CBOM Dashboard Widgets & KPI Guide
A plain-language reference for every widget and KPI tile you can add to a CBOM dashboard: what it shows, how to configure it, and an example configuration. This guide is for dashboard builders and administrators.
Widget definitions live in the database, not in this document. If your dashboard's "Add Widget" picker looks different from what's described here, an admin may have customized or updated the widget catalogue since this guide was written.
How dashboards and widgets work
A dashboard is a grid of widgets, each an independent tile that queries the crypto inventory and renders it as a chart, table, single-value box, or document. You build a dashboard by adding widgets from the Add Widget picker and configuring each one through its own Configure Widget dialog — the fields described in this guide.
Most charts are clickable: clicking a bar, slice, or KPI tile opens a detail table scoped to whatever you clicked (e.g. clicking the "RSA" bar on a certificate chart opens the certificate table filtered to RSA). A few widgets are flagged in this guide as not yet clickable — they display correctly but a click does nothing.
A handful of widgets are containers that hold several of the widgets below at once (Chart and Table, Multi Charts) — see Composite widgets.
Adding a widget
Open Add Widget, pick a category (or search by name), and click a card to place it on your dashboard.
Configuring a widget
Open a placed widget's menu and choose Configure to set its filters. Every field you see in a real dialog corresponds to a row in this guide's per-widget option tables below.
Concepts you'll see on almost every widget
Tag Scope
Most widgets have a Tag Scope dropdown at the top of their configuration dialog. Tag Scopes are named, reusable filters (defined under CMTags → Tag Scopes) that limit a widget to a slice of your estate — for example, "Production only" or "PCI Systems". Leave it blank to include every material. A widget scoped this way also carries the scope into anything you drill into, so a filtered chart opens an equally filtered table.
Tag Scope does not appear on the five core Binary tables (Inventory, Vulnerable, Library Sprawl, Signer, Unsigned) or the Binary Confidence KPI box — those are not yet scopeable. It also doesn't apply to Total Supported Sensors (it counts what the platform can discover with, not estate material), CM-Detail, CM-History, or Text-DOC.
Pagination and sorting
Every table widget offers Items Per Page (10/20/40/60/80, default 20) and usually a Sort By dropdown listing the columns you can order by. Page number itself isn't a setting you pick in the config dialog — the table's paging controls handle that while you browse.
Criticality levels
Several "Analyze" widgets score materials into one of: Critical, High, Medium, Low, Safe, or No Analysis (the platform couldn't evaluate that material against the chosen criterion — e.g. a key missing the field the criterion needs). No Analysis is a real, meaningful bucket — it is not the same as Safe.
Exact vs. partial matching (behind the scenes)
When you click a chart bar to drill into a table, CBOM pins the exact value you clicked (so clicking "DSA" won't also pull in "ECDSA" rows). You don't configure this yourself — it's handled automatically by the drill-down.
Widget display types
| Type | What you see |
|---|---|
chart | A bar / pie / doughnut chart. Clicking a group usually drills into a table (or a second chart). |
table | A paginated, sortable table of rows. |
stacked-chart | A 100%-stacked bar chart — each bar is split into criticality or severity segments; clicking a segment drills into a table. |
line-chart | A time-series line chart (used by the -TSEQ risk-over-time widgets). |
group-chart | A grouped/nested bar chart (Policy Analysis's stacked breakdown). |
mix-table | A table combining several data points per row that don't come from one simple query (Hostwise Agility). |
fix-chart | A fixed-layout chart with no user-selectable chart style (Enterprise Agility). |
pqc-multi-chart | Several related small charts shown together (PQC Safe Multi-Chart). |
svgbox | A row of single-value KPI tiles — see KPI tile catalogue. |
doc | A document/detail view rendered as HTML (material detail, material history, free text). |
cht2tbl / multi-charts | Composite containers — see Composite widgets. |
Certificate widgets
Certificate Chart — Cert-CHT
Display type: chart
Shows a bar/pie/doughnut breakdown of your certificates.
| Option | Notes |
|---|---|
| Tag Scope | See Tag Scope. |
| Group By | Algo (family, e.g. RSA), AlgorithmRef (e.g. RSA/3072), or Issuer. |
| Subject CN | Free-text filter. |
| Issuer CN | Free-text filter. |
| Drill Into Chart First | Requires Group By = Algo. Each bar opens a second chart grouped by AlgorithmRef, which then opens the certificate table. |
Example: Group By = Algo, Drill Into Chart First = on → clicking "RSA" opens a chart of RSA key sizes, and clicking a size opens the certificate table for that size.
Certificate Expiry Chart — Cert-Exp-CHT
Display type: chart
Certificates expiring soon, bucketed by time.
| Option | Notes |
|---|---|
| Tag Scope | See Tag Scope. |
| Days | How many days out the chart should cover. |
| Starting Day | Where the window begins (days from today). |
| Group By | 30 Days buckets or Weeks. |
| Issuer CN | Free-text filter. |
Seeded presets: "Expires in 28 days in weeks" (Days = 28, Group By = Weeks) and "Expires in 120 days" (Days = 120, Group By = 30 Days).
Example: Days = 120, Starting Day = 120, Group By = 30 Days, Issuer CN left blank — the default 120-day expiry view across every issuer.
Certificate Table — Cert-TBL
Display type: table
The full certificate inventory, filterable and sortable. This is the drill-down target for Cert-CHT and Cert-Exp-CHT.
| Option | Notes |
|---|---|
| Tag Scope | See Tag Scope. |
| Sort By | Issuer CN, Subject CN, Issue Date, Expiry Date, or Discover Time. |
| Items Per Page | 10/20/40/60/80 (default 20). |
| Issuer CN / Subject CN | Free-text filters. |
| System | Free-text filter. |
| From Host | Free-text filter. |
| Algorithm | AES, DES, PQC, EC, RSA. |
| Key Usage | Digital Signature, Non Repudiation, Key Encipherment, Data Encipherment, Key Agreement, Key Cert Sign, CRL Sign, Encipher Only, Decipher Only. |
| Issue Date / Issue After / Issue Before | Calendar pickers. A date-only value covers the whole day; a value with a time is used to the second. |
| Expire Date / Expire After / Expire Before | Calendar pickers, same rule as above. |
| Days | Numeric bound paired with the After/Before fields. |
Example: Algorithm = RSA, Expire Before = (90 days from today) → certificates using RSA that expire within 90 days.
