> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tolmo.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Time machine: see what changed

> See your production graph and your findings at a past point in time, and find the resources that appeared or disappeared after that time.

Production changes between pentest runs. The time machine shows these changes. For example, use it to see the new attack surface from a release. You can also use it to see the open findings at the start of an audit.

You can see past data in two places:

* **The graph.** Each resource and each relationship has observation timestamps. You can use these timestamps in the Explorer or with Cypher.
* **Findings.** SQL queries can read the findings table at a past time.

## Use the time machine in the Explorer

Turn on the time machine in the Explorer. Then select a window between two scans. The graph shows the resources that existed during that window. It also shows the number of resources that Tolmo **added**, **removed**, or kept **stable**. You can highlight the added or removed resources.

If no resources existed in the window, the graph tells you. Make the window wider, or go back to the current view.

> [!TIP]
>
> To filter without the slider, use **First seen** or **Last seen** in the Explorer filters. Each filter has **Last 24 hours**, **Last 7 days**, and **Last 30 days**. **Last seen** also has **Not seen in 30+ days**.

## Graph observation timestamps

Graph nodes and edges have these timestamps in epoch milliseconds:

| Property | Meaning |
| - | - |
| `firstSeenAt` | The time when the crawler first saw the resource or relationship |
| `lastSeenAt` | The time when the crawler last saw it |

To find the resources that the crawler first saw in the last seven days, use this query:

```bash theme={null}
tolmo cypher "MATCH (n:GraphNode) WHERE n.firstSeenAt >= (timestamp() - 7*24*60*60*1000) RETURN n.resourceType, n.resourceKey ORDER BY n.firstSeenAt DESC"
```

To find the resources that the crawler did not see in the last 48 hours, use this query:

```bash theme={null}
tolmo cypher "MATCH (n:GraphNode) WHERE n.lastSeenAt < (timestamp() - 48*60*60*1000) RETURN n.resourceType, n.resourceKey LIMIT 50"
```

These timestamps record observations only. They do not show when a resource was created or deleted. They also do not show past property values. An old `lastSeenAt` value can also mean that a crawl did not run. It can also mean that the crawl did not get to the resource.

For scripted graph queries, use `--intent` to record the purpose of the request. See [SQL and Cypher](https://docs.tolmo.com/knowledge-graph/sql-cypher.md).

## Historical findings

To query findings at a past time, use the `--as-of` option of `tolmo sql`:

```bash theme={null}
tolmo sql --as-of 2026-09-01 "SELECT id, title, severity, status FROM findings WHERE severity = 'high' LIMIT 20"
tolmo sql --as-of 2026-09-01T14:30:00Z --json "SELECT status, count(*) FROM findings GROUP BY status"
```

Dates and timestamps without a timezone use UTC. The `findings` table shows its state at the requested time. Other tables show their current state. Thus, a join with another table mixes past findings with current data.

For direct API calls, put the timestamp in the `asOf` field of the SQL request body. The JSON output of the CLI puts the result array in `rows`:

```bash theme={null}
tolmo sql --as-of 2026-09-01 --json "SELECT id, title FROM findings LIMIT 20" | jq '.rows[]'
```

## Compare before and after a release

To review a release, use the two views together:

1. In the Explorer, set the time machine to the window of the release. Highlight the added resources.
2. Run the "first seen" Cypher query above for the same window. This gives you the list as text.
3. Compare the open findings before and after the release:

   ```bash theme={null}
   tolmo sql --as-of 2026-10-01 "SELECT severity, count(*) FROM findings WHERE status = 'open' GROUP BY severity"
   tolmo sql "SELECT severity, count(*) FROM findings WHERE status = 'open' GROUP BY severity"
   ```

The next run of the Red team agent tests the new attack surface. See [Keep up with production changes](https://docs.tolmo.com/pentesting/production-changes.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.