> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tolmo.com/llms.txt
> Use this file to discover all available pages before exploring further.

# What the knowledge graph is

> The production knowledge graph is a live model of your production. Tolmo uses it to find changes, select test targets, and link findings to code and owners.

The production knowledge graph is Tolmo's model of your production. Tolmo builds it from the accounts that you connect: cloud, code, DNS, observability, and security tools. Each resource is a node. Each relationship between two resources is an edge. Tolmo refreshes the graph continuously and records a timestamp for each observation.

You do not add data to the graph manually. You connect an account, and Tolmo maps the resources in it.

![Graph path for api.example.com. Columns show hostname, AWS ingress, runtime, HTTP routes, endpoint, and data store. The PUT /integrations/:id endpoint writes secrets to a PostgreSQL table. Below, the Terraform and application source files that define each step are linked to it.](https://mintcdn.com/tolmo/7vlOnd-Q0dNpaHkM/images/platform/knowledge-graph-context.png?fit=max\&auto=format\&n=7vlOnd-Q0dNpaHkM\&q=85\&s=8ec00657f9cd185ec5f116a2a11c571e)

One path through the graph. A hostname goes to a load balancer, a cluster, an HTTP route, an endpoint, and a database. The graph links each step to the source file that defines it.

## Contents of the graph

| Kind | Examples | Source |
| - | - | - |
| **Domains and hosts** | Apex domains, subdomains, DNS resolution, web reachability | Cloud and DNS providers, and certificate transparency logs |
| **Applications and HTTP endpoints** | Services in your repositories, the routes that they declare, the hostnames that serve them | Your code repositories |
| **Cloud resources** | Compute, storage buckets, databases, IAM roles, network exposure | Cloud providers such as AWS, GCP, and Azure |
| **Datastores** | Databases and object storage, classified by the type of data in them | Cloud providers |
| **Relationships** | "This role can read this bucket", "this app is served at this host" | All of the sources above |

Each integration that you connect adds data to the same graph. The [integrations catalog](https://docs.tolmo.com/integrations/catalog.md) shows the sources of the graph.

## How Tolmo finds changes

Each node and each edge has two timestamps:

* `firstSeenAt`: the time when Tolmo first saw it.
* `lastSeenAt`: the time when Tolmo last confirmed that it exists.

Tolmo uses these timestamps to find new resources. For example, a host that Tolmo first saw yesterday appears as new in the graph. An endpoint from a new release also appears as new. To see these changes, use the [time machine](https://docs.tolmo.com/knowledge-graph/time-machine.md).

Tolmo also runs background assessments on the graph. For example, an assessment classifies the data in a datastore. Each assessment checks only the resources that changed after its last run. Thus, the graph stays current and Tolmo does not process all resources again.

## How the agents use the graph

Each run of the [Red team agent](https://docs.tolmo.com/pentesting/red-team-agent.md) starts from the current graph. The next run includes new hosts and endpoints under your authorized domains. Nobody must update a target list.

Findings also use the graph. A finding links to the related application, endpoint, and code. Thus, you can see the affected resources and their owners. The HTTP endpoints view also uses the graph. It shows the routes that the agents tested and the routes that they did not test.

The graph also limits testing. If a route is not in the graph, recon must find the route in the running application or in the source code.

## Use the graph

> [card] [Explore in the app](https://docs.tolmo.com/knowledge-graph/explore.md)
>
> Browse apps, endpoints, datastores, domains, and the full graph.

> [card] [Time machine](https://docs.tolmo.com/knowledge-graph/time-machine.md)
>
> See the resources that appeared or disappeared in a time window.

> [card] [SQL and Cypher](https://docs.tolmo.com/knowledge-graph/sql-cypher.md)
>
> Query the graph and your findings directly.

> [card] [Connected services](https://docs.tolmo.com/knowledge-graph/connected-services.md)
>
> Query GitHub, AWS, Datadog, and other sources through Tolmo.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.