--- title: "Understanding Asset Roles in Balbix" slug: "understanding-asset-roles-in-balbix" updated: 2026-10-22T15:02:28Z published: 2026-10-22T15:02:28Z canonical: "docs.safe.security/understanding-asset-roles-in-balbix" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.safe.security/llms.txt > Use this file to discover all available pages before exploring further. # Understanding Asset Roles in Balbix ## **What Are Asset Roles?** In large enterprises, thousands of assets exist across cloud, data centers, and endpoints. But what are these assets actually *doing*? Are they domain controllers? Web servers? Databases? Balbix helps answer this by automatically identifying the **function** of each asset. This functionality is represented as the asset’s **Role**. An asset can have multiple roles—such as a web server that’s also a domain controller and an LDAP provider. --- ## **Roles vs Tags** Balbix supports two complementary approaches to asset labeling: - **Tags**: Static labels applied manually or imported via connectors (e.g., “Finance-owned”, “EOL”, or “Prod”) - **Roles**: Dynamic labels automatically inferred by Balbix based on asset data Tags are useful for organizational metadata. Roles tell you *what the asset actually does*. --- ## **Why Asset Roles Matter** Roles are a powerful lens into your environment: - **Prioritize Risk**: Assets hosting critical services like LDAP or MSSQL often carry higher breach impact. - **Accelerate Search**: Easily filter for all DNS servers, RDP-enabled hosts, or cloud databases. - **Enable Remediation**: Tailor remediation efforts to functionally similar assets (e.g., patch all WEB-SRVR roles). --- ## How Balbix Infers Roles Roles are inferred through multiple telemetry signals: ### 1. Port & Protocol Patterns If a server exposes specific combinations of ports (like 88, 135, 389, 445, and 3268), Balbix may infer it’s a DC (Domain Controller). ### 2. Installed Software Running MySQL? Role is MySQL. Hosting Apache? That’s likely a WEB-SRVR. The software stack provides strong evidence. ### 3. Cloud & Connector Metadata Balbix uses cloud-native labels and data sources to assign specific service roles: - AWS EC2 instances → AWS-EC2 - Azure Functions → Azure-Function ### 4. Tags and User Input Even static tags from external systems can influence role inference. --- ## **Examples of Asset Roles** Here’s how roles might appear in the Balbix UI: | Hostname | Roles | | --- | --- | | host123.corp | DC, LDAP, WEB-SRVR, MSSQL | | i-0abcd1234 | AWS-EC2, RDP, DHCP | | pod-xyz.gcp | GCP-CloudRun, HTTP, SSH | Assets can have **multiple roles** depending on their behavior and telemetry. --- ## **Supported Role Catalog** Balbix supports a broad set of **roles** including: - Infrastructure: LDAP, DNS, RDP, FTP, SSH - App servers: WEB-SRVR, Apache, Tomcat, IIS - Databases: MSSQL, MySQL, Oracle, RDBMS, AWS-RDS - Cloud services: AWS-EC2, Azure-VM, GCP-CloudFunction - Protocols: IMAP, POP3, SMTPS, SOCKS The full list includes detection indicators (Ports, Software, OS, Cloud metadata) and whether each role impacts breach impact calculations. --- ## **Asset Roles and Breach Impact** Some roles, like domain controllers or database servers, have **elevated breach impact** by design. For example: - DC, LDAP, and MSSQL → high-value targets in lateral movement - WEB-SRVR → often internet-facing and vulnerable - SSH or VPN roles → linked to remote access paths These roles directly feed into Balbix’s risk models to calculate and prioritize exposure. --- ## **How Roles Influence Risk Scores in Balbix** Asset roles play a central part in Balbix’s dynamic risk calculations. Specifically: ### 1. Breach Impact Modulation Roles associated with identity services, critical data storage, or external exposure directly elevate breach impact scores. For example: | Role | Breach Impact Justification | | --- | --- | | DC, LDAP | Control identity and authentication domain-wide | | MSSQL, RDBMS | Contain sensitive/confidential data | | WEB-SRVR | Typically exposed externally; can be exploited remotely | | VPN, SSH | Enable remote access; often linked to privilege escalation | ### 2. Exploitability Signal Amplification Balbix uses roles to shape the *likelihood of exploit* for certain exposures: - A WEB-SRVR with missing patches and public exposure is considered higher risk. - A RDP-enabled server in an internal zone with weak segmentation may be treated as a lateral movement risk. ### 3. Telemetric Weighting In Balbix’s asset scoring model, certain telemetry components carry different weight depending on the asset type and role. For instance: - The “Role” component may be weighted more heavily for SERVER or DATABASE assets with high-impact functions. These calculations allow security teams to focus efforts on the most consequential exposures based on both asset function and context. --- ## **Asset Roles in the Balbix UI** Roles aren’t just metadata—they’re deeply integrated into the Balbix UI to help users filter, investigate, and act on assets more efficiently. ### 1. Faceted Filtering Across Views In dashboards like Asset Inventory, Exposure Management, and Cyber Risk Summary, you can filter assets by role. This allows Balbix users to answer targeted questions like: - “Show me all assets with the LDAP or DC role.” - “How many exposed RDP assets are internet-facing?” - “Which MySQL servers are unpatched?” This helps analysts reduce noise and zero in on high-priority clusters. ### 2. Risk Aggregation by Function Roles enable risk heatmaps and summaries to group by function, not just asset type or location. For example: - See all WEB-SRVR roles aggregated across on-prem and cloud. - View total risk exposure from all VPN or SSH assets. This allows CISOs and security leads to report and strategize by business service area. ### 3. Contextual Asset Drilldowns On any asset details page, the assigned roles help provide immediate functional context: - A server labeled DC, LDAP, DNS signals it’s a key identity service. - An instance with WEB-SRVR, RDP suggests it’s publicly accessible and interactive. This helps with triage and prioritization during investigations. ### 4. Remediation & Campaign Targeting Security teams often use asset roles to scope patching and hardening campaigns: - “All MSSQL servers missing KB5021127.” - “Every WEB-SRVR with critical vulns and no EDR coverage.” Roles give operational teams an efficient way to group and act on similar assets. ### 5. Dashboard Summaries & Visualizations In executive dashboards, role groupings can highlight trends like: - Growth in cloud-hosted RDBMS roles over time - Decrease in high-risk RDP asset counts due to segmentation This supports data-driven storytelling for leadership and board reporting. --- ## **Summary** Asset Roles in Balbix provide dynamic, telemetry-driven context to every asset. By understanding not just what an asset *is*, but *what it does*, security teams can: - Focus on the most critical assets - Accelerate investigations - Drive targeted, risk-based remediation Roles turn your asset inventory into an actionable, function-aware map of your enterprise.