Documentation Index

Fetch the complete documentation index at: https://docs.safe.security/llms.txt

Use this file to discover all available pages before exploring further.

Balbix Asset Retirement Policy

Prev Next

Balbix automatically manages the lifecycle of assets and their associated data across multiple sources. This article explains how asset retirement (removal of full asset records) and data retirement (removal of asset-specific attributes) are handled.

1. Overview

  • Assets in Balbix may be ingested from multiple sources, including connectors and sensors.

  • Retirement occurs when an asset or its attributes are no longer reported by any active source.

  • Rules differ slightly by data source type: API connectors, snapshot connectors, and sensors.

    Important: Once an asset is retired, it is not “resuscitated.” Any prior observations (e.g., vulnerabilities, tags) remain permanently retired. If the asset reappears later, it is treated as a new record without historical data.

2. General Retirement Rules

  • Data retirement: Attributes are retired if the source that contributed them stops reporting the asset. Attributes from other sources remain.

  • Connector deletion: Removing a connector forces full immediate retirement of all assets and attributes sourced solely from it.

3. Source-Specific Behavior

3.1 API Connectors

  • At each ingestion (whether scheduled or manually triggered), the current asset list is compared to the previous one.

  • If an asset is missing and no other connector reports it, the asset is retired immediately.

  • If only certain attributes are missing, only those attributes are retired.

  • Last Seen filter: Each API connector can be configured with an “Asset last seen days filter” (default: 30 days). This filter limits which records are ingested to only those assets last seen by the data source within the configured period. Note that if a connector ingestion reports no record for an asset, this filter period does not delay retirement of that asset.

The network-level retirement window does not apply to data sourced from API connectors.

3.2 Snapshot Connectors

  • Missing assets are not retired when a new snapshot is ingested.

  • Attributes from past snapshots remain until connector deletion.

Deleting a snapshot connector retires all related assets and attributes.

The network-level retirement window does not apply to data sourced from snapshot connectors.

3.3 Sensors

  • Assets and asset-related attributes only observed by Balbix sensors are retired if not seen within the network-level retirement period.

  • Note: the network-level retirement period is set to 30 days by default, though is configurable. Please contact your Customer Success team to configure changes to the default retirement period.

4. Edge Cases & Special Logic

Zero-asset connector ingestion

  • If a connector sync succeeds but returns zero assets, Balbix treats this as an error to prevent unintended mass retirements.

Interaction of “Last Seen” and Retirement

  • Last Seen filter: Controls which records are ingested (e.g., “only assets seen by the data source in the last 30 days”).

  • Retirement: Will proceed immediately if the conditions outlined earlier are met, regardless of Last Seen filter settings. For example, if an asset sourced only from a single API connector is missing from the latest ingestion, it will be immediately retired.

5. Summary Table

Data Source Type

Retirement Trigger

Process & Timing

API Connector

Asset missing in latest ingest and not reported elsewhere

Asset is retired immediately

Asset missing in latest ingest but reported by another connector

Only this connector’s data is retired immediately

Connector deleted

All assets and data sourced solely from this connector are retired immediately

Snapshot Connector

Asset missing in latest ingest and not reported elsewhere

Asset is not retired, attributes remain

Asset missing in latest ingest but reported by another connector

Asset is not retired, attributes remain

Connector deleted

All assets and data sourced solely from this connector are retired immediately

Sensor

Asset not observed within inactivity window (default 30 days, configurable)

Asset is retired after window expires

Asset not observed by sensor, but observed elsewhere

Only this sensor’s data is retired after window expires

Sensor removed

All assets and data from this sensor are retired after window expires

6. Best Practices

  • Use multiple connectors for critical assets (e.g., cloud + endpoint) to avoid premature retirement if one source fails.

  • Review and configure Last Seen filter windows appropriately for each connector to minimize staleness while ensuring sufficient robustness for missed detections, considering the scan frequency of the data source.

  • Monitor connector health to ensure consistent ingestion.

  • Use Inventory > BX5 Asset Analysis > Recently Retired Assets to review assets retired within the last 7 days.

See Also:

Data Sources: Connectors

Data Sources: Sensors

BX5 Asset Analysis