Certificate expiration table — Cert-Exp-TBL
Display type: table
A narrower expiring-certificates table (Issuer, Subject, Validity, Algo, Usage, Source Host) — the drill-down target for Cert-Exp-CHT.
| Option | Notes |
|---|---|
| Tag Scope | See Tag Scope. |
| Items Per Page | 10/20/40/60/80 (default 20). |
| Starting Day | Days-from-today window start (default 120). |
| Days | Window length (default 120). |
| Issuer CN | Free-text filter. |
Key widgets
Key table — Key-TBL
Display type: table
The full key inventory (secret, private and public keys).
| Option | Notes |
|---|---|
| Tag Scope | See Tag Scope. |
| Key Types | All, Sensitive Keys, Keys, Symmetric Key, Private Key, Public Key. |
| Sort By | Key Type, Algorithm Reference, Algorithm, Host, Secured By, Discover Time. |
| Items Per Page | 10/20/40/60/80 (default 20). |
| Algorithm | AES, DES, PQC, EC, RSA. |
| Algorithm Ref | Free-text filter (e.g. RSA/2048). |
| Secured By | HSM or Software. |
| Sensor | Free-text filter. |
Example: Key Types = Sensitive Keys, Secured By = Software → every secret/private key that is not HSM-protected — a classic "keys at risk" view.
Key Summary Chart — Algo-Sum-CHT
Display type: chart
Keys grouped by algorithm or algorithm reference.
| Option | Notes |
|---|---|
| Tag Scope | See Tag Scope. |
| Key Types | All, Sensitive Keys, Symmetric Key, Private Key, Public Key. |
| Host | Free-text filter. |
| Group By | Algorithm (family) or AlgorithmRef (default). |
| Drill Into Chart First | Requires Group By = Algorithm. Each bar opens a second chart grouped by AlgorithmRef, which then opens the key table. |
Weak Keys Summary Chart — Algo-Weak-CHT
Display type: chart
Keys using weak algorithms, by category.
| Option | Notes |
|---|---|
| Tag Scope | See Tag Scope. |
| Key Types | All, Symmetric Key, Private Key, Public Key. |
| Category | Numeric, 1–3 (algorithm risk category). |
| Host | Free-text filter. |
Protocol widgets
TLS and SSH are tracked separately: the CipherSuites widgets and Proto-TBL cover TLS (a negotiated cipher suite string). SSH negotiates four separate algorithm categories (key exchange, host key, cipher, MAC) which are not comparable to a TLS cipher suite, so SSH has its own widget family below.
Protocol Table — Proto-TBL
Display type: table
Paginated table of TLS/SSH protocol discoveries.
| Option | Notes |
|---|---|
| Tag Scope | See Tag Scope. |
| Items Per Page | 10/20/40/60/80 (default 20). |
| Sort By | Discover Time, Host, Port. |
| Host | Free-text filter. |
| Port | Numeric filter. |
| Cipher Suite | Free-text filter. |
| Protocol | All, TLS, SSH. |
| SSH Algorithm | Free-text filter. |
CipherSuites Chart — CipherSuites-CHT
Display type: chart
TLS cipher suites offered, by endpoint count. (For SSH's negotiated algorithms use SSH-Algo-CHT instead.)
| Option | Notes |
|---|---|
| Tag Scope | See Tag Scope. |
| CipherSuite | Free-text filter. |
CipherSuites Summary Table — CipherSuites-Sum-TBL
Display type: table
TLS cipher suites and their endpoint counts — the drill-down target for CipherSuites-CHT.
| Option | Notes |
|---|---|
| Tag Scope | See Tag Scope. |
| Ciphersuite | Free-text filter. |
| Items Per Page | 10/20/40/60/80 (default 20). |
| Sort By | Ciphersuite or Counts. |
SSH Security Posture — SSH-Posture-TBL
Display type: table
SSH endpoints: auth methods offered, null auth, forwarding flags and rekey settings — the fields Proto-TBL's algorithm columns don't cover.
| Option | Notes |
|---|---|
| Tag Scope | See Tag Scope. |
| Items Per Page | 10/20/40/60/80 (default 20). |
| Sort By | Discover Time, Host, Port. |
| Host | Free-text filter. |
| Port | Numeric filter. |
SSH Algorithm Chart — SSH-Algo-CHT
Display type: chart
One negotiated SSH category at a time (algorithm name vs. endpoint count). Deliberately one category per chart — a MAC algorithm and a key-exchange algorithm aren't comparable values.
| Option | Notes |
|---|---|
| Tag Scope | See Tag Scope. |
| Category | Key Exchange, Host Key, Cipher, MAC (default Key Exchange). |
| Algorithm | Free-text filter. |
SSH Algorithm Table — SSH-Algo-TBL
Display type: table
SSH endpoints, one row each, with the four negotiated algorithm lists split into their own columns (Key Exchange, Host Key, Cipher, MAC) — the drill target for SSH-Algo-CHT.
| Option | Notes |
|---|---|
| Tag Scope | See Tag Scope. |
| Items Per Page | 10/20/40/60/80 (default 20). |
| Sort By | Discover Time, Host, Port. |
| Host | Free-text filter. |
| Port | Numeric filter. |
SSH Algorithm Strength Overview — SSH-Strength-STK
Display type: stacked-chart
SSH endpoints scored across all four negotiated categories at once, stacked by criticality bucket. Click a segment to see the endpoints behind it.
| Option | Notes |
|---|---|
| Tag Scope | See Tag Scope. |
Search widgets
A unified, cross-type search over certificates, keys, protocols, source code, binaries and signatures — useful when you want one table/chart that isn't locked to a single material type.
CMDocs Search Table — CMDocs-Search-TBL
Display type: table
| Option | Notes |
|---|---|
| Tag Scope | See Tag Scope. |
| Document Type | All Types, Certificate, Key, Protocol, Source Code, Binary, Signature. |
| Items Per Page | 10/20/40/60/80 (default 20). |
| Sort By | Discover Time, Algorithm, Host. |
| Algorithm / Algorithm Ref | Free-text filters. |
| Host | Free-text filter. |
| Subject CN (cert) / Issuer CN (cert) | Free-text filters. |
| Key Type (key) | Any, Private Key, Secret Key, Public Key. |
| Secured By (key) | Free-text filter. |
| Port (protocol) | Numeric filter. |
| Cipher Suite (protocol) | Free-text filter. |
| Self-Signed Only | Checkbox — returns only certificates where issuer equals subject. |
Seeded presets: "All Certificates" (docType: certificate), "All Keys" (docType: key).
CMDocs Search Chart — CMDocs-Search-CHT
Display type: chart
Groups search results by a chosen dimension for charting, with optional multi-level drilling.
| Option | Notes |
|---|---|
| Tag Scope | See Tag Scope. |
| Document Type | All Types, Certificate, Key, Protocol, Source Code, Binary, Signature. |
| Group By | Algorithm, Algorithm Ref, Document Type, Host, Key Type, or Issuer. One value, or an ordered list when Drill Into Chart First is on (e.g. Algorithm then Algorithm Ref). |
| Drill Into Chart First | When on, each bar opens another chart regrouped on the next dimension in Group By before reaching the table. |
| Algorithm Filter / Algorithm Ref Filter / Host Filter | Free-text filters. |
| Subject CN Filter (cert) / Issuer CN Filter (cert) | Shown when Document Type = Certificate. |
| Key Type Filter (key) | Shown when Document Type = Key: Any, Private Key, Secret Key, Public Key. |
| Port Filter (protocol) / Cipher Suite Filter (protocol) | Shown when Document Type = Protocol. |
Seeded presets: "Algorithms by Type" (groupBy: algorithmRef), "By Document Type" (groupBy: type).
