Tychon Output Format

Universal Fields (All Events)

Certificate Fields

Cipher Event Record

{"@timestamp":"2025-09-02T13:00:17.123Z","id":"abc123def456","tychon.type":"cipher","tychon.scan_mode":"remote","tychon.active":true,"tychon.pqc_vulnerable":false,"server.address":"example.com","server.port":443,"service.protocol.type":"TLS","service.protocol.name":"TLSV1.3","cipher.name":"TLS_AES_256_GCM_SHA384","cipher.key_length_bits":256,"cipher.negotiated_group":"X25519MLKEM768","cipher.is_preferred":true,"cipher.intel.security_level":"high","cipher.intel.pqc_ready":true,"certificate.subject.common_name":"example.com","certificate.issuer.common_name":"DigiCert TLS RSA SHA256 2020 CA1","certificate.not_after":"2025-03-01T23:59:59Z","certificate.fingerprint_sha256":"ab:cd:ef:12:34:56:78:90","certificate.is_file":"false","tags":["production","quarterly-scan"]}

Library Event Record

{"@timestamp":"2025-09-02T13:00:17.456Z","id":"def789abc123","tychon.type":"library","tychon.scan_mode":"local","tychon.active":true,"process.pid":1234,"process.name":"nginx","process.executable":"/usr/sbin/nginx","file.path":"/usr/lib/libssl.so.3","library.name":"libssl.so.3","library.crypto_type":"TLS Library","library.company_name":"OpenSSL Project","library.detected_apis":"SSL_connect,SSL_accept,TLS_method","tags":["server","crypto-audit"]}

Filesystem Certificate Record

{"@timestamp":"2025-09-02T13:00:17.789Z","id":"ghi456jkl789","tychon.type":"filesystem","tychon.scan_mode":"local","tychon.active":true,"file.path":"/etc/ssl/certs/ca-cert.pem","certificate.subject.common_name":"Internal Root CA","certificate.issuer.common_name":"Internal Root CA","certificate.not_after":"2033-01-01T00:00:00Z","certificate.signature_algorithm":"SHA256-RSA","certificate.is_self_signed":true,"certificate.is_file":"true","tags":["filesystem-scan"]}

Keystore Certificate Record NEW

{"@timestamp":"2025-09-17T20:35:45.267Z","event.action":"keystore_certificate_detected","event.category":"security","event.type":"info","event.dataset":"tychon.keystore_certificate","id":"52d4362845b11fdaadc28c459bb340211a33cc72","observer.hostname":"workstation-01","observer.name":"tychon-pqc-scanner","observer.type":"scanner","observer.version":"1.0.61","file.path":"macOS:Login","file.name":"macOS:Login","file.extension":"","file.mtime":"2025-09-17T16:23:20.093843-04:00","crypto.key_algorithm":"RSA","crypto.key_size":2048,"crypto.signature_algorithm":"SHA256-RSA","crypto.fingerprint_sha1":"7afc9d01a62f03a2de9637936d4afe68090d2de18d03f29c88cfb0b1ba63587f","tls.certificate.subject":"CN=Developer ID Certification Authority,OU=Apple Certification Authority,O=Apple Inc.,C=US","tls.certificate.issuer":"CN=Apple Root CA,OU=Apple Certification Authority,O=Apple Inc.,C=US","tls.certificate.serial_number":"1763908746353189132","tls.certificate.not_before":"2012-02-01T22:12:15Z","tls.certificate.not_after":"2027-02-01T22:12:15Z","tls.certificate.version":3,"tls.certificate.alias":"Developer ID Certification Authority","tls.certificate.is_ca":true,"tls.certificate.is_self_signed":false,"tls.certificate.has_private_key":false,"keystore.type":"macOS-Keychain","keystore.accessible":true,"keystore.requires_auth":false,"keystore.cert_count":18,"vulnerability.is_vulnerable":false,"vulnerability.risk_level":"medium","vulnerability.risk_reason":"RSA key size below recommended 3072 bits for PQC","pqc.vulnerable":true,"pqc.reason":"RSA key size 2048 bits is below recommended 3072 bits for PQC","tychon.scan_mode":"local","tychon.asset_type":"keystore_certificate","tychon.keystore_type":"macOS-Keychain","tychon.certificate_usage":"stored"}

