Getting Started

Every investigation starts with an indicator: a hostname in a log, an IP on an alert. You need to know where it lives, who routes it, and whether anyone has flagged it. Flat lookup tools answer one layer at a time; in WhisperGraph the layers are already joined, so one query does the whole walk. The example below investigates github.com four hops out from the seed: DNS resolution to its IPs, the BGP prefix announcing each IP, the network that routes the prefix and its registered name, the country each IP sits in, and any threat feeds that list it.

curl -s -X POST https://graph.whisper.security/api/query \
  -H "Content-Type: application/json" \
  -H "X-API-Key: $WHISPER_API_KEY" \
  -d "{\"query\":\"MATCH (h:HOSTNAME {name: \\\"github.com\\\"})-[:RESOLVES_TO]->(ip:IPV4)-[:ANNOUNCED_BY]->(p:ANNOUNCED_PREFIX)-[:ROUTES]->(a:ASN) OPTIONAL MATCH (a)-[:HAS_NAME]->(n:ASN_NAME) OPTIONAL MATCH (ip)-[:HAS_COUNTRY]->(co:COUNTRY) OPTIONAL MATCH (ip)-[:LISTED_IN]->(f:FEED_SOURCE) RETURN ip.name AS ip, p.name AS prefix, a.name AS asn, n.name AS network, co.name AS country, collect(DISTINCT f.name)[0..5] AS feeds LIMIT 25\"}"

To run it, sign in. The free tier covers this query and there is no card to enter. Anonymous runs are capped at 2 traversal hops, which is why a walk this deep asks for an account. Once it runs, open the widget's Raw view to see the exact response the API sent back.