Analyze widgets (risk, policy, agility)
Analysis Criteria reference
The four Cryptomaterial-* widgets below share one Analysis Criteria dropdown, whose options depend on the Cryptomaterial Type you pick:
| Cryptomaterial Type | Analysis Criteria options |
|---|---|
| Key | Key Strength, Quantum Safe, Key Reuse, Storage Location |
| Certificate | Certificate Validity, Certificate Expiry, Weak Signature Algorithm, Weak Certificate Key, Issuance Method, Quantum Safe |
| Source Code | Algorithm Strength, Quantum Safe |
| Protocol | Cipher Suite Strength, Quantum Safe, SSH Key Exchange Strength, SSH Host Key Strength, SSH Cipher Strength, SSH MAC Strength |
Every criterion scores materials into Critical / High / Medium / Low / Safe / No Analysis (see Criticality levels).
Host Risk Analysis — Host-Criticality-CHT
Display type: chart (not yet clickable — see Known limitations)
Host risk distribution by criticality level, scored across the host's certificates, keys and protocols.
| Option | Notes |
|---|---|
| Tag Scope | Hosts are scored only from materials in scope. |
| Cryptomaterial Type | All, Key, Certificate, Protocol. |
| Host | Free-text filter. |
Cryptomaterial Risk analysis — Cryptomaterial-Criticality-CHT
Display type: chart
Crypto inventory risk distribution by criticality level for one material type and one criterion. Clicking a bar opens Cryptomaterial-Criticality-TBL for that criticality/criterion/type.
| Option | Notes |
|---|---|
| Tag Scope | See Tag Scope. |
| Cryptomaterial Types | Key, Certificate, Protocol, Source Code (default Key). |
| Analysis Criteria | See Analysis Criteria reference (default Key Strength). |
Example: Cryptomaterial Types = Key, Analysis Criteria = Key Reuse → shows how many keys are uniquely used versus shared with another key elsewhere in the estate.
Crypto Inventory risk criticality Table — Cryptomaterial-Criticality-TBL
Display type: table
The drill-down target for Cryptomaterial-Criticality-CHT — one criticality bucket at a time.
| Option | Notes |
|---|---|
| Tag Scope | See Tag Scope. |
| Cryptomaterial Types | Key, Certificate, Protocol, Source Code (default Key). |
| Items Per Page | 10/20/40/60/80 (default 20). |
| Analysis Criteria | See Analysis Criteria reference. |
| Criticality Level | Critical, High, Medium, Safe, No Analysis (default Critical). |
Cryptomaterial Risk Stacked chart — Cryptomaterial-Criticality-STK
Display type: stacked-chart (not yet clickable)
Criticality distribution for a material type as a 100%-stacked bar (every criterion for that type at once, rather than one criterion at a time). Note: with Type = "all" this widget scores each criterion only over its own document type, while -CHT counts every scanned document — the two are expected to disagree in that case.
| Option | Notes |
|---|---|
| Tag Scope | See Tag Scope. |
| Cryptomaterial Types | Key, Certificate, Protocol, Source Code (default Key). |
Policy Analysis — Policy-Analysis-CHT
Display type: chart
Pass/Fail distribution of your key inventory against a chosen policy's approved algorithm list.
| Option | Notes |
|---|---|
| Tag Scope | See Tag Scope. |
| Policy Name | Dropdown populated from your defined policies. Required. |
| Key Types | All, Secret Key, Private Key, Public Key (default All). |
Policy Analysis Table — Policy-Analysis-TBL
Display type: table
| Option | Notes |
|---|---|
| Tag Scope | See Tag Scope. |
| Policy Name | Dropdown populated from your defined policies. Required. |
| Key Types | All, Secret Key, Private Key, Public Key (default All). |
| Items Per Page | 10/20/40/60/80 (default 20). |
Policy Analysis Stack Chart — Policy-Analysis-GRPCHT
Display type: group-chart
Policy Pass/Fail broken down into a nested/grouped view (a group per algorithm, with Pass/Fail sub-groups).
| Option | Notes |
|---|---|
| Tag Scope | See Tag Scope. |
| Policy Name | Dropdown populated from your defined policies. Required. |
| Key Types | All, Secret Key, Private Key, Public Key (default All). |
Policy Analysis Stacked Analysis — Policy-Analysis-STK
Display type: stacked-chart (not yet clickable)
Policy Pass/Fail as a 100%-stacked bar.
| Option | Notes |
|---|---|
| Tag Scope | See Tag Scope. |
| Policy Name | Dropdown populated from your defined policies. Required. |
Policy Analysis Time Series — Policy-Analysis-TSEQ
Display type: line-chart (not yet clickable)
Policy Pass/Fail over time, recomputed from the material change history (not a stored snapshot) — so any window can be charted, including before the widget existed.
| Option | Notes |
|---|---|
| Tag Scope | Applied point-in-time: a material counts only while it was in scope. |
| Policy Name | Dropdown populated from your defined policies. Required. |
| Key Types | All, Secret Key, Private Key, Public Key (default All). |
| From Date | Calendar, defaults to 84 days back. Required. |
| Interval | 1, 7, 14, 30, or 90 days (default 7). |
| To Date | Calendar; leave empty to stay current ("Now"). |
| Exclude Resolved Materials | On by default — decommissioned keys drop out of the chart. Turn off to compare directly against Policy-Analysis-CHT, which doesn't filter by status at all. |
Cryptomaterial Risk Time Series — Cryptomaterial-Analysis-TSEQ
Display type: line-chart (not yet clickable)
Criticality (Critical/High/Low/Safe/No Analysis) for one material type and criterion, over a chosen window — same history-derived approach as Policy-Analysis-TSEQ.
| Option | Notes |
|---|---|
| Tag Scope | Applied point-in-time. |
| Cryptomaterial Types | Key, Certificate, Protocol (default Key). |
| Analysis Criteria | See Analysis Criteria reference. |
| From Date | Calendar, defaults to 84 days back. Required. |
| Interval | 1, 7, 14, 30, or 90 days (default 7). |
| To Date | Calendar; leave empty for "Now". |
| Exclude Resolved Materials | On by default. |
Note: history starts when the CM Histories feature was turned on for your installation — a From Date earlier than that has no data to show, which is missing history rather than a bug.
