Skip to main content
Your scanners send more alerts than your team can examine. Many of these alerts are not exploitable in your environment. The Blue team agent tries to exploit each new alert from your tools on your live authorized target. Blue starts when the alert arrives, or on a schedule that you select. Each attempt gives a proof of exploitation or a “not exploitable” result with a reason.

​
Connect your security tools

Blue works on findings from the security tools that you connect: For the full list, see the integrations catalog. To add a tool, see Connect an integration. For a different tool, import its Markdown security report with the findings commands.

​
Choose which findings Blue tests

Blue runs on the findings that match your triggers. For example, one trigger tests each new critical finding when it arrives. A second trigger tests high-severity Wiz findings one time each day. For all trigger options and testing hours, see Add Blue triggers. Blue starts when you connect a findings integration. Blue tests only targets in your authorized domains. To test one finding immediately, retest it.

​
Blue verdicts

For each finding, Blue gives one of these verdicts: When Blue proves a finding, the finding gets the same evidence and fix prompt as a finding from the Red team agent. See Understand a finding.
Blue does not change the finding in the source tool. Tolmo keeps the Blue verdict and your triage decisions. A later scan from the source tool can still update the provider status.

​
See which alerts were real

The Validated exploits view shows all validated exploits from all sources. Filter the view by source. Then you can see which scanner alerts an attacker can use.

​
Next steps

Triage at scale

Filter, group, and triage findings from all sources.

Agents overview

How Red, Blue, and Green work together.