--- title: "Vulnerability Inference" slug: "vulnerability-inference-1" updated: 2026-10-22T15:02:28Z published: 2026-10-22T15:02:28Z canonical: "docs.safe.security/vulnerability-inference-1" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.safe.security/llms.txt > Use this file to discover all available pages before exploring further. # Vulnerability Inference ### **High level summary** The Vulnerability Inference system provides a comprehensive mechanism for accurately identifying and managing vulnerabilities (CVEs) that affect software components. It ensures precise vulnerability attribution while eliminating false positives through a multi-stage processing pipeline that handles vulnerability identification, validation, and state management. The Balbix AI system processes vulnerability data through a sequential pipeline, handling CVE mapping, identity management, relationship tracking, data consolidation, quality control, and state processing. The pipeline is designed to maintain data accuracy while supporting different configuration items that can modify processing behavior based on specific needs. --- ### **Balbix Inferred Vulnerabilities Configuration Items** | **Configuration Item** | **Default** | **Explanation** | | --- | --- | --- | | **Infer New / Additional Vulnerabilities** | False | This option allows Balbix to proactively tag new vulnerabilities as soon as they are released by vendors. The system uses detailed vendor advisories, software version (CPE), and other sources like NVD to keep the vulnerability database up to date. For example, vulnerabilities released on "Patch Tuesday" by Microsoft are quickly tagged to relevant assets, even if third-party tools have not identified them. This ensures faster and more comprehensive vulnerability management. | | **Corroborate Vulnerabilities Only** | True | In this configuration, Balbix will corroborate vulnerabilities ingested from third-party tools. Vulnerabilities identified solely by Balbix are excluded, ensuring only ingested vulnerabilities are tagged. This is also a prerequisite for enabling fix enrichment. | | **Enrich Fix Information** | True | Enhances fix details with actionable information such as URLs, patch names, and version-specific guidance. Third-party fix details are preserved and supplemented by Balbix’s high-fidelity data to ensure comprehensive remediation information is provided. | | **Infer EOL Vulnerabilities** | True | Automatically detects vulnerabilities related to software components that have reached their End-of-Life (EOL). This helps organizations address unsupported software versions and align with lifecycle management best practices. | These configuration items can be set by accounts with admin access or Balbix customer success administrators. While most items can be adjusted via the system interface, some require backend configurations that can be requested through Balbix support. *Configuration items allow tailored processing, ensuring the system meets the specific requirements of different environments.* --- ### **Process Flow Diagram** ![A screenshot of a phone AI-generated content may be incorrect.](https://lh7-rt.googleusercontent.com/docsz/AD_4nXe25-1l62dHQ_IyMRvr4WVYfdsu0vthFs6gFYkVR9Z2Q6elBOR8ZYbU0jUTssDk9MmnPy3v2-s1kaFs6fGul_H4SRFfoIUAyFxm3stlk7NSQhMztR8_QpiQNRvPvElVjbhx-VmqP7VxICxKObOz938?key=5pp6RcV9TISuJLHdGmFF6fdZ) --- ### **Process Steps Explained** **Stage 1: CVE Tagging and Initial Processing** - Analyzes software components and their relationships. - Maps identified CVEs to specific components. - Tracks patch supersession timing for accurate vulnerability state management. **Version-Specific Substages** | **Substage** | **Key Aspects** | | --- | --- | | **OS Version Processing** | Handles version chains for Windows, Linux, and macOS. Validates build numbers to ensure accurate version identification, enabling precise CVE tagging. | | **Version Range Validation** | Ensures the validity of inclusive/exclusive version ranges. Checks architecture-specific dependencies and formats to avoid mismatched data and false positives. | | **Patch Version Chains** | Tracks cumulative and security-only updates. Ensures updates are processed in the correct sequence and validates patch order consistency for reliable vulnerability tracking. | **Explanation:** These substages ensure that all software versions are processed accurately for vulnerability tagging. Proper validation and sequence tracking prevent inaccuracies, ensuring complete and reliable mappings. --- **Stage 2: ID Management** - Creates unique identifiers for vulnerabilities. - Tracks versions of components and maintains consistent vulnerability associations. | **Aspect** | **Description** | | --- | --- | | **Version Identifiers** | Ensures unique, version-specific IDs for components to maintain accuracy and avoid duplication. | | **Component Tracking** | Establishes clear relationships between components and tracks version state chains for consistent updates. | **Explanation:** This stage ensures that each vulnerability and its associated component are uniquely and consistently tracked across updates. This eliminates ambiguity and redundancy in vulnerability management. --- **Stage 3: Relationship Mapping** - Establishes connections between software components and their vulnerabilities. - Tracks component dependencies and compatibility. | **Aspect** | **Description** | | --- | --- | | **Version Dependencies** | Maps compatibility and architecture-specific requirements to identify how vulnerabilities impact interconnected systems. | | **Component