Hostwise Agility Table — Hostwise-Agility-TBL
Display type: mix-table
Per-host algorithm agility summary (how quickly a host's crypto could be swapped out).
| Option | Notes |
|---|---|
| Tag Scope | Hosts are scored only from materials in scope. |
| Items Per Page | 10/20/40/60/80 (default 20). |
| Cryptomaterial Type | All, Key, Certificate (default All). |
PQC Safe Chart — PQC-Safe-CHT
Display type: chart (not yet clickable)
Post-quantum readiness distribution across hosts.
| Option | Notes |
|---|---|
| Tag Scope | See Tag Scope. |
| Cryptomaterial Type | All, Key, Certificate, Protocol (default All). |
PQC Safe Multi-Chart — PQC-Safe-MLTCHT
Display type: pqc-multi-chart (not yet clickable)
Post-quantum readiness, broken into several small charts by excessive criticality.
| Option | Notes |
|---|---|
| Tag Scope | Hosts are scored only from materials in scope. |
| Visibility | All, or High Risk only. |
Enterprise Agility CHT — Enterprise-Agility-CHT
Display type: fix-chart (not yet clickable)
Enterprise-wide agility score across hosts, fixed layout (no chart-style picker).
| Option | Notes |
|---|---|
| Tag Scope | Hosts are scored only from materials in scope. |
| Cryptomaterial Type | All, Key, Certificate (default All). |
Deployment widgets
Host OS Chart — Host-OS-CHT
Display type: chart (not yet clickable)
Hosts by operating system.
| Option | Notes |
|---|---|
| Tag Scope | Limits the chart to hosts in a named tag scope. |
| Detail/Summary | Toggle on to break the chart down into OS sub-types. |
Sensor Discovery Chart — sensor-discover-CHT
Display type: chart
Material discovered, summarized by sensor / material type.
| Option | Notes |
|---|---|
| Tag Scope | See Tag Scope. |
| Key Types | All, Keys, Symmetric Key, Private Key, Public Key, Certificate (default Keys). |
Source Code widgets
Seven widgets over source-code scan results, all scoped to the newest scan of each repository (a repository scanned three times is counted once, from its latest scan — not three times over).
Source Code Findings Chart — SourceCode-Findings-CHT
Display type: chart
Crypto findings in source code, grouped by any of ten dimensions.
| Option | Notes |
|---|---|
| Tag Scope | See Tag Scope. |
| Drill Into Chart First | Off by default. When on, clicking a bar opens a second chart regrouped on Drill By, and a bar there opens the findings table. |
| Group By | Severity (default), Category, Library, Algorithm, Algorithm Reference, Risk Tag, Evidence Type, Match Confidence, Language, or Repository. |
| Drill By | Beside Group By, shown only while Drill Into Chart First is on, and then required. Any Group By dimension except the one already chosen. |
| Repository | Dropdown of scanned repositories. |
| Severity | Critical, High, Medium, Low, Safe. |
| Category | Symmetric Encryption, Asymmetric Encryption, Asymmetric Keygen, Key Exchange, Signing, Hashing, Symmetric Keyschedule, MAC, KDF, Randomness, TLS Context, Authenticated Encryption. |
| Library / Algorithm / Algorithm Reference / File Path | Free-text filters. |
| Risk Tag | Weak, Deprecated, PQC Unsafe, IV Reuse, Hardcoded Material, Weak Params, Short Key, Collision Attacks, FIPS KAT. |
| Evidence Type | Library Usage vs. In-tree Implementation. (Not a heuristic filter — use Heuristic Findings for that.) |
| Match Confidence | High, Medium, Low. |
| Language | C/C++, Python, Java, Go, JavaScript/TypeScript, Rust, C#. |
| Heuristic Findings | Include (default), Exclude, or Only heuristic. Heuristic findings come from the scanner's regex fallback and are flagged "needs review — pattern-based"; they can be the majority of a scan. Exclude for a library-matched inventory, or show Only to work through a review queue. |
Both levels are chosen after the widget is placed, so one widget covers every pair — Severity → Category, Repository → Severity, Library → Algorithm and so on.
Source Code Findings Table — SourceCode-Findings-TBL
Display type: table
Every crypto finding, one row each (file, line, function, algorithm, library) — the drill-down target of the findings chart.
| Option | Notes |
|---|---|
| Tag Scope | See Tag Scope. |
| Items Per Page | 10/20/40/60/80 (default 20). |
| Sort By | Severity (default), File, Line, Category, Algorithm, Library, Repository. |
| Repository, Severity, Category, Language, Evidence Type, Match Confidence, Heuristic Findings | Same options as SourceCode-Findings-CHT above. |
Source Code File Table — SourceCode-File-TBL
Display type: table
One row per scanned file that carries findings, worst severity first, with finding counts and algorithms used.
| Option | Notes |
|---|---|
| Tag Scope | See Tag Scope. |
| Items Per Page | 10/20/40/60/80 (default 20). |
| Sort By | Severity (default), Findings, File, Language, Repository, Lines. |
| Repository | Dropdown of scanned repositories. |
| Language | C/C++, Python, Java, Go, JavaScript/TypeScript, Rust, C#. |
| File Path | Free-text filter. |
| Contains Severity | Critical, High, Medium, Low, Safe — files containing at least one finding of that severity. |
Source Code Algorithm Risk Table — SourceCode-Algo-Risk-TBL
Display type: table
Each algorithm the scanner resolved, how often it's called, its worst severity, which libraries provide it, and how many files use it. Rows are aggregates, so they have no detail/click action.
| Option | Notes |
|---|---|
| Tag Scope | See Tag Scope. |
| Items Per Page | 10/20/40/60/80 (default 20). |
| Sort By | Max Severity (default), Usages, Algorithm, Files. |
| Repository, Severity, Category, Library, Risk Tag, Evidence Type, Language, File Path, Heuristic Findings | Same options as the findings chart/table above. |
Source Code Severity Mix — SourceCode-Repo-STK
Display type: stacked-chart
Severity composition of each repository (or language) as a 100%-stacked bar, so a proportionally risky repository stands out regardless of size. Click a segment to open the findings table for it.
| Option | Notes |
|---|---|
| Tag Scope | See Tag Scope. |
| Rows | Repository (default) or Language. |
| Repository / Language / File Path | Filters. |
Source Code Risk Time Series — SourceCode-Analysis-TSEQ
Display type: line-chart (not yet clickable)
Findings by severity over time, recomputed from successive scans. At each point, every repository contributes its newest scan up to that instant — so a flat line means no re-scan happened, not that nothing changed in the code.
| Option | Notes |
|---|---|
| Tag Scope | See Tag Scope. |
| From Date | Calendar, defaults to 84 days back. Required. |
| Interval | 1, 7, 14, 30, or 90 days (default 7). |
| To Date | Calendar; leave empty for "Now". |
| Repository | Dropdown of scanned repositories. |
Source Code KPI Single Value Grids — SourceCode-KPI-SVGBOX
Display type: svgbox
Per-severity finding counts, heuristic matches, PQC-unsafe findings, crypto files and repository coverage — scoped to one repository and one heuristic mode. Use the shared KPI Single Value Grids widget instead if you want a box that mixes source code with key/certificate tiles. See How to use a KPI grid widget for how the Types picker works.
| Option | Notes |
|---|---|
| Types | Which tiles to show, in display order (at least one required). See Source Code tiles below. |
| Repository | Dropdown of scanned repositories. |
| Heuristic Findings | Include (default), Exclude, or Only heuristic. |
Binary widgets
Five tables plus two stacked charts, one plain chart and one KPI box, all over scanned binaries (executables, libraries, drivers, firmware, JARs, .NET assemblies). Note: the five table widgets and the Confidence KPI box do not currently offer Tag Scope; the three chart widgets (Library Mix, Version Spread, Host Footprint) do.
