Cheat Sheet

POST https://graph.whisper.security/api/query
Content-Type: application/json
User-Agent: whisper-client/1.0   # send an explicit UA to avoid a WAF 403
X-API-Key: <your-key>            # optional — anonymous works keyless (2-hop cap)

{"query": "MATCH (h:HOSTNAME {name:\"www.google.com\"})-[:RESOLVES_TO]->(ip) RETURN ip.name LIMIT 3"}

MCP for agents at https://mcp.whisper.security. See MCP setup. Full API details: Cypher API.

There is no Domain or FQDN label — every name is a HOSTNAME. Every node has a name property. Labels marked (virtual) are synthesized at query time — reach them through an edge, never via a deep unanchored scan.

Core DNS & addressing — HOSTNAME (~2.6B), IPV4 (~619M), IPV6, PREFIX, ANNOUNCED_PREFIX (virtual), REGISTERED_PREFIX (virtual), TLD

Routing & org — ASN (AS13335), ASN_NAME, ORGANIZATION, TLD_OPERATOR

WHOIS & registration — REGISTRAR, EMAIL, PHONE, RDAP_ENTITY

Geo & DNSSEC — CITY, COUNTRY, DNSSEC_ALGORITHM

Threat intel — FEED_SOURCE (43, virtual), CATEGORY (25, virtual), THREAT_TAG (MISP-galaxy), THREAT_SIGNAL_TYPE, ACTOR (APT28), ATTACK_PATTERN (MITRE ATT&CK)

RPKI & routing observations — ROA, BGP_PATH_OBSERVATION

Physical infrastructure — FACILITY, INTERNET_EXCHANGE, SUBMARINE_CABLE, CABLE_LANDING, CDN_POP, DNS_ROOT_INSTANCE, CLOUD_REGION (aws:eu-west-1)

Egress, fingerprint & transparency — VENDOR, TOR_RELAY, TLS_FINGERPRINT (JA3/JARM), CT_OBSERVATION, DMARC_RECIPIENT

Directions are strict: a wrong-way traversal returns zero rows with no error. The arrow below is the stored direction; traverse backwards with <-[:EDGE]-.

DNS & web

BGP, routing & RPKI

WHOIS & registration

Geo

Threat intel & egress

Email security (SPF / DMARC / DKIM)

Physical infrastructure & CT

Virtual edges: ROUTES, HAS_NAME, CONFLICTS_WITH, ANNOUNCED_BY, and BELONGS_TO → CATEGORY are synthesized at query time. Write them as explicit single hops — never inside a variable-length [*1..N] pattern.

Host → network owner (attribution) — who hosts a domain and on whose AS:

MATCH (h:HOSTNAME {name:"github.com"})-[:RESOLVES_TO]->(ip:IPV4)
      -[:ANNOUNCED_BY]->(ap:ANNOUNCED_PREFIX)-[:ROUTES]->(a:ASN)-[:HAS_NAME]->(n:ASN_NAME)
RETURN ip.name, ap.name, a.name AS asn, n.name AS network LIMIT 5

IP → jurisdiction — (:IPV4)-[:LOCATED_IN]->(:CITY)-[:HAS_COUNTRY]->(:COUNTRY)

Blast radius (one indicator → the campaign) — pivot on shared infra:

MATCH (ip:IPV4 {name:"203.0.113.10"})<-[:RESOLVES_TO]-(h:HOSTNAME)
OPTIONAL MATCH (h)-[:HAS_EMAIL]->(e:EMAIL)<-[:HAS_EMAIL]-(sibling:HOSTNAME)
RETURN h.name, e.name, collect(DISTINCT sibling.name)[..20] AS shared_registrant LIMIT 25

Domain → mail / name servers (reverse traversal) — MATCH (d:HOSTNAME {name:"github.com"})<-[:MAIL_FOR]-(mx) RETURN mx.name LIMIT 10

MOAS / possible BGP hijack — MATCH (p:ANNOUNCED_PREFIX {name:"216.168.228.0/24"})-[:CONFLICTS_WITH]->(a:ASN) RETURN p.name, collect(a.name) LIMIT 25

IP → feeds → categories — (:IPV4)-[:LISTED_IN]->(:FEED_SOURCE)-[:BELONGS_TO]->(:CATEGORY)

ASN → physical footprint — (:ASN)-[:AS_PRESENT_AT]->(:FACILITY) and (:ASN)-[:IX_MEMBER]->(:INTERNET_EXCHANGE)-[:IX_HOSTED_AT]->(:FACILITY)

Actor → ATT&CK — MATCH (a:ACTOR {name:"APT28"})-[:USES_TECHNIQUE]->(t:ATTACK_PATTERN) RETURN t.name LIMIT 25

The Use Cases have copy-paste recipes per workflow.

Threat-listed IPV4 / IPV6 / HOSTNAME nodes carry the verdict inline, so one anchored read gives the whole posture — no extra hops:

MATCH (ip:IPV4 {name:"185.220.101.1"})
RETURN ip.threatScore, ip.threatLevel, ip.isThreat, ip.isTor, ip.isAnonymizer LIMIT 1

• threatScore (numeric), threatLevel (NONE … CRITICAL), and the flags isThreat, isTor, isAnonymizer.
• For the scored reasoning — feeds, weights, factors — call explain(). A NONE/clean read means "not listed at this granularity," not "safe."

Call from Cypher with CALL. Full signatures in Procedures.

explain() auto-detects the indicator type. exists: true from whisper.variants() means registered, not malicious — pivot the hit through explain() for a verdict.

Speed guide: anchored point lookups = instant · STARTS WITH / selective ENDS WITH ".dom" = fast · multi-hop + OPTIONAL MATCH = 1–5s · LINKS_TO traversals and full HOSTNAME scans = slow · unanchored label scans and regex =~ on HOSTNAME = avoid.

Check yours with CALL whisper.quota() YIELD key, value RETURN key, value. Get a free key · Pricing.

# keyless 2-hop sanity check
curl -s -A "whisper-client/1.0" https://graph.whisper.security/api/query \
  -H "Content-Type: application/json" \
  -d '{"query":"MATCH (h:HOSTNAME {name:\"www.google.com\"})-[:RESOLVES_TO]->(ip) RETURN h.name, ip.name LIMIT 3"}'

See also the Threat Feeds & Categories reference (43 feeds / 25 categories) and the Cypher API for the full endpoint reference.