Documentation
Whisper Security Documentation
WhisperGraph is the public internet as one queryable graph — DNS, routing, ownership, geography and threat feeds already joined — so a pivot that takes four tools and glue code takes one query.
In category terms: infrastructure intelligence — an enrichment and pivot layer for the indicators you already have. It attaches to the SIEM, TIP, EDR and abuse inbox you already run; it does not replace any of them, and it never sees your traffic.
Every verdict answers two questions, not one: how bad (band) and what we actually looked at (coverage). whisper.assess returns coverage: no-data as a populated row — never an empty result — when Whisper has nothing on a host, so "we have never seen this" cannot be mistaken for "we looked and it is clean."
One indicator, three questions
Nothing here runs until you press it.
1 · The verdict
CALL whisper.assess(["140.82.121.3"]) YIELD host, band, coverage, evidence RETURN host, band, coverage, evidence
captured 2026-08-10
- coverage:malicious-evidenced
- band:LOW
- host-class:unknown
- feed-source:listed
- feed-source-count:1
Two answers, not one. How bad — low. What we looked at — we hold positive evidence, from exactly one feed. A tool that returns only the first number cannot tell you the difference between clean and never seen. Ask it about a host that does not exist:
CALL whisper.assess(["zzz-nonexistent-host-9182.example"])
captured 2026-08-10
- coverage:no-data
- band:UNKNOWN
- host-class:unknown
2 · Why
CALL explain("185.220.101.1")captured 2026-08-10
Sign in to run- Listed in 6 source(s) with combined weight 6.00
- Base score: 6.00 × log₂(6 + 1) = 16.84
- Recency boost: ×1.1 (last seen 1 day ago)
- Age boost: ×1.06 (on lists for 5 days)
- Final score: 16.84 × 1.1 × 1.06 = 19.65
Low risk. Most tools stop here. The score shows its working — and it does not carry coverage, which is why beat one exists.
3 · The mechanism
MATCH (ip:IPV4 {name:"185.220.101.1"})-[:LISTED_IN]->(f:FEED_SOURCE)
WITH f
MATCH (f)-[:BELONGS_TO]->(c:CATEGORY)
RETURN f.id AS feed, c.id AS categorycaptured 2026-08-10
Sign in to run| feed | category |
|---|---|
| tor-exit-nodes | tor |
| firehol-abusers-1d | blacklists |
| greensnow | blacklists |
| firehol-level2 | blacklists |
| stopforumspam-listed-ip-7d | spam |
| stamparm-ipsum | blacklists |
That row is not in the score. It changes the ticket.
Start
Start here: one indicator, one answer, no account needed.
WhisperGraph
What the graph holds — and what it does not.
Cypher
The read-only Cypher dialect WhisperGraph runs, clause by clause.
HTTP API
Send Cypher over HTTP and read what comes back.
Workflows
Prepared investigations you run in the browser without writing Cypher.
Recipes
Copy-paste Cypher, by job, that you adapt to your indicator.
Agents & MCP
How an agent asks WhisperGraph, and how it cites the answer.
Integrations
Whisper inside the tool you already have open.
Reference
What the graph misses, what is not promised, and who to ask.