A binary can run on more than one host, so most of these count binaries or hosts, not rows — read each description carefully, since the same word ("total") means a different thing on different tiles.
Binary Inventory — Binary-Inventory-TBL
Display type: table
Every scanned binary: host, path, kind, embedded crypto library, version, detection confidence, and code signature status. The landing table for the binary estate.
| Option | Notes |
|---|---|
| Items Per Page | 10/20/40/60/80 (default 20). |
| Sort By | Confidence (default), Library, Version, Kind, Host, Path, Discovered. |
| Kind | All Kinds, Executables & Drivers, Application, Library, Static Archive, Firmware, Driver, Java Archive, .NET Assembly. |
| Code Signature | Any, Signed, Unsigned, Untrusted (signature present but did not verify), No Valid Signature (Unsigned + Untrusted). |
| Host / File Path / Crypto Library / Family / Library Version / Code Signer (DN) | Free-text filters. |
| Known CVE | Any, Carries a known CVE, No known CVE. Counts binaries, not CVEs — one binary can carry several. |
| End-of-Life Library | Any, On an end-of-life version, On a supported version. A library with no published support boundary, or an unparseable version, is never reported end-of-life. |
| Confidence Below | Keep only detections scoring below this (0–1, exclusive). An import-table/symbol match scores 0.85–1.0; the generic AES/RSA/SHA256 catch-all scores 0.3 — 0.7 is a reasonable line between "declared library" and "inferred". Leave blank for no bound. |
Note on signatures: code signing is three states, not a yes/no: Signed (verified), Unsigned (no signature to check), and Untrusted (a signature is present but did not verify) — the last is worse than Unsigned, not better.
Vulnerable Binaries — Binary-Vulnerable-TBL
Display type: table
One row per CVE on one binary, not per binary — a binary with three known CVEs appears as three rows, so a patch-triage queue reads worst-first correctly.
| Option | Notes |
|---|---|
| Items Per Page | 10/20/40/60/80 (default 20). |
| Sort By | Severity (default), CVSS, CVE, Library, Host. |
| CVE Severity | Critical, High, Medium, Low. |
| Minimum CVSS | Numeric. |
| Kind / Code Signature | Same options as Binary Inventory. |
| CVE Identifier / Crypto Library / Library Version / Host / File Path | Free-text filters — Library/Version here match the vulnerable library entry, not necessarily the binary's own top-level version, since one binary can bundle more than one vulnerable library. |
Library Version Sprawl — Binary-Library-Sprawl-TBL
Display type: table
One row per (library, version) pair: distinct hosts running it, binaries embedding it, first/last seen, and distinct CVE count for that version. Sorted so a library's versions sit together. Rows are aggregates — no per-row detail action.
| Option | Notes |
|---|---|
| Items Per Page | 10/20/40/60/80 (default 20). |
| Sort By | Library & Version (default), Hosts, Binaries, CVEs, Last Seen, First Seen. |
| Known CVEs | With CVEs / Without CVEs. |
| Kind / Code Signature | Same options as Binary Inventory. |
| Crypto Library / Family / Library Version / Host / File Path | Free-text filters. |
Code Signers — Binary-Signer-TBL
Display type: table
One row per signing identity: issuer, certificate key algorithm, expiry, and the binaries/hosts it covers. Connects the binary estate to the certificate estate. Rows are aggregates — no per-row detail action.
| Option | Notes |
|---|---|
| Items Per Page | 10/20/40/60/80 (default 20). |
| Sort By | Expiry (default), Binaries, Hosts, Signer. |
| Expires Within (days) | Numeric — drops unresolved signers regardless of the checkbox below, since "expires within N days" needs a real expiry date. |
| Include Unresolved Signers | Off by default. A signer only resolves to a certificate when its distinguished name matches a certificate's subject exactly; on real estates a meaningful share of signers won't match (a spelling/order mismatch in how the signing tool wrote the DN, not a bug in this table). Turn this on to see them anyway, flagged (unresolved). |
| Kind / Code Signature | Same options as Binary Inventory. |
| Code Signer (DN) / Crypto Library / Family / Library Version / Host / File Path | Free-text filters. |
Unsigned & Untrusted Binaries — Binary-Unsigned-TBL
Display type: table
Binaries with no valid code signature, defaulting to the kinds where that matters: applications, drivers and firmware. Unsigned static/shared libraries are normal and stay out of the default; an unsigned driver or firmware image is a real finding.
| Option | Notes |
|---|---|
| Items Per Page | 10/20/40/60/80 (default 20). |
| Sort By | Kind (default), Host, Path, Library, Reason, Discovered. |
| Kind | All Kinds, Executables & Drivers (default), Application, Library, Static Archive, Firmware, Driver, Java Archive, .NET Assembly. |
| State | No Valid Signature (default, = Unsigned + Untrusted), Unsigned Only, Untrusted Only. This widget cannot be configured to list signed binaries. |
| Host / File Path / Crypto Library / Family / Library Version | Free-text filters. |
Binary Match Confidence KPIs — Binary-Confidence-KPI-SVGBOX
Display type: svgbox
How certain the crypto-library detections in your binary estate are: one tile per fifth of the sensor's confidence score, plus Uncertain for binaries it never scored. The six bands are disjoint and add up to Total Binaries under the same filters. Click a tile to open the inventory table filtered to that band. See How to use a KPI grid widget for how the Types picker works.
| Option | Notes |
|---|---|
| Types | Which of the six bands to show (0–20%, 20–40%, 40–60%, 60–80%, 80–100%, Uncertain), in display order. All six are on by default — a single band alone says little. |
| Kind / Code Signature | Same options as Binary Inventory. |
| Host / File Path / Crypto Library / Family / Library Version / Code Signer (DN) | Free-text filters. |
Binary Crypto Library Mix by Host — Binary-Library-Mix-STK
Display type: stacked-chart
Crypto library composition of every host's scanned binaries, as a stacked bar — a host running an unusually wide mix of libraries stands out. Each segment drills into the inventory table filtered to that host and library.
| Option | Notes |
|---|---|
| Tag Scope | See Tag Scope. |
| Host / Crypto Library | Free-text filters. |
| Max Hosts Shown | Leave blank to show every host; otherwise shows only the busiest N hosts by binary count. |
Binary Library Version Spread — Binary-Version-Spread-STK
Display type: stacked-chart
Version composition of every crypto library's scanned binaries, as a stacked bar — the "sprawl" story at a glance. Clicking through lands in the Library Version Sprawl table.
