Control Type/Subtype Population in the Controls Validation Summary

Overview

The Type and Subtype fields displayed in the Controls Validation Summary dashboard are metadata classifications automatically assigned by Balbix. These values do not come from the CIS Benchmarks themselves. Instead, they are derived from Balbix’s internal Control Knowledge Base (KB), which maintains a hierarchical mapping between CIS recommendations and control categories.

How It Works

When Balbix ingests control findings, the pipeline performs three steps:

1. Sanitization:
   The benchmark name, version, and recommendation IDs from the incoming data are parsed and normalized. This ensures that small variations in naming (e.g., extra punctuation, whitespace, or version formatting differences) do not prevent mapping.

2. Matching:
   The sanitized benchmark metadata is matched against Balbix’s internal KB, which is periodically synchronized with the CIS WorkBench API.

   • If a match is found, Balbix assigns the appropriate Type and Subtype values (for example, Database Services / SQL Server – Microsoft Defender).

   • If no match is found, Balbix defaults to “Other / Other.”

3. Enrichment:
   Once matched, the controls are enriched with their hierarchical classification (Type/Subtype) and displayed in the Controls Validation Summary and Assets views.

Why Some Controls Show “Other / Other”

When a benchmark’s name or structure differs from the expected canonical form, the sanitization process fails to align it with the KB entry. This causes the mapping to fall back to the generic “Other / Other” classification, even though the underlying benchmark data (recommendation IDs) may be valid.