Functions
The built-in function library WhisperGraph Cypher ships — aggregation, string, numeric, collection, node, type-conversion, and date functions.
On this page (10)
Functions Documentation
WhisperGraph Cypher ships a function library you use inside RETURN, WITH, and WHERE. The tables below give the call and the value it returns. For the clauses that hold these functions, see Syntax & Clauses; for the CALL procedures (explain, whisper.variants, whisper.history, whisper.origins), see Procedures.
Aggregation
Aggregations collapse rows; any non-aggregated column in the same RETURN or WITH becomes a grouping key.
| Function | Example | Result |
|---|---|---|
count | count(c) | row count |
count(DISTINCT ...) | count(DISTINCT ip) | distinct count |
sum | sum(x) over [1,2,3,4] | 10 |
avg | avg(x) over [2,4,6] | 4.0 |
min / max | min(x) / max(x) over [5,2,8] | 2 / 8 |
percentileCont | percentileCont(x, 0.5) | interpolated percentile (0.5 = median) |
stdev | stdev(x) | standard deviation |
collect | collect(c.name)[0..3] | a list |
collect(DISTINCT ...) | collect(DISTINCT x) over [1,1,2] | [1,2] |
String
| Function | Example | Result |
|---|---|---|
toUpper / upper | toUpper("abc") | ABC |
toLower / lower | toLower("ABC") | abc |
trim / ltrim / rtrim | trim(" hi ") | hi |
replace | replace("foobar","bar","baz") | foobaz |
substring | substring("hello",1,3) | ell |
split | split("a,b,c",",") | ["a","b","c"] |
left / right | left("hello",2) | he |
reverse | reverse("abc") | cba |
size / length | size("abc") | 3 (string length) |
toString | toString(123) | 123 |
String concatenation uses +.
Numeric
| Function | Example | Result |
|---|---|---|
abs | abs(-5) | 5 |
ceil / floor | ceil(4.2) / floor(4.8) | 5.0 / 4.0 |
round | round(4.5) | 5 |
sign | sign(-3) | -1 |
sqrt | sqrt(16) | 4.0 |
log / log10 / exp | log10(1000) | 3.0 |
rand | rand() | a value in [0,1) |
e / pi | pi() | π |
Arithmetic operators: +, -, *, /, %, ^ (exponent).
Trigonometric
| Function | Example | Result |
|---|---|---|
sin / cos / tan | cos(0) | 1 |
asin / acos / atan / atan2 | atan2(0,1) | 0 |
degrees | degrees(pi()) | 180 |
radians | radians(180) | π |
Collection
| Function | Example | Result |
|---|---|---|
size | size([1,2,3]) | 3 |
head / last | head([10,20,30]) | 10 |
tail | tail([10,20,30]) | [20,30] |
range | range(1,5) | [1,2,3,4,5] |
reverse | reverse([1,2,3]) | [3,2,1] |
keys | keys(node) | property keys |
isEmpty | isEmpty([]) | true |
Node and relationship
| Function | Example | Result |
|---|---|---|
id / elementId | id(n) | a node id |
labels | labels(n) | ["ASN"] |
type | type(r) | RESOLVES_TO |
properties | properties(n) | a property map |
startNode / endNode | startNode(r).name | a node |
nodes / relationships | size(nodes(p)) | node count |
length | length(p) | path length (hop count) |
Type conversion
| Function | Example | Result |
|---|---|---|
toInteger / toInt | toInteger("42") | 42 (bad input → null) |
toFloat | toFloat("3.14") | 3.14 |
toBoolean | toBoolean("true") | true |
toIntegerList / toFloatList / toStringList / toBooleanList | toIntegerList(["1","2"]) | [1,2] |
Input that cannot be parsed yields null rather than an error — toInteger("abc") returns null.
Date and time
| Function | Example | Result |
|---|---|---|
timestamp | timestamp() | epoch millis |
date | toString(date()) | 2026-06-17 |
datetime / localdatetime / time | datetime() | a datetime |
duration | duration("P1D") | a duration |
Geospatial and misc
| Function | Example | Result |
|---|---|---|
point | point({x:1.0,y:2.0}) | a point |
distance | distance(point({x:0,y:0}), point({x:3,y:4})) | geographic distance (x,y treated as lon,lat) |
coalesce | coalesce(a.missing, "default") | default |
randomUUID | randomUUID() | a UUID string |
Read
coveragebeforeband. Only known-clean — coverage: known-clean. In coverage, no malicious evidence. licenses the word "clean"; no-data — coverage: no-data. Not in coverage. This is not a verdict — nothing was looked at. means unknown, which is a different thing again; malicious-evidenced — coverage: malicious-evidenced. In coverage, with positive evidence of malice. and ambiguous — coverage: ambiguous. In coverage, and the evidence points both ways. mean there is evidence, whatever the band says.whisper.explaindoes not returncoverageat all. Full contract: Coverage — what we looked at.
Reading threat properties off a node
You do not need a function to read a verdict — the threat posture lives directly on the node. An IPV4 node carries threatScore, threatLevel, isThreat, isTor, and isAnonymizer, so a single anchored read gives you the whole posture with no extra hops.
MATCH (ip:IPV4 {name: "185.220.101.1"})
RETURN ip.name AS ip, ip.threatScore AS score, ip.threatLevel AS level,
ip.isThreat AS isThreat, ip.isTor AS isTor, ip.isAnonymizer AS isAnonymizer
LIMIT 1
For the scored reasoning behind a verdict — the feeds, weights, and factors — call explain(). See explain() — Threat Verdicts.