Functions

The built-in function library WhisperGraph Cypher ships — aggregation, string, numeric, collection, node, type-conversion, and date functions.

Updated July 2026

WhisperGraph Cypher ships a function library you use inside RETURN, WITH, and WHERE. The tables below give the call and the value it returns. For the clauses that hold these functions, see Syntax & Clauses; for the CALL procedures (explain, whisper.variants, whisper.history, whisper.origins), see Procedures.

Aggregation

Aggregations collapse rows; any non-aggregated column in the same RETURN or WITH becomes a grouping key.

Function	Example	Result
`count`	`count(c)`	row count
`count(DISTINCT ...)`	`count(DISTINCT ip)`	distinct count
`sum`	`sum(x)` over `[1,2,3,4]`	`10`
`avg`	`avg(x)` over `[2,4,6]`	`4.0`
`min` / `max`	`min(x)` / `max(x)` over `[5,2,8]`	`2` / `8`
`collect`	`collect(c.name)[0..3]`	a list
`collect(DISTINCT ...)`	`collect(DISTINCT x)` over `[1,1,2]`	`[1,2]`

String

Function	Example	Result
`toUpper` / `upper`	`toUpper("abc")`	`ABC`
`toLower` / `lower`	`toLower("ABC")`	`abc`
`trim` / `ltrim` / `rtrim`	`trim(" hi ")`	`hi`
`replace`	`replace("foobar","bar","baz")`	`foobaz`
`substring`	`substring("hello",1,3)`	`ell`
`split`	`split("a,b,c",",")`	`["a","b","c"]`
`left` / `right`	`left("hello",2)`	`he`
`reverse`	`reverse("abc")`	`cba`
`toString`	`toString(123)`	`123`

String concatenation uses +.

Numeric

Function	Example	Result
`abs`	`abs(-5)`	`5`
`ceil` / `floor`	`ceil(4.2)` / `floor(4.8)`	`5.0` / `4.0`
`round`	`round(4.5)`	`5`
`sign`	`sign(-3)`	`-1`
`sqrt`	`sqrt(16)`	`4.0`
`log` / `log10` / `exp`	`log10(1000)`	`3.0`
`rand`	`rand()`	a value in [0,1)
`e` / `pi`	`pi()`	π

Arithmetic operators: +, -, *, /, %, ^ (exponent).

Trigonometric

Function	Example	Result
`sin` / `cos` / `tan`	`cos(0)`	`1`
`asin` / `acos` / `atan` / `atan2`	`atan2(0,1)`	`0`
`degrees`	`degrees(pi())`	`180`
`radians`	`radians(180)`	π

Collection

Function	Example	Result
`size`	`size([1,2,3])`	`3`
`head` / `last`	`head([10,20,30])`	`10`
`tail`	`tail([10,20,30])`	`[20,30]`
`range`	`range(1,5)`	`[1,2,3,4,5]`
`reverse`	`reverse([1,2,3])`	`[3,2,1]`
`keys`	`keys(node)`	property keys
`isEmpty`	`isEmpty([])`	`true`

Node and relationship

Function	Example	Result
`id` / `elementId`	`id(n)`	a node id
`labels`	`labels(n)`	`["ASN"]`
`type`	`type(r)`	`RESOLVES_TO`
`properties`	`properties(n)`	a property map
`startNode` / `endNode`	`startNode(r).name`	a node
`nodes` / `relationships`	`size(nodes(p))`	path length

Type conversion

Function	Example	Result
`toInteger` / `toInt`	`toInteger("42")`	`42` (bad input → `null`)
`toFloat`	`toFloat("3.14")`	`3.14`
`toBoolean`	`toBoolean("true")`	`true`
`toIntegerList` / `toFloatList` / `toStringList` / `toBooleanList`	`toIntegerList(["1","2"])`	`[1,2]`

Input that cannot be parsed yields null rather than an error — toInteger("abc") returns null.

Date and time

Function	Example	Result
`timestamp`	`timestamp()`	epoch millis
`date`	`toString(date())`	`2026-06-17`
`datetime` / `localdatetime` / `time`	`datetime()`	a datetime
`duration`	`duration("P1D")`	a duration

Geospatial and misc

Function	Example	Result
`point`	`point({x:1.0,y:2.0})`	a point
`distance`	`distance(point({x:0,y:0}), point({x:3,y:4}))`	geographic distance (x,y treated as lon,lat)
`coalesce`	`coalesce(a.missing, "default")`	`default`
`randomUUID`	`randomUUID()`	a UUID string

Reading threat properties off a node

You do not need a function to read a verdict — the threat posture lives directly on the node. An IPV4 node carries threatScore, threatLevel, isThreat, isTor, and isAnonymizer, so a single anchored read gives you the whole posture with no extra hops.

MATCH (ip:IPV4 {name: "185.220.101.1"})
RETURN ip.name AS ip, ip.threatScore AS score, ip.threatLevel AS level,
       ip.isThreat AS isThreat, ip.isTor AS isTor, ip.isAnonymizer AS isAnonymizer
LIMIT 1

For the scored reasoning behind a verdict — the feeds, weights, and factors — call explain(). See explain() — Threat Verdicts.

PreviousSyntax & Clauses NextBest Practices