Cheat Sheet

WhisperGraph is the internet as a queryable database — DNS, BGP/RPKI, WHOIS/RDAP, GeoIP, email posture, certificate transparency, threat intel, and the physical internet, all pre-joined. This page is the dense quick-reference: labels, edges with directions, the traversal chains worth memorizing, and procedure one-liners with their exact columns. If you already know Cypher, this is the WhisperGraph-specific part you need. Deeper detail lives in the Graph Schema, Procedures, and the Workflows.

Scale: 7.5B nodes · 39.8B edges · 42 labels · 55 edge types · 52 procedures · 134 intelligence feeds (112 of them threat feeds) · 32 categories. GET /api/query/stats returns live totals.

Endpoint

POST https://graph.whisper.security/api/query
Content-Type: application/json
User-Agent: whisper-client/1.0   # send an explicit UA to avoid a WAF 403
X-API-Key: <your-key>            # sign in to get one — see /docs/whisper-graph/getting-started

{"query": "MATCH (h:HOSTNAME {name:\"www.google.com\"})-[:RESOLVES_TO]->(ip) RETURN ip.name LIMIT 3"}

Bind $name placeholders through a sibling "parameters": {...} object; ;-separated statements run as a batch and come back as a results array. MCP for agents at https://mcp.whisper.security. See MCP setup. Full API details: HTTP API.

Node labels

There is no Domain or FQDN label — every name is a HOSTNAME, and a legacy label (Domain, IpAddress, Certificate) is rejected with an error naming the replacement. Every node has a name property except ROA. Names are lowercase with no trailing dot. Labels marked (computed) are synthesized at query time — reach them through an edge from an anchored node, never via an unanchored scan.

Core DNS & addressing — HOSTNAME (2.8B), IPV4 (622M), IPV6, PREFIX, ANNOUNCED_PREFIX (computed), REGISTERED_PREFIX (computed; .rir, .country), TLD, URL (computed; phishing-kit paths — anchor by {name}, which holds the path; {path} and {id} scan the label)

Routing & org — ASN (AS13335; the registry is on .autNumSourceRir), ASN_NAME (computed), ORGANIZATION (raw registrant strings; fold with SAME_ORG_AS), TLD_OPERATOR, RIR (node-only; nothing joins to it)

WHOIS & registration — REGISTRAR, EMAIL, PHONE, RDAP_ENTITY (reached from PREFIX or ASN over REGISTERED_TO_ENTITY)

Geo & DNSSEC — CITY, COUNTRY, DNSSEC_ALGORITHM

Threat intel — FEED_SOURCE (134, computed; .name is the slug, .displayName the label), CATEGORY (32, computed), THREAT_TAG (MISP-galaxy, via TAGGED_AS), THREAT_SIGNAL_TYPE (each signal belongs to one label, for example prefix-age-anomaly and toxic-neighborhood on PREFIX; bulletproof-hosting, critical-infrastructure, ddos-mitigation and satellite-network on ASN; hidden-primary-soa, subdomain-takeover, wildcard-dns and infrastructure-staging on HOSTNAME), ACTOR (APT28, case-sensitive; .aliases holds vendor names), ATTACK_PATTERN (MITRE ATT&CK; anchor by {name: "T1003"}, which the name index resolves by T-number, or filter {kind: "technique"}; the T-number reads back as .id), DWI_DOMAIN (unjoinable; .onion watch entries)

RPKI & routing observations — ROA (no name; reach it via ROA_AUTHORIZES_ORIGIN / ROA_AUTHORIZES_PREFIX, read .prefix, .asn, .maxLength; .authSource is rpki-roa for an RPKI ROA or irr-route for a routing-registry route object), BGP_PATH_OBSERVATION (name is the hyphen-joined AS path, origin last; via BGP_PATH)

Physical infrastructure — FACILITY, INTERNET_EXCHANGE, SUBMARINE_CABLE, CABLE_LANDING, CDN_POP (akamai:peeringdb:164; group on .operator, .city, .countryCode, not .name), DNS_ROOT_INSTANCE (unjoinable), CLOUD_REGION (thin) (aws:eu-west-1)

