | ✓ | ✓ | ✗ |
| tls.server.cipher_count | Integer | Number of supported cipher suites discovered | 2 | ✓ | ✓ | ✗ |
| tls.server.supported_protocols | String | Comma-joined list of all supported TLS protocol versions | "TLSv1.3, TLSv1.2" | ✓ | ✓ | ✗ |
| tls.server.supported_key_exchanges | String | Comma-joined list of all key exchange groups offered | "X25519MLKEM768, x25519, secp256r1" | ✓ | ✓ | ✗ |
| Field | Type | Description | Example | Full | Standard | Minimal |
|---|---|---|---|---|---|---|
| tychon.cipher_negotiation.intel.encryption_algorithm | String | Encryption algorithm | "AES-GCM" | ✓ | ✓ | ✗ |
| tychon.cipher_negotiation.intel.key_exchange_algorithm | String | Key exchange algorithm | "ECDHE" | ✓ | ✓ | ✗ |
| tychon.cipher_negotiation.intel.authentication_algorithm | String | Authentication algorithm | "RSA" | ✓ | ✓ | ✗ |
| tychon.cipher_negotiation.intel.mac_algorithm | String | MAC algorithm | "AEAD" | ✓ | ✓ | ✗ |
| tychon.cipher_negotiation.intel.encryption_bits | Integer | Encryption bit strength | 256 | ✓ | ✓ | ✗ |
| tychon.cipher_negotiation.intel.key_exchange_bits | Integer | Key exchange bits | 256 | ✓ | ✓ | ✗ |
| tychon.cipher_negotiation.intel.authentication_bits | Integer | Authentication bits | 2048 | ✓ | ✓ | ✗ |
| tychon.cipher_negotiation.intel.overall_risk | String | Overall risk | "low" | ✓ | ✓ | ✗ |
| tychon.cipher_negotiation.intel.security_level | String | Security level | "high" | ✓ | ✓ | ✗ |
| tychon.cipher_negotiation.intel.is_quantum_ready | Boolean | Is quantum ready | false | ✓ | ✓ | ✗ |
| tychon.cipher_negotiation.intel.is_pqc | Boolean | Is post-quantum | false | ✓ | ✓ | ✗ |
| tychon.cipher_negotiation.intel.is_fips140_2_compliant | Boolean | FIPS 140-2 compliant | true | ✓ | ✓ | ✗ |
| tychon.cipher_negotiation.intel.is_nist_approved | Boolean | NIST approved | true | ✓ | ✓ | ✗ |
| tychon.cipher_negotiation.intel.nist_security_category | String | NIST category | "recommended" | ✓ | ✓ | ✗ |
| tychon.cipher_negotiation.intel.cve_list | String | Known CVEs | "" | ✓ | ✓ | ✗ |
| tychon.cipher_negotiation.intel.vulnerabilities | String | Known vulnerabilities | "" | ✓ | ✓ | ✗ |
| tychon.cipher_negotiation.intel.recommendations | String | Recommendations | "Use for production" | ✓ | ✓ | ✗ |
| tychon.cipher_negotiation.intel.description | String | Cipher description | "Modern AEAD cipher" | ✓ | ✓ | ✗ |
| tychon.cipher_negotiation.intel.openssl_name | String | OpenSSL name | "TLS_AES_256_GCM_SHA384" | ✓ | ✓ | ✗ |
| tychon.cipher_negotiation.intel.iana_name | String | IANA name | "TLS_AES_256_GCM_SHA384" | ✓ | ✓ | ✗ |
| tychon.cipher_negotiation.intel.tls_version_min | String | Minimum TLS version | "TLSv1.3" | ✓ | ✓ | ✗ |
For events with event.dataset="certificate" or event.dataset="private_key"
| Field | Type | Description | Example | Full | Standard | Minimal | |
|---|---|---|---|---|---|---|---|
| file.path | String | Full path to certificate | "/etc/ssl/certs/server.pem" | ✓ | ✓ | ✗ | |
| file.name | String | Certificate filename | "server.pem" | ✓ | ✓ | ✗ | |
| file.extension | String | File extension | "pem" | ✓ | ✓ | ✗ | |
| file.size | Integer | File size in bytes | 4096 | ✓ | ✓ | ✗ | |
| file.mtime | Date | File modification time | "2024-01-15T12:30:00Z" | ✓ | ✓ | ✗ | |
| file.owner.name | String | File owner | "root" | ✓ | ✓ | ✗ | |
| file.group.name | String | File group | "root" | ✓ | ✓ | ✗ | |
| file.permissions | String | File permissions | "0600" | ✓ | ✓ | ✗ | |
| certificate.subject | String | Subject DN (raw) | "CN=example.com,O=Acme" | ✓ | ✓ | ✗ | |
| certificate.subject_common_name | String | Subject CN | "example.com" | ✓ | ✓ | ✗ | |
| certificate.subject_country | String[] | Subject country | ["US"] | ✓ | ✓ | ✗ | |
| certificate.subject_organization | String[] | Subject organization | ["Acme"] | ✓ | ✓ | ✗ | |
| certificate.subject_organizational_unit | String[] | Subject OU | ["IT"] | ✓ | ✓ | ✗ | |
| certificate.subject_locality | String[] | Subject locality | ["SF"] | ✓ | ✓ | ✗ | |
| certificate.subject_province | String[] | Subject province | ["CA"] | ✓ | ✓ | ✗ | |
