Vulnerabilities with Multiple CVEs in the Name Field
The Balbix Flex Connector supports the ingestion of vulnerability data via CSV uploads from various security tools. In some feeds, a single vulnerability record may reference multiple CVEs within the Name field, typically as a comma-separated list (for example: CVE-2023-1234, CVE-2023-5678).
This article explains how Balbix identifies, parses, and processes vulnerabilities that contain multiple CVEs in the Name field, ensuring accurate exposure modeling, scoring, and remediation tracking.
CVE Identification in the Name Field
When vulnerability data is ingested, Balbix evaluates the Name field to detect valid CVE identifiers.
CVEs are identified using standard CVE formats (for example, CVE-YYYY-NNNN)
If multiple CVEs are detected in a single Name value, Balbix treats them as distinct identifiers
Automatic CVE Breakout
If the Name field contains multiple CVEs separated by commas, Balbix automatically performs the following actions:
Each CVE is split into an individual vulnerability record
All derived records inherit the same contextual metadata, including:
Associated asset
Detection source
Severity and scoring inputs
Affected software details (when provided)
This ensures each CVE is independently tracked, scored, and prioritized within Balbix.
Example: Multiple CVEs in a Single Name Field
Input (from CSV or scanner feed):
Name: CVE-2023-24521, CVE-2023-24522
Severity: High
Asset: app-server-01
Result in Balbix:
Vulnerability 1: CVE-2023-24521
Vulnerability 2: CVE-2023-24522
Each CVE appears as a separate exposure instance, enabling accurate risk evaluation and remediation tracking.
Non-CVE Vulnerability Ingestion
Balbix Flex Connector supports the ingestion of non-CVE–based vulnerabilities via CSV uploads from various security tools. These vulnerabilities may not have an associated CVE identifier and instead rely on vulnerability titles, names, or descriptions provided by the source system.
This article explains how non-CVE vulnerabilities are ingested, represented in the UI, and protected from being dropped during processing.
Data Ingestion Requirements
For a non-CVE vulnerability to be successfully ingested and retained in Balbix, at least one of the following must be present:
Vulnerability Name
Vulnerability Description
Vulnerability Name
Balbix determines the vulnerability name using the following logic:
Mapped Name (Highest Priority): If a vulnerability name is explicitly mapped and present, it is displayed as-is in the UI.
Name Inference (Fallback)
If the mapped name is empty, Balbix attempts to infer the name from the vulnerability details object.
The system searches for the following keys (case-insensitive), in priority order:
title
name
enum
vuln_enum
No Name Available: If no name can be determined after inference, the UI displays “-” as the vulnerability name.
Vulnerability Description
The Description field always displays the mapped description value
No inference or AI parsing is applied to the description
The description plays a critical role in ensuring the vulnerability record is retained during ingestion
Sample Connector Configuration File
This sample configuration illustrates how non-CVE vulnerability names are ingested from the Title column. The Title field is mapped to Vulnerability Details (vuln_details), after which Balbix infers the vulnerability name by parsing the details object and identifying the title key when a CVE value is not present.
{"balbixField":"vuln_details","importedField":"Title","oneHotEncoded":false,"prefix":null,"suffix":null}