Splunk Enterprise Integration

Splunk inputs.conf

# Monitor TYCHON Quantum Readiness NDJSON logs
[monitor:///var/log/certscanner/*.ndjson]
disabled = false
sourcetype = certscanner:crypto_assets
index = security
host_segment = 4

# Monitor JSON reports  
[monitor:///opt/certscanner/reports/*.json]
disabled = false
sourcetype = certscanner:scan_report
index = security
host_segment = 4

# Monitor Tychon format logs
[monitor:///var/log/certscanner/*.tychon.ndjson]
disabled = false
sourcetype = certscanner:tychon
index = security
host_segment = 4

Advanced HEC Configuration Options

# Full HEC configuration example
./certscanner-linux-x64 -host example.com -cipherscan \
  -posttosplunk \
  -splunkurl "https://splunk.company.com:8088" \
  -splunktoken "YOUR_HEC_TOKEN_HERE" \
  -splunkindex "tychon-crypto" \
  -splunksource "tychon-scanner" \
  -splunksourcetype "tychon-acdi:crypto_assets" \
  -splunkbatch 50 \
  -splunktimeout 30

# Basic authentication instead of token
./certscanner-linux-x64 -host example.com -cipherscan \
  -posttosplunk \
  -splunkurl "https://splunk.company.com:8088" \
  -splunkusername "splunk_user" \
  -splunkpassword "secure_password" \
  -splunkindex "tychon-crypto"

# Environment variables for all HEC settings
export SPLUNK_URL="https://splunk.company.com:8088"
export SPLUNK_TOKEN="YOUR_HEC_TOKEN_HERE"
export SPLUNK_INDEX="tychon-crypto"
export SPLUNK_SOURCE="tychon-scanner"
export SPLUNK_SOURCETYPE="tychon-acdi:crypto_assets"
export SPLUNK_BATCH="100"
export SPLUNK_TIMEOUT="60"

./certscanner-linux-x64 -host example.com -cipherscan -posttosplunk

Legacy HEC Integration (curl-based)

# Stream directly to Splunk HEC
.\certscanner-windows-amd64.exe -host example.com -cipherscan -outputformat flatndjson | `
  Invoke-RestMethod -Uri "https://splunk.company.com:8088/services/collector/raw" `
                   -Method POST `
                   -Headers @{"Authorization" = "Splunk $env:HEC_TOKEN"} `
                   -ContentType "application/json" `
                   -Body $input

# Scheduled task approach (use Task Scheduler instead of cron)
# See Task Scheduler configuration section below

# Stream directly to Splunk HEC
./certscanner-linux-x64 -host example.com -cipherscan -outputformat flatndjson | \
  curl -k "https://splunk.company.com:8088/services/collector/raw" \
       -H "Authorization: Splunk $HEC_TOKEN" \
       -H "Content-Type: application/json" \
       --data-binary @-

# Scheduled scan with HEC posting
*/30 * * * * /opt/certscanner/certscanner-linux-x64 -mode local -scanconnected -scanmemory \
  -outputformat flatndjson | \
  curl -k "https://splunk.company.com:8088/services/collector/raw" \
       -H "Authorization: Splunk $HEC_TOKEN" \
       -H "Content-Type: application/json" \
       --data-binary @-

# Stream directly to Splunk HEC  
./certscanner-darwin-amd64 -host example.com -cipherscan -outputformat flatndjson | \
  curl -k "https://splunk.company.com:8088/services/collector/raw" \
       -H "Authorization: Splunk $HEC_TOKEN" \
       -H "Content-Type: application/json" \
       --data-binary @-

# Scheduled scan with HEC posting (no memory scanning on macOS)
*/30 * * * * /opt/certscanner/certscanner-darwin-amd64 -mode local -scanconnected \
  -outputformat flatndjson | \
  curl -k "https://splunk.company.com:8088/services/collector/raw" \
       -H "Authorization: Splunk $HEC_TOKEN" \
       -H "Content-Type: application/json" \
       --data-binary @-

