Search Commands

Diagram

whisperlookup

Streaming command that enriches events with IOC context from the Knowledge Graph. It appends enrichment fields to each event inline.

Syntax

| whisperlookup field=<field_name> [type=auto|domain|ip] [include_threat_intel=true|false] [include_cname=true|false] [include_nameserver=true|false] [include_feeds=true|false] [add_prefix=<prefix>]

Parameters

Output fields

For domain enrichment, these fields are appended (with the configured prefix):

The inline threat fields also include:

For IP enrichment, the same threat fields apply plus:

Inline threat data: whisper_threat_score and the boolean whisper_is_* fields come from inline properties on the IPV4 node in the graph. The explain() API is only called when those inline properties are absent. It returns explanation text, per-feed sources, and first/last seen dates. Both paths populate whisper_threat_score and whisper_threat_level.

CIM field aliases are also created:

Examples

Enrich firewall logs with domain context:

index=firewall sourcetype=pan:traffic
| whisperlookup field=dest_host type=domain
| where whisper_threat_score > 50
| table _time dest_host whisper_asn_name whisper_threat_level whisper_feed_names

Enrich IP addresses with auto-detection:

index=proxy sourcetype=squid
| whisperlookup field=src_ip
| stats count by whisper_asn_name whisper_country

Domain enrichment without threat intel (faster):

index=dns sourcetype=dns
| whisperlookup field=query type=domain include_threat_intel=false include_feeds=false
| table query whisper_ip whisper_asn whisper_asn_name whisper_cohost_count

Custom field prefix:

index=web sourcetype=access_combined
| whisperlookup field=clientip type=ip add_prefix="w_"
| table clientip w_asn_name w_country w_threat_level

Private IP addresses: Private IP addresses (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) are automatically skipped — no API call is made and no enrichment fields are added.

Caching: Results are automatically cached in the whisper_enrichment_cache KV Store collection. Subsequent lookups for the same indicator within the TTL window (default: 1 hour) are served from cache without an API call. Use | whisperflush to clear the cache.

whisperquery

Generating command that runs ad-hoc Cypher queries against the Knowledge Graph.

Syntax

| whisperquery query="<cypher_query>" [params="<parameters>"] [params_b64="<base64_json>"] [max_results=<N>]

Parameters

Examples

Look up a domain's infrastructure:

| whisperquery query="MATCH (h:HOSTNAME {name: $domain})-[:RESOLVES_TO]->(ip:IPV4)-[:BELONGS_TO]->(p:PREFIX)<-[:ROUTES]-(a:ASN)-[:HAS_NAME]->(n:ASN_NAME) RETURN h.name AS hostname, ip.name AS ip, p.name AS prefix, a.name AS asn, n.name AS asn_name LIMIT 10" params="domain=example.com"

Find co-hosted domains:

| whisperquery query="MATCH (h:HOSTNAME {name: $domain})-[:RESOLVES_TO]->(ip:IPV4)<-[:RESOLVES_TO]-(cohost:HOSTNAME) WHERE cohost.name <> $domain RETURN ip.name AS ip, cohost.name AS cohost LIMIT 100" params="domain=example.com"

Get ASN routing information:

| whisperquery query="MATCH (a:ASN {name: $asn})-[:ROUTES]->(p:PREFIX) RETURN a.name AS asn, p.name AS prefix LIMIT 200" params="asn=AS13335"

Use JSON parameters:

| whisperquery query="MATCH (h:HOSTNAME {name: $domain}) RETURN h LIMIT 1" params='{"domain": "example.com"}'

Warning: Queries containing CREATE, DELETE, SET, MERGE, DROP, REMOVE, or DETACH keywords are rejected before being sent to the API. The Knowledge Graph is read-only.

whisperschema

Generating command that shows the Knowledge Graph schema -- node labels, relationship types, property keys, and metadata (descriptions, examples, counts, query patterns).

Syntax

| whisperschema mode=<labels|relationships|properties|schema|full>

Parameters

Modes

All events include a whisper_schema_mode field for filtering.

Schema mode output fields

When using mode=schema or mode=full, each event includes all fields listed below. Fields that do not apply to a particular event type (e.g., sourceLabels on a node event) are present as empty strings. This ensures all events have a uniform field set, which is required by the Splunk chunked v2 protocol for correct field display.

Examples

List all node types in the graph:

| whisperschema mode=labels

List all relationship types:

| whisperschema mode=relationships

List all property keys:

| whisperschema mode=properties

Explore the full schema with descriptions and examples:

| whisperschema mode=schema
| search type=node
| table name, count, description, example

View query best practices:

| whisperschema mode=schema
| search type=tips
| table bestPractices, fastPatterns, slowPatterns

Get combined schema and property keys:

| whisperschema mode=full
| stats count by whisper_schema_mode

whisperflush

Generating command that flushes the enrichment cache. Requires admin or sc_admin role.

Syntax

| whisperflush [collection=cache|precomputed|all]

Parameters

Targets

Examples

Flush the enrichment cache:

| whisperflush

Flush pre-computed enrichments:

| whisperflush collection=precomputed

Flush everything:

| whisperflush collection=all

whisperevict

Generating command that evicts expired entries from the enrichment cache using the KV Store REST API. More efficient than loading all records through the SPL pipeline, especially for large caches. This command is used by the "Whisper - Evict Expired Cache Entries" saved search.

Syntax

| whisperevict

How it works

The command uses two phases:

1. Bulk delete: Queries the KV Store for expired entries with the default TTL and deletes them in a single REST API call.
2. Custom TTL: Scans entries with non-default TTLs and deletes expired ones individually.

This avoids loading all cache records into the search pipeline, which matters for large caches.

Output fields

Examples

Run cache eviction manually:

| whisperevict