> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tolmo.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Query historical findings and graph observations

> Read findings at a past time with SQL and use graph observation timestamps to review infrastructure changes.

Use SQL's `--as-of` option to query findings as they existed at a past time. Use graph observation timestamps to see when resources were first or most recently observed.

## Historical findings

```bash theme={null}
tolmo sql --as-of 2026-09-01 "SELECT id, title, severity, status FROM findings WHERE severity = 'high' LIMIT 20"
tolmo sql --as-of 2026-09-01T14:30:00Z --json "SELECT status, count(*) FROM findings GROUP BY status"
```

Dates and timestamps without a timezone use UTC. The `findings` table resolves to its state at the requested instant. Other tables remain current, so a join to another table is not a historical snapshot of both tables.

For direct API calls, send the timestamp in the SQL request body's `asOf` field. JSON CLI output contains the result array in `rows`:

```bash theme={null}
tolmo sql --as-of 2026-09-01 --json "SELECT id, title FROM findings LIMIT 20" | jq '.rows[]'
```

## Graph observation timestamps

Graph nodes and edges carry these epoch-millisecond timestamps:

| Property | Meaning |
| - | - |
| `firstSeenAt` | When the crawler first observed the resource or relationship |
| `lastSeenAt` | When the crawler most recently observed it |

Find resources first observed during the last seven days:

```bash theme={null}
tolmo cypher "MATCH (n:GraphNode) WHERE n.firstSeenAt >= (timestamp() - 7*24*60*60*1000) RETURN n.resourceType, n.resourceKey ORDER BY n.firstSeenAt DESC"
```

Find resources not observed during the last 48 hours:

```bash theme={null}
tolmo cypher "MATCH (n:GraphNode) WHERE n.lastSeenAt < (timestamp() - 48*60*60*1000) RETURN n.resourceType, n.resourceKey LIMIT 50"
```

These are observation times. They do not establish when a resource was created or deleted, and they do not reconstruct past property values. A stale observation can also mean a crawl has not run or could not reach the resource.

For scripted graph queries, pass `--intent` to record the purpose of the request. See [SQL and Cypher](https://docs.tolmo.com/commands/sql-cypher.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.