Keystore Summary Record NEW

{"@timestamp":"2025-09-17T20:35:45.123Z","event.action":"keystore_discovered","event.category":"security","event.type":"info","event.dataset":"tychon.keystore","id":"8a1b2c3d4e5f6789abcd","observer.hostname":"workstation-01","observer.name":"tychon-pqc-scanner","observer.type":"scanner","observer.version":"1.0.61","file.path":"macOS:System","file.name":"macOS:System","file.extension":"","file.mtime":"2025-09-17T16:23:20.093Z","keystore.type":"macOS-Keychain","keystore.accessible":true,"keystore.requires_auth":false,"keystore.cert_count":45,"keystore.vulnerable_certificates":8,"keystore.pqc_vulnerable_certificates":12,"keystore.expired_certificates":2,"keystore.expiring_soon_certificates":3,"keystore.certificate_types":"ca:15,end_entity:30","keystore.key_algorithms":"RSA:35,ECDSA:8,DSA:2","tychon.scan_mode":"local","tychon.asset_type":"keystore","tychon.keystore_type":"macOS-Keychain"}

Core Fields (All Events)

Network Service Fields (cipher/connected types)

Process & File Fields (library/filesystem types)

TLS & Cipher Fields (cipher type)

X.509 Certificate Fields (cipher/filesystem types)

Library Fields (library/java_crypto_library types)

Archive Fields (archivefile type)

VPN Client Fields (vpn_client type)

IPSec Tunnel Fields (ipsec_tunnel type)

Cipher Intelligence Fields

Elasticsearch Integration

# Direct streaming to Elasticsearch
.\certscanner-windows-amd64.exe -host production-hosts.txt -cipherscan `
  -outputformat tychon `
  -posttoelastic -elasticnode "https://siem.company.com:9200" `
  -elasticapikey "$env:ELASTIC_API_KEY" `
  -elasticindex "crypto-intelligence"

# Continuous monitoring with asset tracking
.\certscanner-windows-amd64.exe -mode local -scanfilesystem -scanmemory `
  -outputformat tychon -tags "continuous-monitoring" `
  -posttoelastic -elasticnode "$env:ELASTIC_URL"

# Direct streaming to Elasticsearch
./certscanner-linux-x64 -host production-hosts.txt -cipherscan \
  -outputformat tychon \
  -posttoelastic -elasticnode "https://siem.company.com:9200" \
  -elasticapikey "$ELASTIC_API_KEY" \
  -elasticindex "crypto-intelligence"

# Continuous monitoring with asset tracking
./certscanner-linux-x64 -mode local -scanfilesystem -scanmemory \
  -outputformat tychon -tags "continuous-monitoring" \
  -posttoelastic -elasticnode "$ELASTIC_URL"

# Direct streaming to Elasticsearch
./certscanner-darwin-amd64 -host production-hosts.txt -cipherscan \
  -outputformat tychon \
  -posttoelastic -elasticnode "https://siem.company.com:9200" \
  -elasticapikey "$ELASTIC_API_KEY" \
  -elasticindex "crypto-intelligence"

# Continuous monitoring with asset tracking
./certscanner-darwin-amd64 -mode local -scanfilesystem \
  -outputformat tychon -tags "continuous-monitoring" \
  -posttoelastic -elasticnode "$ELASTIC_URL"

Query Examples

# Find PQC-vulnerable assets
GET crypto-intelligence/_search
{
  "query": {
    "term": { "tychon.pqc_vulnerable": true }
  }
}

# Find inactive crypto libraries
GET crypto-intelligence/_search
{
  "query": {
    "bool": {
      "must": [
        { "term": { "tychon.type": "library" }},
        { "term": { "tychon.active": false }}
      ]
    }
  }
}

# Find expiring certificates
GET crypto-intelligence/_search
{
  "query": {
    "range": {
      "certificate.not_after": {
        "lte": "now+30d"
      }
    }
  }
}