Overview
Tracking when a vulnerability, exposure, or other finding was last observed by detection tools (the Last Seen date) is critical for validating detections, prioritizing remediation, and measuring progress. Accurately determining this timestamp can be challenging when the same vulnerability is reported by multiple data sources, especially when some sources do not provide an explicit “Last Seen” date. Balbix applies a consistent set of rules to normalize these timestamps across sources.
Principles for Determining Last Seen
Balbix uses the following principles to determine the Last Seen date for each vulnerability instance:
Source-first precedence: Prefer instance-level Last Seen timestamps explicitly provided by data sources when available.
Multi-source consolidation: When multiple data sources report the same vulnerability instance, select the most recent Last Seen timestamp across all sources.
Fallback behavior: If a data source does not provide an instance-level Last Seen timestamp, use the connector’s most recent successful sync timestamp as a fallback. This ensures the Last Seen field is always populated.
Last Seen Calculation Logic
For each vulnerability instance, Balbix applies the following logic:
Collect all available instance-level Last Seen timestamps from observing data sources.
For any data source that does not provide an instance-level timestamp, substitute the connector’s last successful sync timestamp.
Select the most recent timestamp across all sources after applying fallback substitutions.
Populate the vulnerability instance's Last Seen date with this final value.
Example Scenarios
The following examples illustrate how the Last Seen date is determined when aggregating data from multiple sources.
Scenario A
Data Source | Connector Sync Date | Last Seen Date |
Source 1 | Jan 5 | Jan 4 |
Source 2 | Jan 6 | Jan 3 |
Result: Last Seen date is Jan 4
Explanation: Both data sources provide instance-level Last Seen dates. Balbix selects the most recent value across sources, which is Jan 4.
Scenario B
Data Source | Connector Sync Date | Last Seen Date |
Source 1 | Jan 5 | Jan 4 |
Source 2 | Jan 6 | N/A |
Result: Last Seen date is Jan 6
Explanation: Source 1 provides an instance-level Last Seen date, while Source 2 does not. For Source 2, the connector sync date (Jan 6) is used as a fallback. The most recent timestamp across both sources is Jan 6.
Scenario C
Data Source | Connector Sync Date | Last Seen Date |
Source 1 | Jan 6 | Jan 3 |
Source 2 | Jan 5 | N/A |
Result: Last Seen date is Jan 5.
Explanation: Source 1 provides an instance-level Last Seen date, while Source 2 does not. For Source 2, the connector sync date (Jan 5) is used as a fallback. The most recent timestamp across both sources is Jan 5.