Skip to main content
Production changes between pentest runs. The time machine shows these changes. For example, use it to see the new attack surface from a release. You can also use it to see the open findings at the start of an audit. You can see past data in two places:
  • The graph. Each resource and each relationship has observation timestamps. You can use these timestamps in the Explorer or with Cypher.
  • Findings. SQL queries can read the findings table at a past time.

​
Use the time machine in the Explorer

Turn on the time machine in the Explorer. Then select a window between two scans. The graph shows the resources that existed during that window. It also shows the number of resources that Tolmo added, removed, or kept stable. You can highlight the added or removed resources. If no resources existed in the window, the graph tells you. Make the window wider, or go back to the current view.
To filter without the slider, use First seen or Last seen in the Explorer filters. Each filter has Last 24 hours, Last 7 days, and Last 30 days. Last seen also has Not seen in 30+ days.

​
Graph observation timestamps

Graph nodes and edges have these timestamps in epoch milliseconds: To find the resources that the crawler first saw in the last seven days, use this query:
To find the resources that the crawler did not see in the last 48 hours, use this query:
These timestamps record observations only. They do not show when a resource was created or deleted. They also do not show past property values. An old lastSeenAt value can also mean that a crawl did not run. It can also mean that the crawl did not get to the resource. For scripted graph queries, use --intent to record the purpose of the request. See SQL and Cypher.

​
Historical findings

To query findings at a past time, use the --as-of option of tolmo sql:
Dates and timestamps without a timezone use UTC. The findings table shows its state at the requested time. Other tables show their current state. Thus, a join with another table mixes past findings with current data. For direct API calls, put the timestamp in the asOf field of the SQL request body. The JSON output of the CLI puts the result array in rows:

​
Compare before and after a release

To review a release, use the two views together:
  1. In the Explorer, set the time machine to the window of the release. Highlight the added resources.
  2. Run the “first seen” Cypher query above for the same window. This gives you the list as text.
  3. Compare the open findings before and after the release:
The next run of the Red team agent tests the new attack surface. See Keep up with production changes.