| certificate.issuer | String | Issuer DN (raw) | "CN=Root CA" | ✓ | ✓ | ✗ | |
| certificate.issuer_common_name | String | Issuer CN | "Root CA" | ✓ | ✓ | ✗ | |
| certificate.issuer_country | String[] | Issuer country | ["US"] | ✓ | ✓ | ✗ | |
| certificate.issuer_organization | String[] | Issuer organization | ["Acme"] | ✓ | ✓ | ✗ | |
| certificate.issuer_organizational_unit | String[] | Issuer OU | ["CA"] | ✓ | ✓ | ✗ | |
| certificate.issuer_locality | String[] | Issuer locality | ["SF"] | ✓ | ✓ | ✗ | |
| certificate.issuer_province | String[] | Issuer province | ["CA"] | ✓ | ✓ | ✗ | |
| certificate.not_before | Date | Valid from | "2024-01-01T00:00:00Z" | ✓ | ✓ | ✗ | |
| certificate.not_after | Date | Valid until | "2025-01-01T00:00:00Z" | ✓ | ✓ | ✗ | |
| certificate.is_private_key | Boolean | Is private key file | false | ✓ | ✓ | ✗ | |
| x509.subject.distinguished_name | String | Subject DN | "CN=example.com" | ✓ | ✓ | ✗ | |
| x509.issuer.distinguished_name | String | Issuer DN | "CN=Root CA" | ✓ | ✓ | ✗ | |
| x509.public_key_size | Integer | Public key size | 2048 | ✓ | ✓ | ✗ | |
| crypto.key_algorithm | String | Key algorithm | "RSA" | ✓ | ✓ | ✗ | |
| crypto.key_size | Integer | Key size in bits | 2048 | ✓ | ✓ | ✗ | |
| crypto.signature_algorithm | String | Signature algorithm | "SHA256withRSA" | ✓ | ✓ | ✗ | |
| hash.sha256_certificate | String | SHA-256 fingerprint | "a1b2c3..." | ✓ | ✓ | ✗ | |
| tychon.crypto.protocol | String | No | Always X.509 for filesystem certificate events | "X.509" | ✓ | ✓ | ✓ |
| tychon.crypto.cipher | String | No | Public key algorithm (e.g. RSA-2048, ECDSA-P256) | "RSA-2048" | ✓ | ✓ | ✗ |
| tychon.crypto.pqc_vulnerable | Boolean | No | True when the certificate's public key algorithm is vulnerable to a quantum computer | true | ✓ | ✓ | ✓ |
| tychon.crypto.pqc_readiness | String | No | Canonical readiness: ready, transitional, vulnerable, or critical | "vulnerable" | ✓ | ✓ | ✓ |
| tychon.crypto.quantum_risk | String | No | Canonical risk: none, low, medium, high, or critical | "high" | ✓ | ✓ | ✓ |
| Field | Type | Description | Example | Full | Standard | Minimal |
|---|---|---|---|---|---|---|
| pqc.vulnerable | Boolean | Vulnerable to quantum attacks | true | ✓ | ✓ | ✓ |
| pqc.readiness | String | PQC readiness status | "not_ready" | ✓ | ✓ | ✓ |
| pqc.key_strength | String | Key strength assessment | "weak" | ✓ | ✓ | ✗ |
| pqc.quantum_risk | String | Quantum risk level | "high" | ✓ | ✓ | ✗ |
| pqc.recommended_action | String | Recommended action | "upgrade" | ✓ | ✓ | ✗ |
| pqc.migration_priority | String | Migration priority | "high" | ✓ | ✓ | ✗ |
| pqc.crypto_library | String | Crypto library used | "OpenSSL" | ✓ | ✓ | ✗ |
| pqc.reason | String | Vulnerability reason | "RSA-2048 vulnerable" | ✓ | ✓ | ✗ |
Pattern: certificate.chain.N.* where N = 0, 1, 2... Standard mode includes only chain.0 fields.
| Field | Type | Description | Example | Full | Standard | Minimal |
|---|---|---|---|---|---|---|
| certificate.chain.0.subject | String | Chain cert #0 subject DN | "CN=Cert 0" | ✓ | ✓ | ✗ |
| certificate.chain.0.issuer | String | Chain cert #0 issuer DN | "CN=Issuer 0" | ✓ | ✓ | ✗ |
| certificate.chain.0.serial_number | String | Chain cert #0 serial | "00:23:45" | ✓ | ✓ | ✗ |
| certificate.chain.0.not_before | Date | Chain cert #0 valid from | "2024-01-01T00:00:00Z" | ✓ | ✓ | ✗ |
| certificate.chain.0.not_after | Date | Chain cert #0 valid until | "2025-01-01T00:00:00Z" | ✓ | ✓ | ✗ |
| certificate.chain.0.signature_algorithm | String | Chain cert #0 sig algo | "SHA256withRSA" | ✓ | ✓ | ✗ |
| certificate.chain.0.public_key_algorithm | String | Chain cert #0 key algo | "RSA" | ✓ | ✓ | ✗ |
| certificate.chain.0.public_key_size | Integer | Chain cert #0 key size | 2048 | ✓ | ✓ | ✗ |
| certificate.chain.0.version | Integer | Chain cert #0 X.509 version | 3 | ✓ | ✓ | ✗ |
| certificate.chain.0.is_ca | Boolean | Chain cert #0 is CA | false | ✓ | ✓ | ✗ |
| certificate.chain.0.subject_common_name | String | Chain cert #0 subject CN | "CN 0" | ✓ | ✓ | ✗ |
| certificate.chain.0.issuer_common_name | String | Chain cert #0 issuer CN | "Issuer 0" | ✓ | ✓ | ✗ |