| Option | Notes |
|---|---|
| Tag Scope | See Tag Scope. |
| Crypto Library / Version / Host | Free-text filters. |
| Max Libraries Shown | Leave blank to show every library; otherwise shows only the busiest N by binary count. |
Binary Host Footprint by Crypto Library — Binary-Host-Footprint-CHT
Display type: chart
How many distinct hosts carry each crypto library (not how many binaries) — a fleet-wide library reaches every host it's deployed on, not just the most-nested ones. Clicking a bar lands in the inventory table filtered to that library.
| Option | Notes |
|---|---|
| Tag Scope | See Tag Scope. |
| Crypto Library / Host | Free-text filters. |
Misc widgets
KPI Single Value Grids — KPI-list-SVGBOX
Display type: svgbox
A row of single-value tiles covering keys, certificates, protocols, source code and binaries — the general-purpose KPI box. See How to use a KPI grid widget for how the Types picker works, and the full KPI tile catalogue below for what each tile shows and where it drills.
| Option | Notes |
|---|---|
| Tag Scope | Limits the tiles to a named tag scope. Total Supported Sensors is unaffected — it counts registered sensor definitions, not estate material. |
| Types | Which tiles to show, in display order (at least one required, default "Total Keys"). |
Example: Types = Total Keys, Total Active Certificate, Total Expired Certificates, Binary: With a Known CVE — a compact top-of-dashboard risk summary row.
Crypto Material Detail — CM-Detail
Display type: doc
Renders the full detail of one crypto material document — the standard row-click target for every table above. Shows the tags the document carries and (for source code) every finding in that file.
| Option | Notes |
|---|---|
| Doc-ID | The material's document id. Required. You normally reach this by clicking a table row rather than typing an id yourself. |
Crypto Material History — CM-History
Display type: doc
The version timeline of one crypto material — when it was discovered, updated, resolved or reactivated.
| Option | Notes |
|---|---|
| Doc-ID | The material's document id. Required. |
| Change Type | All, Discovered, Updated, Resolved, Reactivated. |
| From Date / To Date | Calendar pickers. |
| Max Versions | 10, 25, or 50 (default 50). |
Text box — Text-DOC
Display type: doc
A free-text tile for notes, instructions, or a dashboard title block.
| Option | Notes |
|---|---|
| Show Text | Multi-line text area. |
Composite widgets
These two widgets don't query anything themselves — each wraps one or more of the widgets above, adding chart-display options (bar/pie/doughnut, legend, title styling) on top.
Chart and Table — cht2tbl
Shows a chart and its drill-down table side by side (or stacked top/bottom) in one tile, auto-selecting the first group on load. Adding a new combination here is a matter of picking any chart widget above and its query parameters — no separate table widget needs to be added.
Common display options on every preset: Chart Type (bar/pie/doughnut), Chart Orientation (varies by chart type), Show Legends, Show Widget Title, title font size/weight/color, and Table Arrangement (right or bottom).
Seeded presets: Certificate Expiry Chart, Certificate Chart, Sensor Discovery Chart, Key Summary Chart and Weak Key Summary Chart. The Source Code widgets carry no presets — place them directly and pick their grouping in Configure Widget.
Multi Charts — multi_charts
A single tile that displays a whole bundle of the chart widgets above together, each kept independently configurable. The seeded bundle includes: Certificate Expiry Chart, Key Summary Chart, Weak Keys Summary Chart, Host Risk Analysis, Cryptomaterial Risk analysis, CipherSuites Chart, Host OS Chart, Policy Analysis, Certificate Chart, Sensor Discovery Chart, Policy Analysis Stack Chart, Cryptomaterial Risk Time Series, Cryptomaterial Risk Stacked chart, Policy Analysis Stacked Analysis, PQC Safe Chart, Enterprise Agility CHT, and PQC Safe Multi-Chart.
KPI tile catalogue
KPI tiles are the single-value boxes shown by KPI-list-SVGBOX, SourceCode-KPI-SVGBOX, and Binary-Confidence-KPI-SVGBOX. Each tile has its own name, its own count, and (usually) its own drill-down table — clicking one opens the material behind that number, already filtered.
How to use a KPI grid widget
All three KPI boxes are configured the same way:
Add the widget from the Add Widget picker like any other widget.
Open its Configure dialog. Every one of these widgets has a Types field — a two-list picker. The left list is every tile not currently on the box; the right list is the tiles you've chosen, in the order they'll be displayed.
Move a tile to the right list to add it (double-click it, or select it and use the arrow button); move it back to the left to remove it. Drag rows within the right list to reorder them — the order in that list is the order the tiles render on your dashboard.
Set any other filters the box offers (Tag Scope, Repository, Heuristic Findings, or the binary filters — see the comparison below), then save.
On the dashboard, each tile shows one number. If a drill-down is noted for that tile in the tables below, clicking the number opens the matching table, already filtered to that tile's population — the same click-to-drill behavior every chart uses. A tile with no drill-down noted simply isn't clickable.
What each KPI box can filter
KPI-list-SVGBOX | SourceCode-KPI-SVGBOX | Binary-Confidence-KPI-SVGBOX | |
|---|---|---|---|
| Tag Scope | Yes — applies to every tile except Total Supported Sensors | No | No |
| Repository | No | Yes | No |
| Heuristic Findings | No | Yes | No |
| Binary filters (Kind, Code Signature, Host, Path, Crypto Library, Family, Library Version, Code Signer) | No | No | Yes |
| Tile catalogue offered | Every tile below | Source Code tiles only | The six confidence bands only |
A KPI grid widget mixes tiles from different estates (keys, certificates, source code, binaries) in one row, which is exactly why it can't offer one filter set that suits every tile — see Tag Scope and Known limitations for the specifics.
Key tiles
| Tile | What it shows | Drills into |
|---|---|---|
Total Secrets (KEY-TOL) | Secret (symmetric) and private keys together. | Key Table, scoped to Sensitive Keys |
Total Secret Keys (KEY-SECRET-TOL) | Symmetric/secret keys only. | Key Table, scoped to Symmetric Key |
Total Private Keys (KEY-PRIVATE-TOL) | Private keys only. | Key Table, scoped to Private Key |
Total Public Keys (KEY-PUBLIC-TOL) | Public keys only. | Key Table, scoped to Public Key |
Total HSM Keys (HSM-PROTECTED-TOL) | Secret and private keys protected by an HSM (Secured By = HSM). Public keys aren't counted here. | Key Table, scoped to Sensitive Keys + Secured By = HSM |
Total Software Keys (SW-PROTECTED-TOL) | Secret and private keys not protected by an HSM. | Key Table, scoped to Sensitive Keys + Secured By = Software |
Certificate tiles
| Tile | What it shows | Drills into |
|---|---|---|
Total Certificates (CERT-TOL) | Every certificate. | Certificate Table |
Total Active Certificate (CERT-ACTIVE-TOL) | Certificates valid right now — already started (validFrom ≤ now) and not yet expired (validTo ≥ now). | Certificate Table, filtered to that window |
Total Expired Certificates (CERT-EXPIRED-TOL) | Certificates whose validTo is already in the past. | Certificate Table, filtered to expired |
Protocol tiles
| Tile | What it shows | Drills into |
|---|---|---|
Total Unique CipherSuites (CIPHERSUITE-TOL) | Distinct cipher suite strings seen across every protocol document. | CipherSuites Summary Table |
Total Protocols (PROTOCOL-TOL) | Listed in the picker, but has no working count behind it. | Broken — see Known limitations |
Task, deployment & platform tiles
Not currently clickable — these summarize task/deployment records rather than crypto material, so none of them opens a table yet.
