5.1 The Difference Between a Sensor and a Connector
CBOM Secure ships a library of sensors and connectors covering cloud key services, HSMs, network protocols, filesystems and keystores, databases, directories, compiled binaries and source code. This part explains the distinction between a sensor and a connector, sets out the structure every sensor guide follows, works one sensor through that structure in full, and describes the coverage planned for future releases.
CBOM Secure distinguishes between a sensor and a connector. The distinction sets the right expectation about what a given discovery unit will and will not find.
A sensor discovers cryptographic material by examining a system directly — reading a filesystem, negotiating a TLS handshake, parsing a binary, walking a source tree, querying an HSM. It finds material that nothing else has catalogued.
A connector collects cryptographic material from a system that has already catalogued it — a certificate lifecycle manager, a vulnerability scanner, a cloud key management service, a configuration management database. It imports an existing inventory.
The distinction matters for three practical reasons: a connector inherits the coverage and the blind spots of the system it reads from; a connector is usually far cheaper to run than the equivalent sensor; and a connector finding and a sensor finding for the same material deduplicate to a single record, so the same certificate discovered both ways is counted once.
Applied to the CBOM Secure sensor set: the network, file, binary, source code, keystore, disk encryption and keyring sensors are sensors. The cloud key service, HSM, KMIP, PKI, certificate lifecycle, directory and database configuration readers are connectors.