| certificate.chain.0.sha256_fingerprint | String | Chain cert #0 SHA-256 | "sha256_0..." | ✓ | ✓ | ✗ |
| certificate.chain.0.sha1_fingerprint | String | Chain cert #0 SHA-1 | "sha1_0..." | ✓ | ✓ | ✗ |
| certificate.chain.0.dns_names | String[] | Chain cert #0 DNS names | [] | ✓ | ✓ | ✗ |
| certificate.chain.1.subject | String | Chain cert #1 subject DN | "CN=Cert 1" | ✓ | ✗ | ✗ |
| certificate.chain.1.issuer | String | Chain cert #1 issuer DN | "CN=Issuer 1" | ✓ | ✗ | ✗ |
| certificate.chain.1.serial_number | String | Chain cert #1 serial | "01:23:45" | ✓ | ✗ | ✗ |
| certificate.chain.1.not_before | Date | Chain cert #1 valid from | "2024-02-01T00:00:00Z" | ✓ | ✗ | ✗ |
| certificate.chain.1.not_after | Date | Chain cert #1 valid until | "2025-02-01T00:00:00Z" | ✓ | ✗ | ✗ |
| certificate.chain.1.signature_algorithm | String | Chain cert #1 sig algo | "SHA256withRSA" | ✓ | ✗ | ✗ |
| certificate.chain.1.public_key_algorithm | String | Chain cert #1 key algo | "RSA" | ✓ | ✗ | ✗ |
| certificate.chain.1.public_key_size | Integer | Chain cert #1 key size | 2048 | ✓ | ✗ | ✗ |
| certificate.chain.1.version | Integer | Chain cert #1 X.509 version | 3 | ✓ | ✗ | ✗ |
| certificate.chain.1.is_ca | Boolean | Chain cert #1 is CA | true | ✓ | ✗ | ✗ |
| certificate.chain.1.subject_common_name | String | Chain cert #1 subject CN | "CN 1" | ✓ | ✗ | ✗ |
| certificate.chain.1.issuer_common_name | String | Chain cert #1 issuer CN | "Issuer 1" | ✓ | ✗ | ✗ |
| certificate.chain.1.sha256_fingerprint | String | Chain cert #1 SHA-256 | "sha256_1..." | ✓ | ✗ | ✗ |
| certificate.chain.1.sha1_fingerprint | String | Chain cert #1 SHA-1 | "sha1_1..." | ✓ | ✗ | ✗ |
| certificate.chain.1.dns_names | String[] | Chain cert #1 DNS names | [] | ✓ | ✗ | ✗ |
| certificate.chain.2.subject | String | Chain cert #2 subject DN | "CN=Cert 2" | ✓ | ✗ | ✗ |
| certificate.chain.2.issuer | String | Chain cert #2 issuer DN | "CN=Issuer 2" | ✓ | ✗ | ✗ |
| certificate.chain.2.serial_number | String | Chain cert #2 serial | "02:23:45" | ✓ | ✗ | ✗ |
| certificate.chain.2.not_before | Date | Chain cert #2 valid from | "2024-03-01T00:00:00Z" | ✓ | ✗ | ✗ |
| certificate.chain.2.not_after | Date | Chain cert #2 valid until | "2025-03-01T00:00:00Z" | ✓ | ✗ | ✗ |
| certificate.chain.2.signature_algorithm | String | Chain cert #2 sig algo | "SHA256withRSA" | ✓ | ✗ | ✗ |
| certificate.chain.2.public_key_algorithm | String | Chain cert #2 key algo | "RSA" | ✓ | ✗ | ✗ |
| certificate.chain.2.public_key_size | Integer | Chain cert #2 key size | 2048 | ✓ | ✗ | ✗ |
| certificate.chain.2.version | Integer | Chain cert #2 X.509 version | 3 | ✓ | ✗ | ✗ |
| certificate.chain.2.is_ca | Boolean | Chain cert #2 is CA | true | ✓ | ✗ | ✗ |
| certificate.chain.2.subject_common_name | String | Chain cert #2 subject CN | "CN 2" | ✓ | ✗ | ✗ |
| certificate.chain.2.issuer_common_name | String | Chain cert #2 issuer CN | "Issuer 2" | ✓ | ✗ | ✗ |
| certificate.chain.2.sha256_fingerprint | String | Chain cert #2 SHA-256 | "sha256_2..." | ✓ | ✗ | ✗ |
| certificate.chain.2.sha1_fingerprint | String | Chain cert #2 SHA-1 | "sha1_2..." | ✓ | ✗ | ✗ |
| certificate.chain.2.dns_names | String[] | Chain cert #2 DNS names | [] | ✓ | ✗ | ✗ |
For events with event.dataset="keystore_certificate"
| Field | Type | Description | Example | Full | Standard | Minimal |
|---|---|---|---|---|---|---|
| keystore.path | String | Path to keystore | "/home/user/keystore.p12" | ✓ | ✓ | ✓ |
| keystore.type | String | Keystore type | "PKCS12" | ✓ | ✓ | ✓ |
| keystore.accessible | Boolean | Is accessible | true | ✓ | ✓ | ✓ |
| keystore.requires_auth | Boolean | Requires authentication | true | ✓ | ✓ | ✗ |
| keystore.cert_count | Integer | Number of certificates | 10 | ✓ | ✓ | ✓ |
| keystore.owner | String | Keystore owner | "root" | ✓ | ✓ | ✗ |
| keystore.permissions | String | File permissions | "600" | ✓ | ✓ | ✗ |
| keystore.error_message | String | Error message | "" | ✓ | ✓ | ✗ |
| keystore.encryption.algorithm | String | Encryption algorithm | "PBEWithHmacSHA256" | ✓ | ✓ | ✗ |
| keystore.encryption.kdf | String | Key derivation function | "PBKDF2" | ✓ | ✓ | ✗ |
