Output Features: Split Outputs & Detail Level Control

Overview

The scanner provides two powerful features for controlling output organization and size:

Split Outputs

Break up large scan reports into separate files per dataset type for easier parsing and processing.

• One file per dataset (quantum, network, memory, etc.)
• Maintains complete metadata in each file
• Automatically skips empty datasets
• Works with most output formats

Detail Levels

Control output verbosity to reduce file sizes while maintaining essential security information.

• Full: All fields (current behavior)
• Standard: ~30-40% size reduction
• Minimal: ~60-70% size reduction
• PQC-critical fields always included

Split Outputs Feature

Problem Statement

By default, the scanner outputs all datasets to a single file (e.g., scan_report.json), which can become very large (100MB+) when scanning systems with many certificates, network connections, and running processes. This makes the files:

• Difficult to parse and process
• Slow to load in text editors and analysis tools
• Challenging to integrate with systems expecting specific data types
• Inefficient for streaming analytics (must process entire file)

Solution: Split by Dataset Type

The -split-outputs flag breaks the report into separate files per dataset:

Usage Examples

WINDOWS

# Basic split outputs
.\certscanner-windows-amd64.exe -local -split-outputs -output report.json

# Split outputs + keep consolidated file
.\certscanner-windows-amd64.exe -local -split-outputs -keep-consolidated -output report.json

LINUX

# Basic split outputs
./certscanner-linux-x64 -local -split-outputs -output report.json

# Split outputs + keep consolidated file
./certscanner-linux-x64 -local -split-outputs -keep-consolidated -output report.json

MACOS

# Intel Macs
./certscanner-darwin-amd64 -local -split-outputs -output report.json

# Apple Silicon Macs
./certscanner-darwin-arm64 -local -split-outputs -output report.json

# With consolidated file
./certscanner-darwin-arm64 -local -split-outputs -keep-consolidated -output report.json

Metadata in Split Files

Each split file is self-contained and includes:

• Complete scanning_system_info: hostname, OS, IP addresses, BigFix client ID
• Scan context: scan_type, target, timestamp, tags
• New metadata fields:
  • dataset_type: Identifies which dataset (e.g., "quantum", "network")
  • record_count: Number of records in this file
  • split_mode: true when file is from split output

Detail Levels Feature

Problem Statement

The scanner currently includes ALL fields in output, regardless of their importance or use case. This results in:

• Large file sizes (unnecessary for real-time monitoring)
• Slower ingestion into SIEM and log aggregation systems
• Higher storage costs
• Verbose output for executive dashboards
• Bandwidth constraints in remote scanning scenarios

Solution: Three Detail Levels

The -detail-level flag controls which fields are included in output:

FULL LEVEL (DEFAULT)

Includes: All fields

Size Reduction: 0% (baseline)

Use Cases:

• Forensic analysis
• Deep troubleshooting
• Compliance audits
• Detailed reporting

Command: -detail-level full

STANDARD LEVEL

Removes:

• Raw binary data (PEM, DER, hex)
• Verbose metadata (file permissions, ownership)
• Internal tracking fields (Active, LastSeen)
• Low-level details (memory addresses, kernel versions)
• Statistical data (byte counts, latency)

Keeps: All security-critical fields, PQC flags, crypto parameters

Size Reduction: ~30-40%

Use Cases:

• SIEM integration
• Security monitoring
• Dashboard ingestion
• Regular scanning

Command: -detail-level standard

MINIMAL LEVEL

Includes ONLY:

• System/asset identifiers
• Security status indicators
• PQC assessment flags
• Key crypto parameters
• Critical timestamps
• Security scores and ratings
• Top recommendations (limited)

Size Reduction: ~60-70%

Use Cases:

• Real-time alerting
• Executive dashboards
• Bandwidth-constrained environments
• Streaming analytics
• High-frequency scanning

Command: -detail-level minimal

Field Distribution Statistics

Across all dataset types in the documentation:

Total: 236 fields documented across all dataset types.