| Tile | What it shows |
|---|---|
Total Tasks (TASK-TOL) | Total number of task definitions. |
Ongoing Deployments (TASK-ONGOING-TOL) | Deployments currently in progress. |
Successful Deployments (TASK-SUCCESS-TOL) | Host-level deployments that completed successfully. |
Failed Deployments (TASK-FAILED-TOL) | Host-level deployments that failed. |
Pending Deployments (TASK-PENDING-TOL) | Host-level deployments still queued or not yet started. |
Total Supported Sensors (Sensor-Count) | Number of sensor types the platform currently supports. This counts what CBOM can discover with, not material in your estate — Tag Scope never affects it. |
Enterprise Agility tiles — keys
These score the same criteria as the Analyze widgets' Key Strength, Quantum Safe, Storage Location and Key Reuse criteria, as standalone counts — useful for a compact "enterprise readiness" KPI row.
| Tile | What it shows | Drills into |
|---|---|---|
Enterprise Safe Key Strength (ENT-CAT4-KeyStrength-Safe-TOL) | Keys whose algorithm falls in the safe strength category (Cat 4). | — |
Enterprise Low Risk Key Strength (ENT-CAT3-KeyStrength-Safe-TOL) | Keys in the low-risk algorithm category (Cat 3). | — |
Enterprise High Risk Key Strength (ENT-CAT2-KeyStrength-Safe-TOL) | Keys in the high-risk algorithm category (Cat 2). | — |
Enterprise Critical Risk Key Strength (ENT-CAT1-KeyStrength-Safe-TOL) | Keys in the critical-risk algorithm category (Cat 1). | — |
Quantum Safe Keys (ENT-Key-QuantumSafe-Safe-TOL) | Keys whose algorithm is rated post-quantum safe. | — |
Non-Quantum Safe Keys (ENT-Key-QuantumSafe-Critical-TOL) | Keys whose algorithm is rated not post-quantum safe. | — |
Quantum Safety – No Analysis Keys (ENT-Key-QuantumSafe-NoAnl-TOL) | Keys that can't be evaluated for quantum safety — missing an algorithm reference or ranking rule. | — |
HSM Protected Keys (ENT-Key-StorageLocation-Safe-TOL) | Keys of any type (including public) secured by HSM. Broader than Total HSM Keys above, which counts only secret/private keys. | Key Table, scoped to Secured By = HSM |
Software Protected Keys (ENT-Key-StorageLocation-Critical-TOL) | Keys of any type not secured by HSM. Broader than Total Software Keys above, for the same reason. | Key Table, scoped to Secured By = Software |
Key Reuse (Critical) (ENT-KeyReuse-Critical-TOL) | Keys whose public key hash matches another key elsewhere in the estate — genuinely shared key material. | — |
Key Reuse (Safe) (ENT-Key-Reuse-Safe-TOL) | Keys whose public key hash is unique — not shared with any other key. | — |
Key Reuse (No Analysis) (ENT-Key-Reuse-NoAnl-TOL) | Secret/private keys with no recorded public key hash, so reuse can't be evaluated. | — |
Enterprise Agility tiles — certificates
| Tile | What it shows | Drills into |
|---|---|---|
Certificates Safe Key Strength (ENT-CAT4-WeakCertKey-Safe-TOL) | Certificates whose key falls in the safe strength category (Cat 4). | — |
Certificates Low Risk Key Strength (ENT-CAT3-WeakCertKey-Low-TOL) | Certificates whose key is in the low-risk category (Cat 3). | — |
Certificates High Risk Key Strength (ENT-CAT2-WeakCertKey-High-TOL) | Certificates whose key is in the high-risk category (Cat 2). | — |
Certificates Critical Risk Key Strength (ENT-CAT1-WeakCertKey-Critical-TOL) | Certificates whose key is in the critical-risk category (Cat 1). | — |
Quantum Safe Certificates (ENT-Cert-QuantumSafe-Safe-TOL) | Certificates whose algorithm is rated post-quantum safe. | — |
Non-Quantum Safe Certificates (ENT-Cert-QuantumSafe-Critical-TOL) | Certificates whose algorithm is rated not post-quantum safe. | — |
Self-signed Certificates (Critical) (ENT-Cert-SelfSigned-Critical-TOL) | Certificates where issuer equals subject (including both being blank). | Certificate Table, Self-Signed Only |
CA-signed Certificates (Safe) (ENT-Cert-SelfSigned-Safe-TOL) | Certificates with a genuinely different, non-blank issuer and subject. | — |
SelfSigned (No Analysis) (ENT-Cert-SelfSigned-NoAnl-TOL) | Certificates missing an issuer or subject, so issuance method can't be evaluated. | — |
Strong Signature Certificates (Safe) (ENT-Cert-WeakSignature-Safe-TOL) | Certificates signed with a hash algorithm that isn't MD5 or SHA-1. | — |
Weak Signature Certificates (Critical) (ENT-Cert-WeakSignature-Critical-TOL) | Certificates signed with MD5 or SHA-1 — a weak signing hash. | — |
WeakSignature (No Analysis) (ENT-Cert-WeakSignature-NoAnl-TOL) | Certificates with no recorded signing algorithm. | — |
Expired Certificates (Critical) (ENT-Cert-Expiry-Critical-TOL) | Certificates whose validTo is already in the past. | Certificate Table, filtered to expired |
Expiring Soon Certificates (High) (ENT-Cert-Expiry-High-TOL) | Certificates expiring within the next 30 days. | Certificate Table, 0–30 days to expiry |
Expiring Later Certificates (Low) (ENT-Cert-Expiry-Low-TOL) | Certificates expiring in 31–180 days. | Certificate Expiration Table |
Valid Certificates (Safe) (ENT-Cert-Expiry-Safe-TOL) | Certificates expiring more than 180 days from now. | Certificate Expiration Table |
Cert Expiry (No Analysis) (ENT-Cert-Expiry-NoAnl-TOL) | Certificates with a missing or unreadable validTo. | — |
Enterprise Agility tiles — protocols
| Tile | What it shows | Drills into |
|---|---|---|
Protocols Safe Cipher Suites (ENT-Proto-CipherSuiteStrength-Cat4-TOL) | Protocol documents whose first-matched cipher suite rule is Cat 4 (safe). | — |
Protocols Low Risk Cipher Suites (ENT-Proto-CipherSuiteStrength-Cat3-TOL) | Cat 3 (low risk). | — |
Protocols High Risk Cipher Suites (ENT-Proto-CipherSuiteStrength-Cat2-TOL) | Cat 2 (high risk). | — |
Protocols Critical Risk Cipher Suites (ENT-Proto-CipherSuiteStrength-Cat1-TOL) | Cat 1 (critical) — also the default when no ranking rule matched at all. | — |
Protocols CipherSuite Strength (No Analysis) (ENT-Proto-CipherSuiteStrength-NoAnl-TOL) | Protocols with no cipher suite recorded, or one that matched no ranking rule. | — |
Protocols Quantum Safe Cipher Suites (ENT-Proto-CipherSuiteQuantumSafe-Safe-TOL) | Protocols whose negotiated cipher suite is rated post-quantum safe. | — |
Protocols Non-Quantum Safe Cipher Suites (ENT-Proto-CipherSuiteQuantumSafe-Critical-TOL) | Protocols whose negotiated cipher suite is not rated post-quantum safe. | — |
Source Code tiles
Both KPI-list-SVGBOX and SourceCode-KPI-SVGBOX can show these, but not the same set: KPI-list-SVGBOX offers only the four estate-wide totals marked "Yes" below (no repository/heuristic filter there — a per-severity number would only ever be unscoped). SourceCode-KPI-SVGBOX offers the full set, each scopeable by Repository and Heuristic Findings.