| keystore.encryption.iterations | Integer | KDF iterations | 10000 | ✓ | ✓ | ✗ |
| keystore.encryption.mac | String | MAC algorithm | "HmacSHA256" | ✓ | ✓ | ✗ |
| keystore.encryption.vulnerable | Boolean | Is encryption vulnerable | false | ✓ | ✓ | ✗ |
| keystore.encryption.reason | String | Vulnerability reason | "" | ✓ | ✓ | ✗ |
| keystore.encryption.iv_length | Integer | IV length in bytes | 16 | ✓ | ✗ | ✗ |
| keystore.encryption.salt_length | Integer | Salt length in bytes | 16 | ✓ | ✗ | ✗ |
| file.size | Long | File size in bytes | 4096 | ✓ | ✓ | ✗ |
| file.mtime | Date | Last modified | "2024-12-15T10:30:00Z" | ✓ | ✓ | ✗ |
| Field | Type | Description | Example | Full | Standard | Minimal | |
|---|---|---|---|---|---|---|---|
| certificate.alias | String | Certificate alias | "server-cert" | ✓ | ✓ | ✗ | |
| certificate.is_ca | Boolean | Is CA certificate | false | ✓ | ✓ | ✗ | |
| certificate.is_self_signed | Boolean | Is self-signed | false | ✓ | ✓ | ✗ | |
| certificate.has_private_key | Boolean | Has private key | true | ✓ | ✓ | ✗ | |
| tls.certificate.subject | String | Certificate subject | "CN=example.com" | ✓ | ✓ | ✗ | |
| tls.certificate.issuer | String | Certificate issuer | "CN=Root CA" | ✓ | ✓ | ✗ | |
| tls.certificate.not_before | Date | Valid from | "2024-01-01T00:00:00Z" | ✓ | ✓ | ✗ | |
| tls.certificate.not_after | Date | Valid until | "2025-01-01T00:00:00Z" | ✓ | ✓ | ✗ | |
| tls.certificate.serial_number | String | Serial number | "01:23:45" | ✓ | ✓ | ✗ | |
| tls.certificate.extended_key_usage | String[] | Extended key usage | ["serverAuth"] | ✓ | ✓ | ✗ | |
| tls.server.subject | String | Subject (compat) | "CN=example.com" | ✓ | ✓ | ✗ | |
| tls.server.issuer | String | Issuer (compat) | "CN=Root CA" | ✓ | ✓ | ✗ | |
| tls.server.not_before | Date | Valid from (compat) | "2024-01-01T00:00:00Z" | ✓ | ✓ | ✗ | |
| tls.server.not_after | Date | Valid until (compat) | "2025-01-01T00:00:00Z" | ✓ | ✓ | ✗ | |
| tls.server.serial_number | String | Serial (compat) | "01:23:45" | ✓ | ✓ | ✗ | |
| tls.server.hash.sha1 | String | SHA-1 thumbprint | "abc123..." | ✓ | ✓ | ✗ | |
| vulnerability.is_vulnerable | Boolean | Is vulnerable | true | ✓ | ✓ | ✓ | |
| vulnerability.risk_level | String | Risk level | "high" | ✓ | ✓ | ✓ | |
| vulnerability.risk_reason | String | Risk reason | "RSA-2048" | ✓ | ✓ | ✗ | |
| vulnerability.cve_list | String[] | CVE list | [] | ✓ | ✓ | ✗ | |
| active | Boolean | Is active | true | ✓ | ✓ | ✗ | |
| last_seen | Date | Last seen | "2025-01-16T10:15:39Z" | ✓ | ✓ | ✗ | |
| tychon.crypto.protocol | String | No | Always X.509 for keystore certificate events | "X.509" | ✓ | ✓ | ✓ |
| tychon.crypto.cipher | String | No | Key algorithm (e.g. RSA-2048, EC) | "RSA-2048" | ✓ | ✓ | ✗ |
| tychon.crypto.pqc_vulnerable | Boolean | No | True when the certificate's key algorithm is vulnerable to a quantum computer | true | ✓ | ✓ | ✓ |
| tychon.crypto.pqc_readiness | String | No | vulnerable or transitional based on pqc_vulnerable flag | "vulnerable" | ✓ | ✓ | ✓ |
| tychon.crypto.quantum_risk | String | No | high or low based on pqc_vulnerable flag | "high" | ✓ | ✓ | ✓ |
For events with event.dataset="keystore" (summary events)
| Field | Type | Description | Example | Full | Standard | Minimal |
|---|---|---|---|---|---|---|
| keystore.stats.vulnerable_certificates | Integer | Count of vulnerable certs | 2 | ✓ | ✓ | ✗ |
| keystore.stats.pqc_vulnerable_certificates | Integer | Count of PQC vulnerable | 5 | ✓ | ✓ | ✗ |
| keystore.stats.expired_certificates | Integer | Count of expired | 1 | ✓ | ✓ | ✗ |
| keystore.stats.certificate_types.ca | Integer | Count of CA certs | 3 | ✓ | ✓ | ✗ |
| keystore.stats.certificate_types.end_entity | Integer | Count of end-entity | 7 | ✓ | ✓ | ✗ |
| keystore.stats.key_algorithms.RSA | Integer | Count of RSA keys | 8 | ✓ | ✓ | ✗ |
| keystore.stats.key_algorithms.ECDSA | Integer | Count of ECDSA keys | 2 | ✓ | ✓ | ✗ |
For events with event.dataset="memory_scan" or event.dataset="java_crypto"
| Field | Type | Description | Example | Full | Standard | Minimal | |
|---|---|---|---|---|---|---|---|