Egress, fingerprint & transparency — VENDOR (zoom, okta), TOR_RELAY (keyed by fingerprint), TLS_FINGERPRINT (thin) (ja3:<hash>, jarm:<hash>), CT_OBSERVATION (thin) (certificates live here, never on a Certificate label), DMARC_RECIPIENT

Three markers change how you plan a traversal:

• (unjoinable) — the nodes exist and list, and no edge of any type touches them. DNS_ROOT_INSTANCE and DWI_DOMAIN are in this state: you can MATCH them, you cannot traverse to or from them.
• (thin) — the plane is real and most seeds will miss it.
• (computed) — synthesized at query time; anchor the stored end and walk outward.

A zero-row result on a thin or unjoinable plane means Whisper holds no observation — never that the host has none.

Edge types — with directions

Directions are strict: a wrong-way traversal returns zero rows with no error. The arrow below is the stored direction; traverse backwards with <-[:EDGE]-.

DNS & web

BGP, routing & RPKI

WHOIS & registration

Geo

Threat intel & egress

Email security (SPF / DMARC / DKIM)

Physical infrastructure & CT

Computed edges: ROUTES, HAS_NAME, CONFLICTS_WITH, ANNOUNCED_BY, LISTED_IN, BGP_NEIGHBOR, and BELONGS_TO → CATEGORY are synthesized at query time. They work inside a variable-length [*1..N] when one endpoint is anchored by name: keep the range tight, filter WHERE n <> a on peering walks, and for a wide fan-out write explicit single hops joined with WITH ... LIMIT. Read per-type counts from CALL db.relationshipTypes() YIELD type, count, never from count(r) over unanchored endpoints.

Direction landmines (memorize these)

Must-know traversal chains

Host → network owner (attribution) — who hosts a domain and on whose AS (ROUTES matches in either direction):

MATCH (h:HOSTNAME {name:"github.com"})-[:RESOLVES_TO]->(ip:IPV4)
      -[:ANNOUNCED_BY]->(ap:ANNOUNCED_PREFIX)-[:ROUTES]->(a:ASN)-[:HAS_NAME]->(n:ASN_NAME)
RETURN ip.name, ap.name, a.name AS asn, n.name AS network LIMIT 5

To bound each stage, put the routing leg in a CALL { WITH ip ... } subquery, or give each WITH stage one computed hop (ANNOUNCED_BY, then ROUTES). A walk this long needs an account, so sign in before you run it.

IP → jurisdiction — (:IPV4)-[:LOCATED_IN]->(:CITY)-[:HAS_COUNTRY]->(:COUNTRY)

IP → origin AS — MATCH (ip:IPV4 {name:"1.1.1.1"})-[:ANNOUNCED_BY]->(ap:ANNOUNCED_PREFIX)<-[:ROUTES]-(a:ASN) RETURN ap.name, a.name LIMIT 5

Blast radius (one indicator → the campaign) — pivot on shared infra:

MATCH (ip:IPV4 {name:"172.67.75.10"})<-[:RESOLVES_TO]-(h:HOSTNAME)
WITH h LIMIT 25
OPTIONAL MATCH (h)-[:HAS_EMAIL]->(e:EMAIL)<-[:HAS_EMAIL]-(sibling:HOSTNAME)
RETURN h.name, e.name, collect(DISTINCT sibling.name)[..20] AS shared_registrant

Bound the co-tenant set with WITH h LIMIT 25 before the registrant pivot. A trailing LIMIT will not do it: the sibling collect still runs against every co-tenant first, and the [..20] slice is applied only after the whole list is built.

