Getting Started

Every investigation starts with an indicator: a hostname in a log, an IP on an alert. You need to know where it lives, who routes it, and whether anyone has flagged it. Flat lookup tools answer one layer at a time; in WhisperGraph the layers are already joined, so one query does the whole walk. The example below investigates github.com four hops out from the seed: DNS resolution to its IPs, the BGP prefix announcing each IP, the network that routes the prefix and its registered name, the country each IP sits in, and any threat feeds that list it.

curl -s -X POST https://graph.whisper.security/api/query \
  -H "Content-Type: application/json" \
  -H "X-API-Key: $WHISPER_API_KEY" \
  -d "{\"query\":\"MATCH (h:HOSTNAME {name: \\\"github.com\\\"})-[:RESOLVES_TO]->(ip:IPV4)-[:ANNOUNCED_BY]->(p:ANNOUNCED_PREFIX)-[:ROUTES]->(a:ASN) OPTIONAL MATCH (a)-[:HAS_NAME]->(n:ASN_NAME) OPTIONAL MATCH (ip)-[:HAS_COUNTRY]->(co:COUNTRY) OPTIONAL MATCH (ip)-[:LISTED_IN]->(f:FEED_SOURCE) RETURN ip.name AS ip, p.name AS prefix, a.name AS asn, n.name AS network, co.name AS country, collect(DISTINCT f.name)[0..5] AS feeds LIMIT 25\"}"

A walk this deep needs an account, so sign in to run it — there is no card to enter. Once it runs, open the widget's Raw view to see the exact response the API sent back.