Skip to main content
Use SQL’s --as-of option to query findings as they existed at a past time. Use graph observation timestamps to see when resources were first or most recently observed.

​
Historical findings

Dates and timestamps without a timezone use UTC. The findings table resolves to its state at the requested instant. Other tables remain current, so a join to another table is not a historical snapshot of both tables. For direct API calls, send the timestamp in the SQL request body’s asOf field. JSON CLI output contains the result array in rows:

​
Graph observation timestamps

Graph nodes and edges carry these epoch-millisecond timestamps: Find resources first observed during the last seven days:
Find resources not observed during the last 48 hours:
These are observation times. They do not establish when a resource was created or deleted, and they do not reconstruct past property values. A stale observation can also mean a crawl has not run or could not reach the resource. For scripted graph queries, pass --intent to record the purpose of the request. See SQL and Cypher.