Relations** | Tracks shared vulnerabilities across components and assesses cross-component impacts for comprehensive risk analysis. | **Explanation:** Relationship mapping provides a comprehensive view of interconnected software components, making it easier to assess the cascading effects of vulnerabilities and plan effective mitigations. This is critical for supply chain like vulnerabilities. This is typically highest fidelity operation when Balbix Host Analyzers are installed. SBOM data is natively provided by Balbix Host Analyzers. --- **Stage 4: Consolidation** - Merges duplicate entries and standardizes vulnerability data. - Combines multiple patch states and ensures consistency. | **Aspect** | **Description** | | --- | --- | | **Version Deduplication** | Merges overlapping version ranges and consolidates patch information to eliminate redundancy and enhance clarity. | | **State Consolidation** | Aggregates multiple version states into a unified state hierarchy, simplifying the assessment of overall vulnerability posture. | **Explanation:** This stage reduces data clutter by removing redundant entries and aligning state information. This ensures that all stakeholders work with accurate and streamlined vulnerability data. --- **Stage 5: Quality Control** - Validates and enriches data while discarding uncorroborated vulnerabilities from any further enrichment - Comprises filtering, fix information enrichment, and data population substages. **Filtering Substage** | **Aspect** | **Description** | | --- | --- | | **Version Filtering** | Sanitizes Software and Vulnerabilities. Unsupported, or incompatible software versions from vulnerability processing. Note: No 3rd party vulnerabilities are dropped by Balbix | | **Source Validation** | Cross-checks conflicting data from various sources and prioritizes the most reliable information for vulnerability tagging. | **Fix Information Substage** | **Aspect** | **Description** | | --- | --- | | **Fix Processing** | Tracks multiple versions and supersession of fixes to ensure the latest and most relevant fixes are identified. | | **Mitigation Handling** | Validates environmental configurations to ensure fixes are compatible and deployable without issues. | **Fix Data Population Substage** | **Aspect** | **Description** | | --- | --- | | **Data Completeness** | Ensures all required fix data is included and consistent, minimizing gaps in remediation information. | | **Source Integration** | Consolidates fixes from multiple sources, resolving conflicts and prioritizing accuracy and completeness. | **Explanation:** Quality control ensures the accuracy and reliability of vulnerability data by removing low-confidence entries and enriching information to support actionable remediation. This step guarantees the highest quality data for operational decision-making. --- **Stage 6: State Processing** - Updates component states based on vulnerability data and aggregates overall security posture. | **Aspect** | **Description** | | --- | --- | | **Version States** | Identifies supported, unsupported (EOL), and mixed state versions to provide a clear understanding of component health. | | **Component States** | Aggregates version states into a comprehensive security hierarchy for easier prioritization and decision-making. | **Explanation:** By consolidating version and component states, this stage provides a complete picture of the organization’s security posture, enabling more effective risk management and response planning. --- **Stage 7: EOL Processing** - Identifies End-of-Life components and generates corresponding vulnerability entries. | **Aspect** | **Description** | | --- | --- | | **Version Lifecycle** | Validates component lifecycle stages, including support windows and migration paths, to ensure alignment with vendor policies. | | **EOL State Management** | Tracks and manages the migration of unsupported components to minimize risk and maintain compliance. | **Explanation:** EOL processing highlights outdated and unsupported components, enabling proactive remediation strategies and reducing the risk of security vulnerabilities in legacy systems. --- ### **Example Scenarios** **Example 1: Basic CVE Processing** **Input:** Windows 10 Pro workstation with Office 365 **Configuration:** Default settings (minimal inference) **Process:** - System identifies base CVEs from CPE matching. - Creates relationship mapping for Windows and Office components. - Processes states without additional inference. **Outcome:** Base vulnerability set with standard relationships. **Example 2: Enhanced Processing with All Features** **Input:** Linux server running multiple services **Configuration:** All features enabled **Process:** - Performs extensive CVE inference. - Enriches fix information from multiple sources. - Generates EOL entries for outdated components. - Removes any uncorroborated vulnerabilities. **Outcome:** Comprehensive vulnerability assessment with enhanced data quality. **Example 3: Mixed Configuration for Critical Systems** **Input:** Database server with mission-critical applications **Configuration:** Enhanced fix information, no CVE inference **Process:** - Uses only verified CVE mappings. - Enriches fix information for better remediation guidance. - Maintains all corroborated vulnerabilities. - Processes EOL states without generating additional entries. **Outcome:** Conservative vulnerability assessment with rich fix information. --- > ### See Also: > > [How Balbix Tags CVEs for Enterprise Linux Distributions](/balbixhelp/docs/how-balbix-tags-cves-for-enterprise-linux-distributions)