> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tolmo.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Keep up with production changes

> See which production changes Tolmo detects, which agent reacts to each change, and how to set the Red schedule and Blue triggers to match your releases.

A pentest shows production on the day of the test. After that day, each deploy adds endpoints, hostnames, and cloud resources that the pentest did not see. Your scanners also continue to send alerts. Tolmo continues to test production as it changes. Thus, you know what an attacker can reach today, and you do not wait for the next yearly pentest.

## Changes that Tolmo detects

Tolmo builds a [knowledge graph](https://docs.tolmo.com/knowledge-graph/overview.md) of production from the accounts that you connect. For each asset, the graph records when Tolmo first saw it and when Tolmo last saw it. A recent first-seen time shows that an asset is new.

| Change | Where Tolmo sees it |
| - | - |
| New domains and hostnames | Cloud DNS, Cloudflare, and certificate transparency |
| New applications and HTTP endpoints | Your repositories, through GitHub or GitLab |
| New or changed cloud resources and exposure | AWS, GCP, Azure, and the other cloud and hosting providers that you connect |
| New third-party findings | Security tools such as Wiz, Snyk, Aikido, Socket, HackerOne, and Bugcrowd |

## Agent reactions and timing

| Change | What reacts | When |
| - | - | - |
| New hosts, endpoints, or cloud exposure in an authorized domain | The **Red team agent** reads the current graph at the start of each run. Thus, the next run includes the new surface. | On the Red schedule, or when you start a run |
| A new finding from a connected security tool | If a trigger matches the finding, the **Blue team agent** tries to prove or disprove it. | Immediately, daily, or weekly, as the trigger sets |
| A fix that you shipped | **Retest** replays the exploit. The **Green team agent** rechecks findings that an agent exploited before. | When you retest |

An authorized domain is a domain where an organization admin enabled offensive testing. See [Define scope](https://docs.tolmo.com/pentesting/scope.md).

> [!NOTE]
>
> Red runs on a schedule or when you start a run. A new endpoint waits for the next scheduled run. Thus, set a schedule that matches how often you ship.

## Set the Red schedule

The Red schedule sets how often the Red team agent pentests all authorized domains automatically. You set a frequency, a start time, and a timezone:

* **Daily**: every *N* days.
* **Weekly**: every *N* weeks, on one or more weekdays.

You can pause the schedule during a release freeze. Tolmo keeps your settings. When you resume the schedule, automatic runs start again.

> [!TIP]
>
> If you deploy every day, use a daily schedule. Then the time between a change and its first test is less than one day. After a large release, start a run immediately. Do not wait for the next scheduled run.

To set the schedule from the CLI, use `tolmo red-agent schedule`:

```bash theme={null}
tolmo red-agent schedule get
tolmo red-agent schedule set --frequency week --interval 1 --days mon,thu --time 09:00 --timezone Europe/Paris
tolmo red-agent schedule pause
tolmo red-agent schedule resume
```

For all flags, see the [red-agent command reference](https://docs.tolmo.com/cli/commands/red-agent.md).

### Start a run now

You can start a run at any time, for example after a large release. To start a run from the CLI, use this command:

```bash theme={null}
tolmo red-agent run
```

A run that you start tests the same authorized domains as a scheduled run. It does not change the time of the next scheduled run.

## Add Blue triggers for new third-party findings

A Blue trigger sets which new findings from your other security tools Blue tries to exploit. It also sets when Blue starts. For what Blue does with each finding, see [Validate the findings you already have](https://docs.tolmo.com/pentesting/third-party-findings.md).

A trigger matches new findings by severity. It can also match by source, such as Wiz or Snyk. A trigger runs in one of two modes:

* **On arrival**: Blue starts when a matching finding arrives.
* **On a schedule**: Blue starts daily, or weekly on a day that you select.

Start with one trigger that verifies each new critical finding when it arrives.

Blue checks the triggers in order and uses the first trigger that matches. A finding that matches no trigger follows your default setting. The default setting is off, daily, or weekly.

### Limit Blue to testing hours

You can limit Blue to testing hours on the days that you select. Use this setting to keep verification traffic to specified times. Outside the testing hours, no Blue run starts. If a run continues when the testing hours end, Tolmo stops the run. Tolmo starts the run again when the testing hours start again.

## Get notified about changes

When [notifications](https://docs.tolmo.com/agents/notifications.md) are on, Tolmo sends a validated finding to Slack when an agent proves it. The finding is also in your next email digest.

## Next steps

> [card] [How the Red team agent tests](https://docs.tolmo.com/pentesting/red-team-agent.md)
>
> The steps of a run, from recon to a validated finding.

> [card] [Define scope](https://docs.tolmo.com/pentesting/scope.md)
>
> Select the domains that the agents can test, and give the agents test accounts.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.