Data sources are divided into two categories: connectors, and sensors.
There are 2 types of connectors: API-based connectors, and file-based connectors.
There are 4 types of sensors: traffic analyzer (TA), network analyzer (NA), host analyzer (HA), and SNMP analyzer.
Connectors
API-based connectors are automated integration mechanisms that retrieve data from a variety of external platforms and tools commonly used in enterprise environments. These may include endpoint detection and response (EDR) systems, cloud infrastructure providers, vulnerability management (VM) scanners, Internet of Things (IoT) management platforms, IT asset management (ITAM) systems, and many others. The connectors interact with these systems through their exposed APIs, allowing Balbix to continuously ingest structured data without manual intervention.
File-based connectors provide a flexible alternative for data ingestion when automated API access is not feasible or available. In this approach, users extract data from external tools or systems in a supported file format and can manually upload it to Balbix, or use scripting to send files to a configured Balbix S3 bucket; Balbix will automatically detect the new file, then load and process the data. This allows the platform to process and integrate external data even in cases where systems lack API connectivity, are air-gapped, or involve legacy infrastructure.
Here you can see the full Connectors List.
Sensors
The Traffic Analyzer (TA) is a physical appliance that dynamically inspects and evaluates network traffic that passes through a network switch connected to TA appliance. The TA provides continuous monitoring of both managed and unmanaged assets as they communicate with other assets on both the intranet and internet. The data collected by the TA is automatically scrubbed and summarized, then sent to the Balbix Brain.
The TA monitors your network traffic in real time to identify breach risks such as unsafe browsing behavior, phishing risk, potential man-in-the-middle attacks, and access to sensitive networks and services. The TA connects to the SPAN port on the network switch, thereby providing comprehensive network visibility without any disruption to the production environment.
The Network Analyzer (NA) is a lightweight, proactive asset and service discovery engine. The Network Analyzer provides a continuous, real-time comprehensive inventory of your entire environment. Balbix technology leverages sequence-to-sequence deep learning to properly identify all assets above and beyond traditional port scanning. It performs a comprehensive inventory of all assets within range, including servers, desktop/laptops, managed and unmanaged (BYOD), devices, applications, users, IoT devices, and mobile assets.
The Host Analyzer (HA) is end point software that gathers detailed real-time information related to installed software, configurations, logged in users and passively observes incoming and outgoing network traffic. The HA also gathers information from logs such as windows active directory, RDP sessions, SSH sessions, http server access etc. HA software can be installed on desktops/laptops and servers and accommodates Windows, OSX, Centos and RedHat Linux Operating Systems.
The SNMP Analyzer is a sensor module that collects device and network metadata using the Simple Network Management Protocol (SNMP). It queries SNMP-enabled devices to gather structured information about their configuration, operational status, interfaces, and performance metrics.
The Balbix Data Aggregator (DA) is a software module that can be deployed in customer environments to communicate and collect data from local data sources that are otherwise not reachable from the Balbix cloud- based service. For example, the DA can collect data via APIs from other on-prem services (e.g., Nozomi Networks, Rapid7 Nexpose, Tenable Security Center) and securely transmit it to the Balbix Cloud.
See Also: