Asset Telemetry Score

Overview

The Asset Telemetry Score measures the completeness of information available for an asset. It is computed over a collection of telemetry attributes. Each telemetry attribute is a boolean (true/false) indicating whether the relevant information is present. These booleans are then converted into a weighted point value based on the asset's type.

Asset Telemetry Score - Input Attributes

Asset Type

Whether the Asset Type is known (boolean).

Notes

• Valid Asset Categories include Server, Container, Serverless, Networking, Storage, IoT Asset, OT Asset, Medical Device, Cloud Security Infrastructure, End User Compute, Handheld, Database, Multimedia, AV/VoIP, Printer/Fax/Scanner, Cloud Account, Cloud Infrastructure, Embedded Asset.

• If the Asset Type is Unexamined/Poor Visibility, this attribute is false.

Asset Subtype

Whether the Asset Subtype is known. Each Asset Type has valid subtypes.

For example:

• Server: Physical Server, On-Prem Virtual Machine, Cloud Virtual Machine

• Container: Image, Instance, Registry, Workload

• End-User Compute: VDI, Cloud VDI, Physical Workstation

• Networking Asset: Router/Switch, Access Point, Firewall, VPN, CDN, WAF

• Database: In-Memory Data Store, Document Data Storage, RDBMS, Search Engine

If the subtype is not set or defaults to "Other", this value is false. This attribute measures the specificity of asset inventory data.

Software Vulnerabilities

Whether there is evidence of software vulnerability assessment on the asset (boolean). This applies only to software vulnerabilities (CVEs), not misconfigurations, EOL, or other exposure types.

The attribute is true if either:

1. There exists both software AND vulnerabilities on the asset, OR

2. There exists software, and the asset is fully patched (no vulnerabilities)

Coverage Level Assessment

Software Vulnerability coverage involves inferring telemetry quality from the connectors used to ingest data. For each asset, each connector is assessed for whether software and vulnerability coverage is FULL, PARTIAL, or MISSING, based on data source metadata. The maximum coverage level across all connectors is used for this determination.

Coverage determination logic

• If the software coverage level is FULL or PARTIAL, AND there are Balbix-inferred vulnerabilities > true

• If the vulnerability coverage level is FULL (even without vulnerabilities) > true

• If the vulnerability coverage level is PARTIAL, AND there are fewer than 5 vulnerabilities > false

• All other cases > false

Example: An asset has data from two connectors:

• CrowdStrike Falcon: coverage: {SW: "FULL", VULN: "FULL", CONTROLS: "MISSING"}

• Balbix HA (Host Analyzer): No explicit coverage defined

The system evaluates each connector and takes the maximum:

• SW coverage: max(FULL, FULL*) = FULL

• VULN coverage: max(FULL, MISSING*) = FULL

*HA defaults explained below:

Since VULN coverage is FULL, the Software Vulnerabilities attribute is true.

HA (Host Analyzer) Default Coverage

When a Balbix Host Analyzer (HA) is the data source and no explicit coverage is provided, the following defaults are applied:

• Software (SW): FULL — The HA can enumerate installed software comprehensively

• Vulnerability (VULN): MISSING — The HA does not perform direct vulnerability scanning; Balbix infers vulnerabilities from the software inventory

• Controls: FULL — The HA can assess CIS benchmark controls

The VULN coverage defaults to MISSING because the HA itself does not directly scan for vulnerabilities. Instead, Balbix infers vulnerabilities based on the software inventory. If Balbix-inferred vulnerabilities exist (balbix_vuln_count > 0), credit is given.

EDR

Whether there is any EDR (Endpoint Detection and Response) software present on the asset (boolean).

EDR presence is detected via:

• Software inventory — Security products with mitigation discovery metadata in the software list

• Coverage from an EDR API integration — Connectors like CrowdStrike Falcon, Carbon Black, etc.

Note

EDR telemetry is only expected on certain asset types: End-User Compute and Server. For other asset types, EDR count is set to 0.

Control

Whether hardening configuration controls are enabled on the asset (boolean).

Note

• HA (Host Analyzer) only assesses CIS Benchmarks for certain supported Windows and Linux operating systems, not macOS.

• The supported operating systems assessed by the HA are listed here.

Coverage Level Assessment

For each asset, each connector is assessed for control coverage: FULL, PARTIAL, or MISSING, based on data source metadata. If an HA is used without explicit coverage, control coverage defaults to FULL.

The Control attribute is true if:

Control coverage level is FULL, AND

There are sufficient controls present:

• 5+ controls for End-User Compute, Server, or Container assets

• 1+ control for all other asset types

Example:

An asset of type Server has data from:

• Balbix HA: No explicit coverage (defaults to CONTROLS: FULL)

• Tenable: coverage: {CONTROLS: "PARTIAL"}

The system takes max(FULL, PARTIAL) = FULL.

