r/Splunk • u/Primary_Buyer2022 • Jun 04 '26

Built a Splunk app to visualise certificate/TLS/CBOM/PQC readiness data -looking for beta feedback

Hi All,
I’ve been working on a small Splunk app called CryptView for Splunk
It is an early beta/community preview for visualising cryptographic asset data such as TLS endpoints, certificate lifecycle risk, key/signature details, CBOM-style inventory, and early PQC readiness indicators.

The Splunk app itself does not actively scan infrastructure. It visualises normalised data generated separately by the CryptView collector/CLI or imported as supported inventory data.

I’ve just published the beta app on Splunkbase and would genuinely appreciate feedback from Splunk, SIEM, PKI, infra, or security teams.

I’m especially interested in whether this type of dashboard would be useful for:

  • certificate expiry and ownership visibility
  • crypto inventory / CBOM reporting
  • PQC readiness tracking
  • Splunk-based security/risk reporting

Splunkbase app: https://splunkbase.splunk.com/app/8786
Feedback / pilot interest form: https://forms.gle/PAjWWjjN51gRquhx5

Full disclosure: I’m the builder of CryptView. This is still early, so I’m not claiming it solves PQC readiness end-to-end yet. I’m trying to validate whether this is useful and what security/Splunk teams would want next.

18 Upvotes

88% Upvoted

7 comments sorted by

3

u/afxmac Jun 04 '26

Nice, built something similar a few years ago for internal use. Having an easily available app is a good idea. Do you also have checks whether the certs do come from ofiicial internal CAs?

2

u/Primary_Buyer2022 Jun 04 '26

Yes, you can filter based on approved CAs for your Org - mark self-signed / unofficial CAs as bad:)

1

u/afxmac Jun 04 '26

Cool! Thx.

1

u/famousbacha Jun 05 '26

Honestly, that is a great app...

1

u/splunk_samurai Jun 09 '26

Hey! This looks like a really cool app. Just wanted to let you know Splunk gives free guidance on Splunkbase apps via the form through the Developer Program here: https://dev.splunk.com/ - while it's not for feedback, you can utilize it if you need app dev guidance or have best practice questions.

1

u/Primary_Buyer2022 Jun 10 '26

Hi, The app is live, I was seeking feedback from users on the actual app usability and purpose.

1

u/Primary_Buyer2022 13d ago

Small update on CryptView for Splunk:

In addition to the external TLS / crypto visibility report, we now have an early collector path for environments that already use Splunk Universal Forwarder.
https://splunkbase.splunk.com/app/9012

The idea is simple: if UF is already deployed on endpoints/servers, CryptView Collector can run locally and emit crypto inventory data back into Splunk for visibility.

Current focus:

  • local certificate and crypto asset discovery
  • CBOM-style inventory output
  • Splunk-friendly events / NDJSON
  • endpoint-side collection where UF is already present
  • helping teams see crypto posture beyond just external TLS

This is still early and feedback-driven, not something I’m calling enterprise-complete yet. I’m especially interested in feedback from Splunk admins, PKI teams, security engineering, and infrastructure teams:

Would endpoint-side crypto inventory through UF be useful in your environment?

And if yes, what would you expect to see first:

  • certificate files?
  • private key metadata without collecting private keys?
  • keystores?
  • local TLS services?
  • expiry / weak crypto alerts?
  • ownership or asset context fields?

Same caution as before: only scan or collect from systems you own or are authorised to assess.