---
title: "Control-type-subtype"
slug: "control-type-subtype"
updated: 2026-10-22T15:02:28Z
published: 2026-10-22T15:02:28Z
canonical: "docs.safe.security/control-type-subtype"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.safe.security/llms.txt
> Use this file to discover all available pages before exploring further.

# Control Type/Subtype Population in the Controls Validation Summary

### 

#### **Overview**

The **Type** and **Subtype** fields displayed in the *Controls Validation Summary* dashboard are metadata classifications automatically assigned by Balbix. These values do **not** come from the CIS Benchmarks themselves. Instead, they are derived from Balbix’s **internal Control Knowledge Base (KB)**, which maintains a hierarchical mapping between CIS recommendations and control categories.

#### **How It Works**

When Balbix ingests control findings, the pipeline performs three steps:

1. **Sanitization:** The benchmark name, version, and recommendation IDs from the incoming data are parsed and normalized. This ensures that small variations in naming (e.g., extra punctuation, whitespace, or version formatting differences) do not prevent mapping.
2. **Matching:** The sanitized benchmark metadata is matched against Balbix’s internal KB, which is periodically synchronized with the **CIS WorkBench API**.
  - If a match is found, Balbix assigns the appropriate **Type** and **Subtype** values (for example, *Database Services / SQL Server – Microsoft Defender*).
  - If no match is found, Balbix defaults to **“Other / Other.”**
3. **Enrichment:** Once matched, the controls are enriched with their hierarchical classification (Type/Subtype) and displayed in the *Controls Validation Summary* and *Assets* views.

#### **Why Some Controls Show “Other / Other”**

When a benchmark’s name or structure differs from the expected canonical form, the **sanitization process** fails to align it with the KB entry. This causes the mapping to fall back to the generic “Other / Other” classification, even though the underlying benchmark data (recommendation IDs) may be valid.