| id | String | Universal document ID | "mem_abc123_libssl" | ✓ | ✓ | ✗ | |
| event.kind | String | ECS event kind | "event" | ✓ | ✓ | ✓ | |
| vulnerability.is_vulnerable | Boolean | Is library vulnerable | true | ✓ | ✓ | ✓ | |
| vulnerability.risk_level | String | Risk level | "high" | ✓ | ✓ | ✓ | |
| vulnerability.risk_reason | String | Risk reason | "Known CVE" | ✓ | ✓ | ✗ | |
| vulnerability.cve_list | String[] | List of CVEs | ["CVE-2023-1234"] | ✓ | ✓ | ✗ | |
| vulnerability.fixed_in_version | String | Fixed in version | "1.1.1t" | ✓ | ✓ | ✗ | |
| vulnerability.assessed_at | Date | Assessment timestamp | "2025-01-16T10:15:39Z" | ✓ | ✓ | ✗ | |
| tychon.library.uses_openssl | Boolean | Process links against OpenSSL | true | ✓ | ✓ | ✗ | |
| tychon.library.openssl_version | String | OpenSSL version in use by this process | "OpenSSL 3.0.8" | ✓ | ✓ | ✗ | |
| tychon.library.openssl_pqc_status | String | PQC readiness of the OpenSSL version | "not_supported" | ✓ | ✓ | ✗ | |
| tychon.library.uses_libressl | Boolean | Process links against LibreSSL | false | ✓ | ✓ | ✗ | |
| tychon.library.libressl_version | String | LibreSSL version in use (if applicable) | "LibreSSL 3.7.2" | ✓ | ✓ | ✗ | |
| tychon.library.libressl_pqc_status | String | PQC readiness of the LibreSSL version | "not_supported" | ✓ | ✓ | ✗ | |
| tychon.library.uses_apple_security | Boolean | Process uses Apple Security framework (macOS only) | true | ✓ | ✓ | ✗ | |
| tychon.library.apple_security_pqc_status | String | PQC readiness of the Apple Security framework version | "partial" | ✓ | ✓ | ✗ | |
| java.vendor | String | Java vendor (Java only) | "Oracle Corporation" | ✓ | ✓ | ✗ | |
| java.version | String | Java version (Java only) | "11.0.16" | ✓ | ✓ | ✗ | |
| tychon.crypto.protocol | String | No | Always library for crypto library events | "library" | ✓ | ✓ | ✓ |
| tychon.crypto.cipher | String | No | Library name (e.g. OpenSSL, LibreSSL) | "OpenSSL" | ✓ | ✓ | ✗ |
| tychon.crypto.pqc_vulnerable | Boolean | No | True when the library is not quantum-ready | true | ✓ | ✓ | ✓ |
| tychon.crypto.pqc_readiness | String | No | Canonical readiness: ready, transitional, vulnerable, or critical | "vulnerable" | ✓ | ✓ | ✓ |
| tychon.crypto.quantum_risk | String | No | Canonical risk: none, low, medium, high, or critical | "high" | ✓ | ✓ | ✓ |
Note: Additional library.* fields are dynamically flattened from the CryptoLibrary structure.
For events with event.dataset="vpn"
| Field | Type | Description | Example | Full | Standard | Minimal | |
|---|---|---|---|---|---|---|---|
| id | String | Universal document ID | "vpn_abc123_openvpn" | ✓ | ✓ | ✗ | |
| event.kind | String | ECS event kind | "event" | ✓ | ✓ | ✓ | |
| file.path | String | VPN install path | "C:\Program Files\VPN" | ✓ | ✓ | ✗ | |
| service.name | String | VPN service name | "OpenVPN" | ✓ | ✓ | ✗ | |
| service.state | String | VPN service state | "running" | ✓ | ✓ | ✗ | |
| vpn_client.name | String | VPN client product name | "OpenVPN" | ✓ | ✓ | ✓ | |
| vpn_client.version | String | Installed client version | "2.6.1" | ✓ | ✓ | ✗ | |
| vpn_client.status | String | Current client status | "connected" | ✓ | ✓ | ✓ | |
| vpn_client.vendor | String | Vendor / publisher name | "OpenVPN Inc." | ✓ | ✓ | ✗ | |
| vpn_client.install_path | String | Installation directory | "C:\Program Files\OpenVPN" | ✓ | ✓ | ✗ | |
| vpn_connection.server_address | String | VPN server address | "vpn.example.com" | ✓ | ✓ | ✓ | |
| vpn_connection.server_port | Integer | VPN server port | 1194 | ✓ | ✓ | ✗ | |
| vpn_connection.protocol | String | VPN tunnel protocol | "UDP" | ✓ | ✓ | ✗ | |
| vpn_connection.encryption_algorithm | String | Negotiated encryption algorithm | "AES-256-GCM" | ✓ | ✓ | ✓ | |
| vpn_connection.key_exchange_algorithm | String | Key exchange algorithm | "ECDH" | ✓ | ✓ | ✓ | |
| vpn_connection.dh_group | String | Diffie-Hellman group used | "Group-20" | ✓ | ✓ | ✗ | |
| security.score | Integer | Overall security score (0-100) | 72 | ✓ | ✓ | ✓ | |
| security.pqc_support | Boolean | Supports post-quantum crypto | false | ✓ | ✓ | ✓ | |