Distributed Deployment Script

#!/bin/bash
# Deploy TYCHON Quantum Readiness with Universal Forwarder

# Create log directory
mkdir -p /opt/certscanner/logs

# Schedule TYCHON Quantum Readiness execution
cat << 'EOF' > /etc/cron.d/certscanner
# TYCHON Quantum Readiness crypto asset monitoring
0 */6 * * * root /opt/certscanner/certscanner -mode local -scanfilesystem -scanconnected -outputformat flatndjson -output /opt/certscanner/logs/crypto-assets-$(date +\%Y\%m\%d-\%H\%M).ndjson
0 2 * * * root /opt/certscanner/certscanner -arpscan -cipherscan -outputformat flatndjson -output /opt/certscanner/logs/network-scan-$(date +\%Y\%m\%d).ndjson
EOF

# Configure Universal Forwarder
cat << 'EOF' > $SPLUNK_HOME/etc/system/local/inputs.conf
[monitor:///opt/certscanner/logs/*.ndjson]
disabled = false
sourcetype = certscanner:crypto_assets
index = security
host = certscanner_agent

[monitor:///var/log/certscanner/*.json]
disabled = false  
sourcetype = certscanner:scan_report
index = security
host = certscanner_agent
EOF

# TYCHON Quantum Readiness source types configuration

[tychon-acdi:crypto_assets]
KV_MODE = json
AUTO_KV_JSON = true
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)
TRUNCATE = 100000
TIME_PREFIX = "timestamp"\s*:\s*"
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3N%z
MAX_TIMESTAMP_LOOKAHEAD = 30
category = Application
description = TYCHON Quantum Readiness crypto assets in NDJSON format

# Field aliases for common searches (updated for comprehensive data structure)
FIELDALIAS-certscanner_host = observer.hostname AS host
FIELDALIAS-certscanner_dest = server_address AS dest_ip, server_port AS dest_port
FIELDALIAS-certscanner_cert_cn = x509_subject_common_name AS cert_subject_cn
FIELDALIAS-certscanner_cert_issuer = x509_issuer_common_name AS cert_issuer_cn
FIELDALIAS-certscanner_cipher = cipher_suite AS cipher_name
FIELDALIAS-certscanner_tls = tls_server_cipher AS tls_cipher, tls_server_protocol_version AS tls_version

# Calculated fields
EVAL-cert_expires_days = if(isnotnull(certificate_days_until_expiry), certificate_days_until_expiry, null())
EVAL-cert_status_severity = case(certificate_status="expired", "critical", certificate_status="expiring_soon", "high", certificate_status="expiring_warning", "medium", certificate_status="valid", "low", "unknown")
EVAL-pqc_risk_level = if(pqc_vulnerable==true, "high", "low")

[tychon-acdi:scan_report]  
KV_MODE = json
AUTO_KV_JSON = true
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)
TIME_PREFIX = "scan_metadata"\s*:\s*{\s*"timestamp"\s*:\s*"
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3N%z
category = Application
description = TYCHON Quantum Readiness complete scan reports

[tychon-acdi:tychon]
KV_MODE = json  
AUTO_KV_JSON = true
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)
TIME_PREFIX = "tychon"\s*:\s*{\s*"timestamp"\s*:\s*"
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3N%z
category = Application
description = TYCHON Quantum Readiness Tychon format with threat intelligence

Event ID Schema by Asset Type

sourcetype=certscanner:* asset_type=cipher_suite
| stats latest(_time) as latest_time, latest(*) as * by event_id
| eval _time=latest_time

sourcetype=certscanner:* asset_type=crypto_library
| stats latest(_time) as latest_time, latest(*) as * by event_id, observer.id
| eval _time=latest_time

sourcetype=certscanner:* asset_type=host_summary
| stats latest(_time) as latest_time, latest(*) as * by server_address, server_port
| eval _time=latest_time

sourcetype=certscanner:*
| stats latest(_time) as latest_time, latest(*) as * by event_id, observer.id
| eval _time=latest_time
| stats dc(event_id) as unique_assets by asset_type

TYCHON Quantum Readiness Data Model (datamodels.conf)

[TYCHON_ACDI_Crypto_Assets]
acceleration = true
acceleration.earliest_time = -30d
acceleration.max_time = 0

# Root search for all TYCHON Quantum Readiness data
search = sourcetype=tychon-acdi:* | eval asset_id=coalesce(tychon_source_id, certificate.source_id, tychon.certificate.source_id)