If the asset has 7 CIS controls in "Passed" or "Failed" state, the Control attribute is true (FULL coverage + 7 ≥ 5 controls).

Zone

Whether the Zone of the asset is known (boolean).

In the current implementation, this is always true because the Zone defaults to either Internal or Internet-Facing.

Valid Zones:

• Internal — Assets not directly accessible from the internet

• Internet-Facing — Assets accessible from the internet

How is Zone determined?

• Automatic inference — Balbix infers Zone based on asset type, tags, and roles

• Tag Manager mapping — Users can configure the Zone directly via asset tags by setting up a mapping in Tag Manager

Role-based inference

• Assets with roles like WEB-SRVR, Internet-Facing Server, or cloud-exposed services typically map to Internet-Facing

• Internal servers, workstations, and infrastructure typically map to Internal

Subzone

Whether the Subzone of the asset is known (boolean).

Valid Subzones:

• DMZ — Demilitarized zone, typically for internet-facing assets with additional segmentation

• EUC — End-User Compute segmented network

• Air-Gapped — Isolated network with no external connectivity

• Other — Default when no specific subzone is identified

In the current implementation, this is almost always false unless the asset is in the DMZ or Air-Gapped. Subzone defaults to Other when not explicitly set.

How is Subzone determined?

1. Automatic inference — Balbix infers Subzone based on asset type, tags, and roles

2. Tag Manager mapping — Users can configure both Zone and Subzone directly via asset tags by setting up a mapping in Tag Manager

Business Tag

Whether there are tags on the asset indicating business context (boolean).

In the current implementation, this is always false because business tag detection has not yet been implemented.

Owner

Whether the owner of the asset is known (boolean).

This attribute is true if any of the following owner types are present:

• Application Owner

• Business Owner

• IT Owner

• VM Owner

• Primary User

• Device Owner

• Asset Owner

The owner value must not be "Unknown" or empty.

Role

Whether the asset has a known role in the enterprise (boolean).

How is the role determined?

Roles are derived from tagging rules applied during asset categorization. The system examines:

• The asset's categorized type and subtype

• Inferred roles from services detected (e.g., DNS, DHCP, DC, WEB-SRVR)

• Cloud-specific roles (e.g., AWS-EC2, Azure-Compute, GCP-GKE)

This attribute is true if Balbix has determined an asset type AND, if it is a Server, an additional role (e.g., DNS Server, Web Server, Domain Controller).

Note

Role penalties only apply for Servers — if a Server has only a single generic "Server" role with no additional service roles, this attribute is false.

Backup

Whether a backup of this asset exists (boolean).

In the current implementation, this is always false because backup detection has not yet been implemented.

Site

Whether the asset's location is known (boolean).

This is true if the asset has a site name other than "Unknown".

Location

Whether the asset's geolocation is known (boolean).

Any level of detail is sufficient: Continent, Country, State, or City. The value must not be "Unknown".

SBOM

Whether a Software Bill of Materials exists for this asset (boolean). A software inventory is sufficient.

Coverage Level Assessment

For each asset, each connector is assessed for whether software coverage is FULL, PARTIAL, or MISSING, based on data source metadata. The maximum coverage level across all connectors is used.

The SBOM attribute is true if:

• Software coverage level is FULL, AND

• There are at least 20 software packages present on the asset

Example:

An asset has data from:

• CrowdStrike Falcon: coverage: {SW: "FULL"}

• SCCM: coverage: {SW: "PARTIAL"}

The system takes max(FULL, PARTIAL) = FULL.

If the asset has 35 software packages in its inventory, the SBOM attribute is true (FULL coverage + 35 ≥ 20 packages).

If the asset only has 12 software packages, the SBOM attribute is false even with FULL coverage.

Telemetry Score Computation

Each of these booleans is converted to a set number of points based on the asset category. The logic behind this is that each asset category may have some telemetry types that are irrelevant, and others that are much more important (for example, the absence of SBOM information might be expected on a Printer, but not a Server).

Telemetry Weights by Asset Type

Note

EDR and SBOM weights are 0 for asset types where these telemetry sources are not expected (e.g., Printers, IoT devices).

Telemetry Score - The sum of all of the points as a result of the booleans above. This value is at max 92, out of a possible 100.

The logic behind the imperfect max is that, even with most information available, there is no guarantee of full observability. In particular, the lack of information needs to be accounted for in scoring, to compute exposure and risk due to Zero-Day vulnerabilities.