| security.weak_crypto | Boolean | Uses weak/deprecated crypto | false | ✓ | ✓ | ✗ | |
| vpn_config.authentication_method | String | Auth method (password, certificate, MFA) | "certificate" | ✓ | ✓ | ✗ | |
| vpn_config.dns_leak_protection | Boolean | DNS leak protection enabled | true | ✓ | ✓ | ✗ | |
| vpn_config.kill_switch | Boolean | Kill switch enabled | true | ✓ | ✓ | ✗ | |
| vpn_config.split_tunneling | Boolean | Split tunneling enabled | false | ✓ | ✓ | ✗ | |
| pqc.is_pqc_ready | Boolean | Whether client is PQC-ready | false | ✓ | ✓ | ✓ | |
| pqc.supported_algorithms | String[] | List of PQC algorithms supported | [] | ✓ | ✓ | ✗ | |
| pqc.quantum_resistance | String | Quantum resistance level: none, partial, full | "none" | ✓ | ✓ | ✓ | |
| pqc.pqc_migration_status | String | Migration status: not_started, in_progress, complete | "not_started" | ✓ | ✓ | ✗ | |
| tychon.crypto.protocol | String | No | VPN protocol (e.g. WireGuard, OpenVPN) from the connection's Protocol field | "OpenVPN" | ✓ | ✓ | ✓ |
| tychon.crypto.key_exchange | String | No | Key exchange algorithm from connection | "ECDH" | ✓ | ✓ | ✗ |
| tychon.crypto.cipher | String | No | Encryption algorithm from connection (e.g. AES-256-GCM) | "AES-256-GCM" | ✓ | ✓ | ✗ |
| tychon.crypto.mac | String | No | Authentication algorithm from connection (e.g. HMAC-SHA2-256) | "HMAC-SHA2-256" | ✓ | ✓ | ✗ |
| tychon.crypto.auth | String | No | Authentication method (e.g. PSK, Certificate) | "Certificate" | ✓ | ✓ | ✗ |
| tychon.crypto.pqc_vulnerable | Boolean | No | True when key exchange or cipher is vulnerable to a quantum computer | true | ✓ | ✓ | ✓ |
| tychon.crypto.pqc_readiness | String | No | Canonical readiness: ready, transitional, vulnerable, or critical | "vulnerable" | ✓ | ✓ | ✓ |
| tychon.crypto.quantum_risk | String | No | Canonical risk: none, low, medium, high, or critical | "high" | ✓ | ✓ | ✓ |
For events with event.dataset="ipsec"
| Field | Type | Description | Example | Full | Standard | Minimal | |
|---|---|---|---|---|---|---|---|
| source.ip | IP | Local endpoint IP | "10.0.0.1" | ✓ | ✓ | ✗ | |
| destination.ip | IP | Remote endpoint IP | "10.0.1.1" | ✓ | ✓ | ✗ | |
| source.network | String | Local subnet | "10.0.0.0/24" | ✓ | ✓ | ✗ | |
| destination.network | String | Remote subnet | "10.0.1.0/24" | ✓ | ✓ | ✗ | |
| tychon.crypto.protocol | String | No | Always IPSec for IPSec tunnel events | "IPSec" | ✓ | ✓ | ✓ |
| tychon.crypto.key_exchange | String | No | Key exchange group (e.g. modp14) | "modp14" | ✓ | ✓ | ✗ |
| tychon.crypto.cipher | String | No | Encryption algorithm (e.g. AES-256-GCM) | "AES-256-GCM" | ✓ | ✓ | ✗ |
| tychon.crypto.mac | String | No | Integrity algorithm (e.g. HMAC-SHA2-256) | "HMAC-SHA2-256" | ✓ | ✓ | ✗ |
| tychon.crypto.auth | String | No | Authentication method (e.g. PSK, Certificate) | "PSK" | ✓ | ✓ | ✗ |
| tychon.crypto.pqc_vulnerable | Boolean | No | True when key exchange or cipher is vulnerable to a quantum computer | true | ✓ | ✓ | ✓ |
| tychon.crypto.pqc_readiness | String | No | Canonical readiness: ready, transitional, vulnerable, or critical | "vulnerable" | ✓ | ✓ | ✓ |
| tychon.crypto.quantum_risk | String | No | Canonical risk: none, low, medium, high, or critical | "high" | ✓ | ✓ | ✓ |
Note: Additional ipsec_tunnel.* fields are dynamically flattened from the IPSecTunnelInfo structure.
Local mode only. The quantum assessment produces three separate flat datasets — all routed to tychon.index="system-readiness" — so that NDJSON consumers (Elasticsearch, Splunk, NoSQL stores) can query each dimension without handling nested arrays.
quantum_assessment — one row per host: OS info, overall scores, hardware, network, crypto libraries, cost analysis totals, and OS-level cost breakdownquantum_assessment.app_group — one row per application family: remediation cost by app family (labor hours, cost, tier)quantum_assessment.critical_issue — one row per critical finding: severity, component, issue text, impact, resolution, blocking flagquantum_assessment — Top-Level FieldsStable ID: SHA-256(quantum_readiness | hostname | observerID) truncated to 16 hex chars.
