Balbix automatically manages the lifecycle of assets and their associated data across multiple sources. This article explains how asset retirement (removal of full asset records) and data retirement (removal of asset-specific attributes) are handled.
1. Overview
Assets in Balbix may be ingested from multiple sources, including connectors and sensors.
Retirement occurs when an asset or its attributes are no longer reported by any active source.
Rules differ slightly by data source type: API connectors, snapshot connectors, and sensors.
Important: Once an asset is retired, it is not “resuscitated.” Any prior observations (e.g., vulnerabilities, tags) remain permanently retired. If the asset reappears later, it is treated as a new record without historical data.
2. General Retirement Rules
Data retirement: Attributes are retired if the source that contributed them stops reporting the asset. Attributes from other sources remain.
Connector deletion: Removing a connector forces full immediate retirement of all assets and attributes sourced solely from it.
3. Source-Specific Behavior
3.1 API Connectors
At each ingestion (whether scheduled or manually triggered), the current asset list is compared to the previous one.
If an asset is missing and no other connector reports it, the asset is retired immediately.
If only certain attributes are missing, only those attributes are retired.
Last Seen filter: Each API connector can be configured with an “Asset last seen days filter” (default: 30 days). This filter limits which records are ingested to only those assets last seen by the data source within the configured period. Note that if a connector ingestion reports no record for an asset, this filter period does not delay retirement of that asset.
The network-level retirement window does not apply to data sourced from API connectors.
3.2 Snapshot Connectors
Missing assets are not retired when a new snapshot is ingested.
Attributes from past snapshots remain until connector deletion.
Deleting a snapshot connector retires all related assets and attributes.
The network-level retirement window does not apply to data sourced from snapshot connectors.
3.3 Sensors
Assets and asset-related attributes only observed by Balbix sensors are retired if not seen within the network-level retirement period.
Note: the network-level retirement period is set to 30 days by default, though is configurable. Please contact your Customer Success team to configure changes to the default retirement period.
4. Edge Cases & Special Logic
Zero-asset connector ingestion
If a connector sync succeeds but returns zero assets, Balbix treats this as an error to prevent unintended mass retirements.
Interaction of “Last Seen” and Retirement
Last Seen filter: Controls which records are ingested (e.g., “only assets seen by the data source in the last 30 days”).
Retirement: Will proceed immediately if the conditions outlined earlier are met, regardless of Last Seen filter settings. For example, if an asset sourced only from a single API connector is missing from the latest ingestion, it will be immediately retired.
5. Summary Table
Data Source Type | Retirement Trigger | Process & Timing |
|---|---|---|
API Connector | Asset missing in latest ingest and not reported elsewhere | Asset is retired immediately |
Asset missing in latest ingest but reported by another connector | Only this connector’s data is retired immediately | |
Connector deleted | All assets and data sourced solely from this connector are retired immediately | |
Snapshot Connector | Asset missing in latest ingest and not reported elsewhere | Asset is not retired, attributes remain |
Asset missing in latest ingest but reported by another connector | Asset is not retired, attributes remain | |
Connector deleted | All assets and data sourced solely from this connector are retired immediately | |
Sensor | Asset not observed within inactivity window (default 30 days, configurable) | Asset is retired after window expires |
Asset not observed by sensor, but observed elsewhere | Only this sensor’s data is retired after window expires | |
Sensor removed | All assets and data from this sensor are retired after window expires |
6. Best Practices
Use multiple connectors for critical assets (e.g., cloud + endpoint) to avoid premature retirement if one source fails.
Review and configure Last Seen filter windows appropriately for each connector to minimize staleness while ensuring sufficient robustness for missed detections, considering the scan frequency of the data source.
Monitor connector health to ensure consistent ingestion.
Use Inventory > BX5 Asset Analysis > Recently Retired Assets to review assets retired within the last 7 days.
See Also: