Skip to main content
The production knowledge graph is Tolmo’s model of your production. Tolmo builds it from the accounts that you connect: cloud, code, DNS, observability, and security tools. Each resource is a node. Each relationship between two resources is an edge. Tolmo refreshes the graph continuously and records a timestamp for each observation. You do not add data to the graph manually. You connect an account, and Tolmo maps the resources in it.
Graph path for api.example.com. Columns show hostname, AWS ingress, runtime, HTTP routes, endpoint, and data store. The PUT /integrations/:id endpoint writes secrets to a PostgreSQL table. Below, the Terraform and application source files that define each step are linked to it.

One path through the graph. A hostname goes to a load balancer, a cluster, an HTTP route, an endpoint, and a database. The graph links each step to the source file that defines it.

​
Contents of the graph

Each integration that you connect adds data to the same graph. The integrations catalog shows the sources of the graph.

​
How Tolmo finds changes

Each node and each edge has two timestamps:
  • firstSeenAt: the time when Tolmo first saw it.
  • lastSeenAt: the time when Tolmo last confirmed that it exists.
Tolmo uses these timestamps to find new resources. For example, a host that Tolmo first saw yesterday appears as new in the graph. An endpoint from a new release also appears as new. To see these changes, use the time machine. Tolmo also runs background assessments on the graph. For example, an assessment classifies the data in a datastore. Each assessment checks only the resources that changed after its last run. Thus, the graph stays current and Tolmo does not process all resources again.

​
How the agents use the graph

Each run of the Red team agent starts from the current graph. The next run includes new hosts and endpoints under your authorized domains. Nobody must update a target list. Findings also use the graph. A finding links to the related application, endpoint, and code. Thus, you can see the affected resources and their owners. The HTTP endpoints view also uses the graph. It shows the routes that the agents tested and the routes that they did not test. The graph also limits testing. If a route is not in the graph, recon must find the route in the running application or in the source code.

​
Use the graph

Explore in the app

Browse apps, endpoints, datastores, domains, and the full graph.

Time machine

See the resources that appeared or disappeared in a time window.

SQL and Cypher

Query the graph and your findings directly.

Connected services

Query GitHub, AWS, Datadog, and other sources through Tolmo.