Understanding Asset Timestamps

Balbix ingests and analyzes asset data from multiple connectors (data sources). To improve clarity and transparency around asset visibility and synchronization activity, Balbix provides several key timestamp fields in the user interface.

This document explains the meaning and derivation of each timestamp field as seen in both the per-data source view and the aggregated asset view.

Per-Data Source Table View

Each row corresponds to a specific connector and includes the following fields:

Field	Description
Data Source	The specific connector or tool providing data (e.g., Host Analyzer, Cortex, ServiceNow CMDB).
Type	The category of the connector (e.g., Traffic Analyzer, Host Analyzer, CMDB).
First Sync Date	The date when this data source first reported the asset to Balbix. Derived from first_seen.
Last Sync Date	The most recent date when this data source sent data about the asset. Derived from last_seen.
Last Seen	The latest time this data source directly observed the asset. Derived from source_last_seen.

These timestamps are independently tracked for each data source that provides asset telemetry.

Per-Data Source View Table

Aggregated Asset View

In the asset details view, Balbix also displays a summary across all sources:

Field	Description
Last Seen	The latest source_last_seen timestamp across all active connectors. Represents the most recent observation of the asset.
Last Analysis	The timestamp when Balbix last completed analysis of the asset for vulnerabilities, exposure, and risk.
Data Sources	A list of all connectors that are currently reporting data about the asset.

Aggregated Asset View with Timestamps and Data Sources

Mapping to JSON Fields

The timestamps are derived from the JSON structure as follows:

{

"first_seen": "→ First Sync Date",

"last_seen": "→ Last Sync Date (ETL ingestion)",

"source_last_seen": "→ Last Seen (as seen by the connector)"

}

In the aggregated view, Balbix computes:

Last Seen = max(source_last_seen across all connectors)
Last Analysis = timestamp of the most recent Balbix risk analysis run

UI/UX Tooltip Help Text

These are the recommended descriptions to be used as tooltips or inline help text in the product interface:

Per-Data Source View

First Sync Date:
"Indicates when this specific connector first successfully ingested asset data into the Balbix platform."
Last Sync Date:
"Shows the most recent time Balbix ingested this asset data from the connector."
Last Seen:
"Represents the last observed timestamp when this connector detected the asset within its native telemetry or scan data."

Aggregated View

Last Seen:
"Reflects the most recent observation timestamp of the asset across all connected data sources."
Last Analysis:
"Marks the time when Balbix completed its most recent analysis of this asset for vulnerabilities, exposure levels, and associated risk."

See Also:
Understanding First Seen and Last Seen