Size Reduction Benchmarks

Expected size reductions by dataset type when using Standard and Minimal detail levels:

Combined Usage: Split + Detail Levels

Both features can be used together for maximum flexibility and efficiency.

Example: Real-Time Security Monitoring

WINDOWS

# Maximum efficiency: Split outputs + minimal detail
.\certscanner-windows-amd64.exe -local -split-outputs -detail-level minimal -output report.json

# Result: 8 small files instead of 1 large file
# - report_quantum.json    (2-3 KB instead of 12 KB)
# - report_network.json    (15-50 KB instead of 200 KB)
# - report_memory.json     (1-5 KB instead of 20 KB)
# - report_filesystem.json (1-2 KB per cert)
# - ... etc

LINUX

# Maximum efficiency: Split outputs + minimal detail
./certscanner-linux-x64 -local -split-outputs -detail-level minimal -output report.json

# Result: 8 small files instead of 1 large file
# - report_quantum.json    (2-3 KB instead of 12 KB)
# - report_network.json    (15-50 KB instead of 200 KB)
# - report_memory.json     (1-5 KB instead of 20 KB)
# - report_filesystem.json (1-2 KB per cert)
# - ... etc

MACOS

# Maximum efficiency: Split outputs + minimal detail
./certscanner-darwin-arm64 -local -split-outputs -detail-level minimal -output report.json

# Result: 8 small files instead of 1 large file
# - report_quantum.json    (2-3 KB instead of 12 KB)
# - report_network.json    (15-50 KB instead of 200 KB)
# - report_memory.json     (1-5 KB instead of 20 KB)
# - report_filesystem.json (1-2 KB per cert)
# - ... etc

Benefits:

• Each dataset in its own file (easy parsing)
• ~60-70% size reduction per file
• Fast ingestion into SIEM systems
• Reduced network bandwidth
• Lower storage costs

Example: Comprehensive Audit with Organization

# Split outputs with full detail for forensic analysis
./certscanner -local -split-outputs -detail-level full -output audit_report.json

# Keep consolidated file for compliance
./certscanner -local -split-outputs -keep-consolidated -detail-level full -output audit_report.json

BENEFITS:

• All fields retained (full detail)
• Organized by dataset type (easy to find specific data)
• Optional consolidated file for compliance requirements
• Suitable for deep analysis and troubleshooting

Format and Integration Compatibility

Output Format Support

Integration Platform Support

Use Case Recommendations

Real-Time Security Monitoring

-split-outputs -detail-level minimal

Maximum efficiency for continuous monitoring. Small files, fast processing, essential security data only.

SIEM Integration

-split-outputs -detail-level standard

Organized datasets with all security-relevant fields. Good balance of detail and size.

Compliance Audits

-split-outputs -keep-consolidated -detail-level full

Complete records organized by type. Consolidated file for archival requirements.

Executive Dashboards

-detail-level minimal

Single file with high-level security indicators, scores, and PQC readiness flags.

Forensic Investigation

-split-outputs -detail-level full

All fields retained, organized for analysis. Access raw certificates, memory addresses, full metadata.

Bandwidth-Constrained Remote Scanning

-detail-level minimal

Minimize data transfer. Essential fields only, ~60-70% smaller outputs.

Command-Line Reference

-split-outputs

Type: Boolean flag

Default: false

Description: Enable split output files (one per dataset type)

-keep-consolidated

Type: Boolean flag

Default: false

Requires: -split-outputs

Description: Keep consolidated file when using split outputs (creates both split files AND the main file)

-detail-level <level>

Type: String

Default: full

Valid Values: full, standard, minimal

Description: Control output verbosity (full = 0% reduction, standard = ~30-40% reduction, minimal = ~60-70% reduction)

Output Schema Reference

Please refer to the BigFix Quantum Risk Analyzer online documentation for a complete Output Schema Reference for the following flags: -cipherscanquick -scanfilesystem -scanmemory -scanconnected.