---
title: "Ingesting Vulnerability Data with the Flex Connector"
slug: "ingesting-vulnerability-data-with-flex-connector"
updated: 2026-10-22T15:02:28Z
published: 2026-10-22T15:02:28Z
canonical: "docs.safe.security/ingesting-vulnerability-data-with-flex-connector"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.safe.security/llms.txt
> Use this file to discover all available pages before exploring further.

# Ingesting Vulnerability Data with the Flex Connector

## Vulnerabilities with Multiple CVEs in the Name Field

The Balbix Flex Connector supports the ingestion of vulnerability data via CSV uploads from various security tools. In some feeds, a single vulnerability record may reference multiple CVEs within the Name field, typically as a comma-separated list (for example: CVE-2023-1234, CVE-2023-5678).

This article explains how Balbix identifies, parses, and processes vulnerabilities that contain multiple CVEs in the Name field, ensuring accurate exposure modeling, scoring, and remediation tracking.

#### CVE Identification in the Name Field

When vulnerability data is ingested, Balbix evaluates the Name field to detect valid CVE identifiers.

- CVEs are identified using standard CVE formats (for example, CVE-YYYY-NNNN)
- If multiple CVEs are detected in a single Name value, Balbix treats them as distinct identifiers

#### Automatic CVE Breakout

If the Name field contains multiple CVEs separated by commas, Balbix automatically performs the following actions:

- Each CVE is split into an individual vulnerability record
- All derived records inherit the same contextual metadata, including:
  - Associated asset
  - Detection source
  - Severity and scoring inputs
  - Affected software details (when provided)

This ensures each CVE is independently tracked, scored, and prioritized within Balbix.

#### Example: Multiple CVEs in a Single Name Field

**Input (from CSV or scanner feed):**

- Name: CVE-2023-24521, CVE-2023-24522
- Severity: High
- Asset: app-server-01

**Result in Balbix:**

- Vulnerability 1: CVE-2023-24521
- Vulnerability 2: CVE-2023-24522

Each CVE appears as a separate exposure instance, enabling accurate risk evaluation and remediation tracking.

## Non-CVE Vulnerability Ingestion

Balbix Flex Connector supports the ingestion of non-CVE–based vulnerabilities via CSV uploads from various security tools. These vulnerabilities may not have an associated CVE identifier and instead rely on vulnerability titles, names, or descriptions provided by the source system.

This article explains how non-CVE vulnerabilities are ingested, represented in the UI, and protected from being dropped during processing.

### Data Ingestion Requirements

For a non-CVE vulnerability to be successfully ingested and retained in Balbix, at least one of the following must be present:

- Vulnerability Name
- Vulnerability Description

### Vulnerability Name

Balbix determines the vulnerability name using the following logic:

- Mapped Name (Highest Priority): If a vulnerability name is explicitly mapped and present, it is displayed as-is in the UI.
- Name Inference (Fallback)
  - If the mapped name is empty, Balbix attempts to infer the name from the vulnerability details object.
  - The system searches for the following keys (case-insensitive), in priority order:
    - title
    - name
    - enum
    - vuln_enum
- No Name Available: If no name can be determined after inference, the UI displays “-” as the vulnerability name.

### Vulnerability Description

- The Description field always displays the mapped description value
- No inference or AI parsing is applied to the description
- The description plays a critical role in ensuring the vulnerability record is retained during ingestion

## Sample Connector Configuration File

This sample configuration illustrates how non-CVE vulnerability names are ingested from the Title column. The Title field is mapped to Vulnerability Details (vuln_details), after which Balbix infers the vulnerability name by parsing the details object and identifying the title key when a CVE value is not present.

```json
{"balbixField":"vuln_details","importedField":"Title","oneHotEncoded":false,"prefix":null,"suffix":null}
```

[](https://cdn.document360.io/23dc20b8-a989-48c0-8653-f1d3e4abc734/Images/Documentation/config(1).json)config2.13 KB[](https://cdn.document360.io/23dc20b8-a989-48c0-8653-f1d3e4abc734/Images/Documentation/config(1).json)