Reports whether a GraphObject is a stored point-in-time copy of an object's state rather than the object's live state.
Snapshots are written when a policy rule evaluation records a finding status change, so the state that opened or resolved the finding stays readable after the live object moves on. A snapshot is immutable: it is never re-observed or re-written, and it is addressed by its own identifier — it is invisible to listings, searches, and relationship traversals, so you only reach one by asking for it by id.
Fields
| Field Name | Description |
|---|---|
isSnapshot - Boolean!
|
True when this object is a point-in-time snapshot of an object's state. False when it is the live object. |
timestamp - Time
|
The point in time the snapshotted state was observed. Null when this is the live object. This is when the state was last confirmed on the object — not the moment the object changed, and not the moment the snapshot was taken. For the time of the change itself, use the timestamp on the FindingStatusChange that references this snapshot. |
snapshotOfObject - GraphObject
|
The live object this snapshot was taken from, in its current state. Null when this is the live object, and when the object the snapshot was taken from has been deleted. |
versionId - String
|
The identifier of the stored version this snapshot is, for debugging and support. It distinguishes two snapshots of the same object taken at different times. Null when this is the live object. |
Used by
AccountPolicytype: The local account password and lockout policy in effect on an Endpoint.ActiveDirectorytype: The Active Directory (AD) domain membership and directory-binding configuration of an Endpoint.AdministrativeTemplatesWindowstype: The Group Policy Administrative Templates (ADMX) settings applied to a Windows Endpoint, read from the policy registry values those templates write.Applicationtype: A software product as an identity shared across an organization, independent of any one computer.ApplicationInstalltype: One installed copy of an application on one Endpoint.ApplicationInstallUserSettingstype: The settings one EndpointUser has configured for one ApplicationInstall, so there is at most one object per user and install on an Endpoint.ArpTableEntrytype: One entry in an Endpoint's neighbor cache: the IPv4 Address Resolution Protocol (ARP) table and, where the operating system reports it, the IPv6…AuditPolicytype: The security event auditing configuration of an Endpoint.Devicetype: A physical or virtual device that does not run the Wartiva endpoint application but is visible on the network to a managed Endpoint, such as…DeviceManufacturertype: A hardware vendor that made one or more discovered Device objects in an organization.DeviceModeltype: A specific product model, made by a DeviceManufacturer, that one or more discovered Device objects in an organization are instances of.Disktype: A physical disk drive attached to an Endpoint, identified on that Endpoint by its operating-system drive ID (for example \\.\PhysicalDrive0 on…DiskMounttype: A file system mounted on an Endpoint, identified by its device and mount point (for example C: on Windows or / on Linux and macOS).Endpointtype: A Windows, macOS, or Linux computer that runs the Wartiva endpoint agent and is enrolled with an organization.EndpointGrouptype: An operating system or domain group observed on an Endpoint.EndpointPathtype: The single graph object a PathSensor produces on an Endpoint, so an Endpoint has one EndpointPath per sensor that has reported data from it; list…EndpointUsertype: An operating system or domain user account observed on an Endpoint.Executabletype: A unique executable file observed running on an Endpoint, aggregating data across all observed processes that share the same file system path.Findingtype: The record of a policy Rule evaluating FAIL against one graph object, such as an Endpoint, Device, or network service.Interfacetype: A network interface (physical, virtual, loopback, or tunnel) on an Endpoint, collected from Windows, macOS, and Linux endpoints as part of the…Issuetype: The triage record for a policy violation: a security concern on one graph object that needs remediation or a decision.LocalPoliciestype: The local security policy settings of an Endpoint.Locationtype: A physical place identified by its global plus code (Open Location Code), with a street address resolved by reverse geocoding.LogonSessiontype: A user logon session observed on an Endpoint, identified by the username and the time the session started.Networktype: An IP network (subnet) that a managed Endpoint has been attached to, identified by its address range in CIDR notation and, for networks outside a…NetworkPrefixtype: A specific IP address together with its subnet prefix length (e.g.OpenPorttype: One TCP or UDP port at one IP address on a discovered Device, found by managed endpoints port-scanning the devices on their local networks and by…PositionSeentype: A geographic coordinate (latitude and longitude) where a managed Endpoint was observed, and the times it was seen there.Routetype: One entry in an Endpoint's IP routing table, collected from Windows, macOS, and Linux endpoints as part of the periodic network inventory.Securitytype: The security posture of an Endpoint: its firewall, anti-malware and disk encryption state, summarized as per-component health ratings in Health.Servicetype: A network service identified on a discovered Device: one protocol (such as HTTP, TLS, SSH, SMB, DNS, SNMP, IPP, mDNS, or UPnP) acting as a client or…SoftwareUpdatePreferencestype: The operating system update configuration of an Endpoint and the updates currently available to it.SystemServicetype: A background service or daemon configured on an Endpoint.SystemSettingstype: The machine-wide operating system configuration of an Endpoint.UserSystemSettingstype: The per-user operating system configuration of one user account on an Endpoint, complementing the machine-wide SystemSettings.WlanAccessPointtype: A Wi-Fi access point radio, identified by the network name (SSID) it broadcasts and its BSSID, as heard by managed endpoints scanning for nearby…WlanInterfacetype: A wireless LAN (Wi-Fi) adapter on an Endpoint, collected from Windows, macOS, and Linux endpoints by the periodic Wi-Fi inventory.WlanNetworktype: A Wi-Fi network identified by its network name (SSID), visible to managed endpoints when they scan for nearby networks on Windows, macOS, or Linux.FindingStatusChangetype: A single status transition in the history of a Finding.Ruletype: A policy rule evaluated against graph objects.
And 1 more.
Example
Example
{
"isSnapshot": true,
"timestamp": "2021-10-07T18:23:25.829Z",
"snapshotOfObject": GraphObject,
"versionId": "abc123"
}