Domain → mail / name servers (reverse traversal) — MATCH (d:HOSTNAME {name:"github.com"})<-[:MAIL_FOR]-(mx) RETURN mx.name LIMIT 10

MOAS / possible BGP hijack — MATCH (p:ANNOUNCED_PREFIX {name:"216.168.228.0/24"})-[:CONFLICTS_WITH]->(a:ASN) RETURN p.name, collect(a.name) LIMIT 25

IP → feeds → categories — (:IPV4)-[:LISTED_IN]->(:FEED_SOURCE)-[:BELONGS_TO]->(:CATEGORY)

ASN → physical footprint — (:ASN)-[:AS_PRESENT_AT]->(:FACILITY) and (:ASN)-[:IX_MEMBER]->(:INTERNET_EXCHANGE)-[:IX_HOSTED_AT]->(:FACILITY)

ASN → RPKI — MATCH (a:ASN {name:"AS13335"})<-[:ROA_AUTHORIZES_ORIGIN]-(r:ROA) WHERE r.authSource = "rpki-roa" RETURN r.prefix, r.asn, r.maxLength LIMIT 10 (a ROA has no name)

Unclassified token → typed entity — CALL whisper.search("1.1.1.1") YIELD kind, name, matchType RETURN kind, name, matchType LIMIT 5

Actor → ATT&CK — MATCH (a:ACTOR {name:"APT28"})-[:USES_TECHNIQUE]->(t:ATTACK_PATTERN) RETURN t.name LIMIT 25

That chain reads the curated MITRE ATT&CK knowledge base — 9,256 USES_TECHNIQUE edges and 872 USES_TACTIC edges across 1,944 actors and 712 techniques. It is a reference layer, not Whisper's own attribution. The edge that joins it to live infrastructure is sparse: ATTRIBUTED_TO, a published attribution from an indicator to a named group, holds 302 edges. The chain returns technique and tactic rollups. It does not attribute anything.

The Workflows have copy-paste recipes per workflow.

Threat properties on a node

Threat-listed IPV4 / IPV6 / HOSTNAME nodes carry the verdict inline, so one anchored read gives the whole posture — no extra hops:

MATCH (ip:IPV4 {name:"185.220.101.1"})
RETURN ip.threatScore, ip.threatLevel, ip.isThreat, ip.isTor, ip.isAnonymizer LIMIT 1

• threatScore (numeric), threatLevel (NONE … CRITICAL), and the flags isThreat, isTor, isAnonymizer.
• Name the properties you read. RETURN ip may leave the reconciled verdict fields out for speed and say so with a projection-verdict-omitted advisory; projectionFull: true on the request returns the full surface.
• For the scored reasoning — feeds, weights, factors — call explain(). A NONE/clean read means "not listed at this granularity," not "safe."

Read coverage before band. Only known-clean — coverage: known-clean. In coverage, no malicious evidence. licenses the word "clean"; no-data — coverage: no-data. Not in coverage. This is not a verdict — nothing was looked at. means unknown, which is a different thing again; malicious-evidenced — coverage: malicious-evidenced. In coverage, with positive evidence of malice. and ambiguous — coverage: ambiguous. In coverage, and the evidence points both ways. mean there is evidence, whatever the band says. Full contract: Coverage — what we looked at.

Procedures — one-liners

Call from Cypher with CALL. Quote every argument, and YIELD exact names: a column a procedure does not emit is rejected, not ignored. Full signatures and the complete census (52 procedures) are in Procedures.

explain() auto-detects the indicator type. exists: true from whisper.variants() means registered, not malicious — pivot the hit through explain() for a verdict. A successful response may also carry a top-level advisories[] array (whois-parent-fold, enrich-semantics, null-pagination-param, projection-verdict-omitted, …): read it rather than parsing rows.

Query rules (one line each)

Speed guide: anchored point lookups = instant · STARTS WITH / narrow ENDS WITH ".dom" = fast · anchored multi-hop with OPTIONAL MATCH = seconds · unanchored label scans, unanchored URL expansion, and regex =~ over HOSTNAME = avoid.

Send one

Sign in to get a key, then send it in X-API-Key. Getting Started walks the setup.

curl -s -A "whisper-client/1.0" https://graph.whisper.security/api/query \
  -H "Content-Type: application/json" \
  -H "X-API-Key: $WHISPER_API_KEY" \
  -d '{"query":"MATCH (h:HOSTNAME {name:\"www.google.com\"})-[:RESOLVES_TO]->(ip) RETURN h.name, ip.name LIMIT 3"}'

See also the Threat Feeds & Categories reference (134 feeds / 32 categories) and the HTTP API for the full endpoint reference.