| Field | Type | Description | Example |
|---|---|---|---|
| quantum_readiness.overall_score | Integer | Overall score (0–100) | 64 |
| quantum_readiness.readiness_status | String | Readiness status label | "Update Required" |
| quantum_readiness.ready_timeline | String | Estimated timeline to readiness | "2-6 months" |
| quantum_readiness.cost_analysis.total_labor_hours | Float | Total estimated remediation labor hours | 48.0 |
| quantum_readiness.cost_analysis.total_cost_usd | Float | Total estimated remediation cost (USD) | 9600.0 |
| quantum_readiness.cost_analysis.os_category | String | OS upgrade category (flattened from single-entry OS list) | "Windows Server" |
| quantum_readiness.cost_analysis.os_upgrade_target | String | Target OS version for PQC readiness | "Windows Server 2025" |
| quantum_readiness.cost_analysis.os_total_cost_usd | Float | OS upgrade total cost estimate (USD) | 2400.0 |
Additional sub-namespaces: quantum_readiness.hardware.* (22 fields), quantum_readiness.operating_system.* (16 fields), quantum_readiness.crypto_libraries.* (8+ fields), quantum_readiness.network.* (12 fields), quantum_readiness.upgrade_pathway.* (6 fields), quantum_readiness.compliance.* (4 fields).
quantum_assessment.app_group — Per-App-Family CostOne row per application family. Stable ID: SHA-256(quantum_assessment_app_group | hostname | appFamily | observerID) truncated to 16 hex chars.
| Field | Type | Description | Example |
|---|---|---|---|
| quantum_readiness.cost_analysis.app_family | String | Application family name | "Web Servers" |
| quantum_readiness.cost_analysis.tier | String | Remediation tier (e.g. standard, complex) | "standard" |
| quantum_readiness.cost_analysis.instance_count | Integer | Number of instances in this family | 3 |
| quantum_readiness.cost_analysis.labor_hours | Float | Estimated labor hours for this family | 16.0 |
| quantum_readiness.cost_analysis.labor_cost_usd | Float | Estimated labor cost (USD) for this family | 3200.0 |
| quantum_readiness.cost_analysis.total_cost_usd | Float | Total estimated cost (USD) for this family | 3200.0 |
quantum_assessment.critical_issue — Per-Issue FindingsOne row per critical finding. Stable ID: SHA-256(quantum_assessment_critical_issue | hostname | component | severity | issue | observerID) truncated to 16 hex chars.
| Field | Type | Description | Example |
|---|---|---|---|
| quantum_readiness.issue.severity | String | Issue severity level | "critical" |
| quantum_readiness.issue.component | String | Affected component name | "TLS Configuration" |
| quantum_readiness.issue.issue | String | Issue description | "TLSv1.0 still enabled" |
| quantum_readiness.issue.impact | String | Business / security impact | "Vulnerable to POODLE and BEAST attacks" |
| quantum_readiness.issue.resolution | String | Recommended resolution action | "Disable TLSv1.0 in server configuration" |
| quantum_readiness.issue.blocking | Boolean | True when this issue blocks PQC readiness | true |
For events with event.dataset="tychon.application" (local mode with -cipherscanquick only). One row per (application × port) — each listening port on a process gets its own document. Applications with no detected ports emit a single app-level row with no port fields. The stable id is SHA-256(tychon_application | hostname | name | path | port) truncated to 16 hex chars, so an IIS cipher upgrade updates the existing document rather than creating a new one.
| Field | Type | Description | Example | Full | Standard | Minimal |
|---|---|---|---|---|---|---|
| event.dataset | String | Always "tychon.application" | "tychon.application" | ✓ | ✓ | ✓ |
| event.category | String | Always "process" | "process" | ✓ | ✓ | ✓ |
| event.type | String | Always "info" | "info" | ✓ | ✓ | ✓ |
| process.name | String | Process name | "nginx" | ✓ | ✓ | ✓ |
| process.pid | Integer | Process ID | 1234 | ✓ | ✓ | ✓ |
| process.executable | String | Full path to the executable | "/usr/sbin/nginx" | ✓ | ✓ | ✗ |
| process.command_line | String | Launch command line | "nginx -g daemon off;" | ✓ | ✓ | ✗ |
| process.working_directory | String | Working directory of the process | "/etc/nginx" | ✓ | ✓ | ✗ |
| process.source | String | How the application was discovered: "process", "port", "connected", etc. | "process" | ✓ | ✓ | ✗ |
| crypto_library_count | Integer | Count of crypto libraries found for this application | 3 | ✓ | ✓ | ✗ |
| keystore_count | Integer | Count of keystores found for this application | 1 | ✓ | ✓ | ✗ |
| in_memory_cert_count | Integer | Count of in-memory certificates found for this application | 2 | ✓ | ✓ | ✗ |
| tychon.application.port | Integer | Listening port for this row. Absent if the application has no detected ports. | 443 | ✓ | ✓ | ✗ |
| tychon.application.protocol_detected | String | Protocol detected on this port (e.g. "https", "tls") | "https" | ✓ | ✓ | ✗ |
| tychon.application.preferred_protocol | String | Best TLS protocol version negotiated on this port | "TLSv1.3" | ✓ | ✓ | ✗ |