# Certificate lifecycle dataset
[TYCHON_ACDI_Crypto_Assets.Certificate_Lifecycle]
search = sourcetype=tychon-acdi:* asset_type=certificate | eval cert_id=asset_id, days_to_expiry=certificate_days_until_expiry

# Cipher analysis dataset  
[TYCHON_ACDI_Crypto_Assets.Cipher_Analysis]
search = sourcetype=tychon-acdi:* (asset_type=cipher OR isnotnull(cipher_info.algorithm)) | eval cipher_name=coalesce(cipher_info.full_name, tls.cipher)

# Security assessments dataset
[TYCHON_ACDI_Crypto_Assets.Security_Assessment]
search = sourcetype=tychon-acdi:* | eval risk_score=security_score, risk_level=security_level

Dashboard XML (Simple XML)

<dashboard>
  <label>TYCHON Quantum Readiness - Executive Crypto Security Overview</label>
  <description>High-level cryptographic security posture metrics</description>
  
  <row>
    <panel>
      <single>
        <title>Total Crypto Assets</title>
        <search>
          <query>
            sourcetype=certscanner:* 
            | stats dc(certscanner_source_id) as asset_count
          </query>
          <earliest>-7d@d</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="colorBy">value</option>
        <option name="colorMode">none</option>
      </single>
    </panel>
    
    <panel>
      <single>
        <title>Average Security Score</title>
        <search>
          <query>
            sourcetype=certscanner:* 
            | stats avg(security_score) as avg_score
            | eval avg_score=round(avg_score, 1)
          </query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="rangeColors">["0xDC4E41","0xF1813F","0x53A051"]</option>
        <option name="rangeValues">[50,80]</option>
      </single>
    </panel>
    
    <panel>
      <single>
        <title>PQC Vulnerable Assets</title>
        <search>
          <query>
            sourcetype=certscanner:* pqc_vulnerable=true
            | stats latest(_time) as latest_time, latest(*) as * by event_id, observer.id
            | eval _time=latest_time
            | stats dc(event_id) as pqc_vulnerable_count
          </query>
          <earliest>-7d@d</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="colorBy">value</option>
        <option name="rangeColors">["0x53A051","0xF1813F","0xDC4E41"]</option>
        <option name="rangeValues">[10,50]</option>
      </single>
    </panel>
  </row>
  
  <row>
    <panel>
      <chart>
        <title>Security Level Distribution</title>
        <search>
          <query>
            sourcetype=certscanner:*
            | stats latest(_time) as latest_time, latest(*) as * by event_id, observer.id
            | eval _time=latest_time
            | stats dc(event_id) as count by security_level
            | eval security_level=upper(security_level)
          </query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.chart.showPercent">true</option>
        <option name="charting.legend.placement">bottom</option>
      </chart>
    </panel>
    
    <panel>
      <chart>
        <title>Certificate Status Breakdown</title>
        <search>
          <query>
            sourcetype=certscanner:* asset_type=certificate
            | stats latest(_time) as latest_time, latest(*) as * by event_id, observer.id
            | eval _time=latest_time
            | stats dc(event_id) as count by certificate_status
            | eval certificate_status=case(
                certificate_status="valid", "Valid",
                certificate_status="expiring_warning", "Expiring (90 days)",
                certificate_status="expiring_soon", "Expiring (30 days)", 
                certificate_status="expired", "EXPIRED",
                true(), "Unknown")
          </query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.chart">column</option>
        <option name="charting.axisTitleY.text">Certificate Count</option>
      </chart>
    </panel>
  </row>
</dashboard>

Key Operational Searches

sourcetype=certscanner:* | timechart span=1h count by certificate_status

sourcetype=certscanner:* | top limit=10 cipher_info.algorithm by dest_ip

sourcetype=certscanner:* | iplocation dest_ip | stats avg(security_score) as avg_score by Country | geostats latfield=lat longfield=lon avg_score

sourcetype=certscanner:*
| stats latest(_time) as latest_time, latest(*) as * by event_id, observer.id
| eval _time=latest_time
| stats dc(event_id) as assets, latest(_time) as last_scan by observer.hostname
| eval last_scan=strftime(last_scan, "%Y-%m-%d %H:%M")
| sort assets desc

Volume Reduction Through Strategic Retention