| Tile | What it shows | On KPI-list-SVGBOX? |
|---|---|---|
Source Code: Crypto Files (SRC-FILES) | Files (in the newest scan of each repository) carrying at least one crypto finding. | Yes |
Source Code: Files with Critical (SRC-CRITICAL-FILES) | Files carrying at least one Critical-severity finding. | No |
Source Code: Languages (SRC-LANGUAGES) | Distinct programming languages seen across scanned files. Not clickable — a distinct-value count with no single matching table. | Yes |
Source Code: Repositories (SRC-REPOS) | Distinct repositories scanned. Not clickable, same reason. | Yes |
Source Code: Total Findings (SRC-FINDINGS) | Every crypto finding across the newest scan of each repository. | Yes |
Source Code: Critical Findings (SRC-CRITICAL) | Findings at Critical severity. | No |
Source Code: High Findings (SRC-HIGH) | Findings at High severity. | No |
Source Code: Medium Findings (SRC-MEDIUM) | Findings at Medium severity. | No |
Source Code: Low Findings (SRC-LOW) | Findings at Low severity. | No |
Source Code: Safe Findings (SRC-SAFE) | Findings at Safe severity. | No |
Source Code: Heuristic Matches (SRC-HEURISTIC) | Findings caught only by the scanner's regex fallback tier — flagged for manual review rather than a confirmed library match. | No |
Source Code: PQC-Unsafe Findings (SRC-PQC-UNSAFE) | Findings tagged as not post-quantum safe. | No |
Every clickable Source Code tile drills into the Source Code Findings Table (the two file-count tiles drill into the File Table instead).
Binary tiles
| Tile | What it shows | Where | Drills into |
|---|---|---|---|
Binary: Total Binaries (BIN-TOTAL) | Binaries scanned. One entry per distinct file content, so the same binary present on several hosts still counts once. | KPI-list-SVGBOX | Binary Inventory |
Binary: Crypto Libraries (BIN-LIBRARIES) | Distinct crypto libraries detected. Spellings are the sensor's own and aren't merged, so "CNG" and "Windows CNG" count separately. Not clickable — the closest table lists (library, version) pairs, not libraries. | KPI-list-SVGBOX | — |
Binary: With a Known CVE (BIN-CVE) | Binaries whose library version matched a known CVE. Counts binaries, not CVEs — one binary can carry several. | KPI-list-SVGBOX | Binary Inventory, Known CVE = true |
Binary: Unsigned/Untrusted (BIN-UNSIGNED) | Executables, drivers and firmware with no valid code signature — unsigned, or carrying a signature that didn't verify. | KPI-list-SVGBOX | Unsigned & Untrusted Binaries |
Binary: End-of-Life Library (BIN-EOL) | Binaries on a library version past its publicly known support boundary. Libraries with no published boundary are never counted here. | KPI-list-SVGBOX | Binary Inventory, End-of-Life Library = true |
Binary: Confidence 0–20% / 20–40% / 40–60% / 60–80% / 80–100% (BIN-CONF-0-20 … BIN-CONF-80-100) | Binaries whose crypto-library detection scored in that band. The five bands plus Uncertain always sum to Total Binaries under the same filters. | Binary-Confidence-KPI-SVGBOX | Binary Inventory, filtered to that band |
Binary: Confidence Uncertain (BIN-CONF-UNCERTAIN) | Binaries the sensor never scored at all — not a low score, just no reading. | Binary-Confidence-KPI-SVGBOX | Binary Inventory, filtered to Uncertain |
Known limitations
A short, honest list of things that look like settings but don't currently work, so you don't spend time chasing them:
"Total Protocols" (
PROTOCOL-TOL) is selectable onKPI-list-SVGBOXbut has no working count behind it — selecting it will show an error rather than a number.Not every chart is clickable yet. The following don't currently drill into anything when you click a bar/segment: Host Risk Analysis, PQC Safe Chart, PQC Safe Multi-Chart, Enterprise Agility CHT, Host OS Chart, Policy Analysis Time Series, Cryptomaterial Risk Time Series, Cryptomaterial Risk Stacked chart, Policy Analysis Stacked Analysis, Source Code Risk Time Series.
Source Code Risk Time Series can only be read as a whole trend line — you can't click an individual point on the line to see the findings behind that moment in time. A flat line means "no re-scan happened in that window," not "nothing changed."
Source Code Algorithm Risk Table rows are aggregates over many findings, so rows have no click-through — same for Binary Library Version Sprawl and Binary Code Signers.
Binary Code Signers will show many rows as
(unresolved)when Include Unresolved Signers is on — this reflects a real gap in how signing identities are recorded on the binary vs. the certificate, not a bug in the table.Binary tables don't yet support Tag Scope (Inventory, Vulnerable, Library Sprawl, Signer, Unsigned, and the Confidence KPI box). The three Binary chart widgets (Library Mix by Host, Version Spread, Host Footprint) do support it.
Cryptomaterial Risk Stacked chart, with Cryptomaterial Type = "all", intentionally disagrees with Cryptomaterial Risk analysis — the stacked chart scores each criterion only within its own document type, while the chart counts every scanned document. This is by design, not a bug to reconcile.
History-based time series (
Policy-Analysis-TSEQ,Cryptomaterial-Analysis-TSEQ,SourceCode-Analysis-TSEQ) only have data back to when your installation turned on history tracking (or, for source code, back to the earliest scan). A date range before that legitimately shows low/no activity.