| tychon.application.preferred_cipher | String | Preferred cipher suite on this port | "TLS_AES_256_GCM_SHA384" | ✓ | ✓ | ✗ |
| tychon.application.preferred_key_exchange | String | Preferred key exchange group on this port | "X25519MLKEM768" | ✓ | ✓ | ✗ |
| tychon.application.quantum_ready | Boolean | True when this port's cipher configuration is quantum-ready | true | ✓ | ✓ | ✓ |
| tychon.application.supported_protocols | String | Comma-joined list of all TLS versions supported on this port | "TLSv1.3, TLSv1.2" | ✓ | ✓ | ✗ |
| tychon.application.supported_cipher_suites | String | Comma-joined list of all cipher suites on this port | "TLS_AES_256_GCM_SHA384, TLS_AES_128_GCM_SHA256" | ✓ | ✓ | ✗ |
| tychon.application.connected_to | String | Comma-joined list of outbound TLS destinations (ip:port pairs). Only present when -scanconnected is active. | "10.0.1.5:443, 10.0.1.6:8443" | ✓ | ✓ | ✗ |
| tychon.library.uses_openssl | Boolean | Application links against OpenSSL | true | ✓ | ✓ | ✗ |
| tychon.library.openssl_version | String | OpenSSL version used by this application | "OpenSSL 3.0.8" | ✓ | ✓ | ✗ |
| tychon.library.openssl_pqc_status | String | PQC readiness of the OpenSSL version | "not_supported" | ✓ | ✓ | ✗ |
| tychon.library.uses_libressl | Boolean | Application links against LibreSSL | false | ✓ | ✓ | ✗ |
| tychon.library.libressl_version | String | LibreSSL version used by this application | "LibreSSL 3.7.2" | ✓ | ✓ | ✗ |
| tychon.library.libressl_pqc_status | String | PQC readiness of the LibreSSL version | "not_supported" | ✓ | ✓ | ✗ |
| tychon.library.uses_apple_security | Boolean | Application uses Apple Security framework (macOS only) | true | ✓ | ✓ | ✗ |
| tychon.library.apple_security_pqc_status | String | PQC readiness of the Apple Security framework version | "partial" | ✓ | ✓ | ✗ |
Note: All fields are flat scalars. Multi-value fields (supported protocols, cipher suites, key exchanges, connected destinations) are emitted as comma-joined strings for compatibility with all NDJSON consumers. The application-level quantum grade fields (tychon.application.quantum_grade.*) are on each port row.
For events with event.dataset="tychon.app_certificate". Each event represents a certificate discovered in connection with a specific running application (process).
| Field | Type | Description | Example | Full | Standard | Minimal |
|---|---|---|---|---|---|---|
| id | String | Universal document ID | "appcert_abc123" | ✓ | ✓ | ✗ |
| event.kind | String | ECS event kind | "event" | ✓ | ✓ | ✓ |
| process.name | String | Owning process name | "nginx" | ✓ | ✓ | ✓ |
| process.pid | Integer | Owning process ID | 1234 | ✓ | ✓ | ✓ |
| x509.subject.distinguished_name | String | Certificate subject DN | "CN=example.com,O=Acme" | ✓ | ✓ | ✗ |
| x509.issuer.distinguished_name | String | Certificate issuer DN | "CN=Root CA" | ✓ | ✓ | ✗ |
| x509.not_before | Date | Certificate valid from | "2024-01-01T00:00:00Z" | ✓ | ✓ | ✗ |
| x509.not_after | Date | Certificate valid until | "2025-01-01T00:00:00Z" | ✓ | ✓ | ✗ |
| x509.serial_number | String | Certificate serial number | "01:23:45:67" | ✓ | ✓ | ✗ |
| x509.public_key_algorithm | String | Public key algorithm | "RSA" | ✓ | ✓ | ✓ |
| x509.public_key_size | Integer | Public key size in bits | 2048 | ✓ | ✓ | ✓ |
| x509.signature_algorithm | String | Signature algorithm | "SHA256withRSA" | ✓ | ✓ | ✗ |
| tychon.application.name | String | Application name (mirrors process.name) | "nginx" | ✓ | ✓ | ✓ |
| tychon.application.executable | String | Full path to the executable | "/usr/sbin/nginx" | ✓ | ✓ | ✗ |
| vulnerability.is_vulnerable | Boolean | Certificate is quantum-vulnerable | true | ✓ | ✓ | ✓ |
| vulnerability.risk_level | String | Risk level: low, medium, high, critical | "high" | ✓ | ✓ | ✓ |
For events with event.dataset="tychon.pqc_inventory". Summary inventory events emitted at the end of a scan, grouping cryptographic assets by host.
| Field | Type | Description | Example | Full | Standard | Minimal |
|---|---|---|---|---|---|---|
| id | String | Universal document ID | "pqcinv_abc123" | ✓ | ✓ | ✗ |
| event.kind | String | ECS event kind | "event" | ✓ | ✓ | ✓ |
| host.hostname | String | Target hostname | "server01.acme.local" | ✓ | ✓ | ✓ |
| host.ip | String | Target IP address | "192.168.1.10" | ✓ | ✓ | ✓ |
| inventory.total_assets | Integer | Total cryptographic assets discovered | 42 | ✓ | ✓ | ✓ |
| inventory.vulnerable_assets | Integer | Count of quantum-vulnerable assets | 28 | ✓ | ✓ | ✓ |
| inventory.pqc_ready_assets | Integer | Count of PQC-ready assets | 5 | ✓ | ✓ | ✓ |
| inventory.certificates | Integer | Count of certificates discovered | 15 | ✓ | ✓ | ✗ |
| inventory.keystores | Integer | Count of keystores discovered | 3 | ✓ | ✓ | ✗ |
| inventory.crypto_libraries | Integer | Count of unique crypto libraries in use | 8 | ✓ | ✓ | ✗ |
| inventory.vpn_clients | Integer | Count of VPN clients detected | 1 | ✓ | ✓ | ✗ |