# Changelog > WhisperGraph documentation and product changelog — track API additions, schema changes, Splunk add-on releases, and breaking changes over time. *Source: https://www.whisper.security/docs/whisper-graph/changelog* --- A running log of what's new on the public WhisperGraph — new data layers, query capabilities, and agent tools. Everything listed here is live and reproducible at [graph.whisper.security](https://graph.whisper.security). Changes to the MCP connector's own contract — tools, resources, prompts and response fields — are logged separately on the Agents & MCP chapter's [Changelog](/docs/ai/mcp/changelog). **Key concepts:** [Certificate Transparency](/glossary/certificate-transparency), [RPKI / Route Origin Authorization](/glossary/rpki-roa), [MITRE ATT&CK](/glossary/mitre-attack). ## 2026-08 - **Vulnerability plane.** `whisper.cve.byPackage()` returns the known CVEs for a CPE 2.3 package spec — band, KEV status, ransomware use, EPSS and CVSS — and `whisper.vulnPosture()` rolls exposure up into one row for a CVE list, a package spec or an ASN. `explain()` and `whisper.assess()` accept CVE ids and file hashes, and known-good hashes are clamped to informational. See [Procedures](/docs/whisper-graph/procedures). - **Bulk export.** `whisper.export({label, limit, cursor})` pages through a whole verdict tier — `malicious`, `ambiguous` or `benign-allowlisted` — with an opaque continuation cursor. See [Exporting at volume](/docs/guides/bulk-export). - **Batch enrichment.** `whisper.enrich()` returns owner, country, ASN, band and prevalence for a list of hosts or IPs in one call. - **Subdomain-takeover check.** `whisper.danglingCname()` returns CNAME targets whose apex is unregistered. - **Phishing-kit paths.** URL paths that kits reuse are `URL` nodes joined to the hosts that serve them by `LINKS_TO` and ranked by how rare each path is across the graph, so a kit can be expanded to its member hosts and clustered across apexes. - **Registrant handles in the graph.** Prefixes and ASNs link to their RDAP registrant entities through `REGISTERED_TO_ENTITY`. - **Routing security signals.** A ROA that covers a more-specific block now links to it; ASNs carry hijack-posture and route-leak signals; peering edges (`BGP_NEIGHBOR`) carry the relationship class between the two networks (`relClass`) and their provenance. New curated signals name bulletproof-hosting, critical-infrastructure, satellite and declining networks, and wildcard-DNS hosts. - **Actor aliases and malware context.** `ACTOR.aliases` holds the vendor names an actor is known by, and an indicator's MISP tag links onward to the named actor. - **Computed edges in paths.** Query-time edges such as `ROUTES`, `BGP_NEIGHBOR` and `LISTED_IN` now work inside `[*1..N]` and `shortestPath()` patterns when one endpoint is anchored. - **One company, one node.** `SAME_ORG_AS` folds a raw WHOIS registrant string to the company it actually is, so a portfolio view no longer splits one owner into several spellings, and organization display names answer `STARTS WITH` lookups. - **Errors are RFC 7807.** Every error body is `application/problem+json` with a stable `type` URI, `title`, `status`, `detail` and `instance`, and query errors carry `suggestions[]` with a runnable rewrite where one exists. See [Errors](/docs/cypher-api/errors). - **Band-consistent `verdictScore`.** `explain()` and `whisper.assess()` return a `verdictScore` that always agrees with the band, and `explain()` now scores networks and ASNs as aggregates over the range. ## 2026-07 - **Path-scoped verdicts.** `whisper.assessUrl()` scores a full URL, so a malicious path on an otherwise clean apex is caught, and `whisper.assess()` accepts a single host as well as a list. See [`whisper.assessUrl()`](/docs/whisper-graph/procedures/assess-url). - **Response advisories.** A successful response can carry an `advisories[]` channel — non-fatal notices such as a null pagination parameter, a WHOIS parent fold or an omitted verdict projection — so a caveat is a field rather than a guess. See [POST /api/query](/docs/cypher-api/reference/query-post). - **Forgiving input.** Labels from other graph products (`Domain`, `IpAddress`, `Certificate`) are corrected or answered with a clear error naming the replacement; procedures accept a URL and fold it to its host; `whisper.version()` reports the engine version. - **New procedures.** `whisper.resolve()` returns a host's A and AAAA records; `whisper.asnCountries()` and `whisper.asnThreatDensity()` profile networks; `whisper.search()` also matches network names; `whisper.identify()` attributes a bare IP through its netblock or BGP origin. - **Indicator attribution.** `TAGGED_AS` and `ATTRIBUTED_TO` link indicators to MISP tags and named actors, traversable from the actor side as well, and `BGP_PATH` links an observed AS path to each network on it. - **Route-origin validation on prefixes.** `rpkiStatus`, `roaAsn` and `roaMaxLength` on announced prefixes, `prefix` on ROA nodes, and per-edge provenance (`source`, `observed_at`, `inferred`) on inferred physical-infrastructure edges. - **Egress risk and popularity.** Hosts and IPs carry `isEgressRisk` and `egressClasses`; hostnames carry a popularity `rank`; a first-class `scam` category joins the taxonomy; and feed sources expose `isThreat`, `isPopularity` and `category`, so a popularity list never reads as a threat list. - **`whisper.origins` confidence is a probability.** `confidence` is a value between 0 and 1 rather than an integer weight, and CDN or shared-provider addresses are excluded unless you pass `{include_related: true}`. See [`whisper.origins()`](/docs/whisper-graph/procedures/origins). - **Layer coverage in the statistics.** `GET /api/query/stats` reports each query-time layer's coverage (`OK` / `DEGRADED` / `EMPTY`) and last refresh, so a thin layer is visible before you trust a result. - **Reverse feed enumeration.** List everything a feed lists by traversing `LISTED_IN` from an anchored feed, and walk from a country to a bounded sample of its addresses. ## 2026-06 - **Reconciled threat verdict.** Every threat-listed indicator now returns a single, blocking-aware verdict — `verdictScore`, `verdictLevel`, and `verdictBlocking` — alongside the raw feed signals, so triage is one read instead of a judgement call. See [Graph Schema → Node properties](/docs/whisper-graph/schema). - **TLS fingerprints, Tor-exit identity, and vendor egress.** Pivot on JA3/JARM TLS fingerprints, attribute Tor exit relays to the IPs that operate them, and see which cloud or SaaS vendor operates a netblock. - **Certificate Transparency.** Discover subdomains and SANs observed in CT logs. - **Agent tools for AI Context (MCP).** The host-identity set — `identify` (whose infrastructure a host is), `assess` (a coverage-qualified verdict), and `walk` (structural neighborhood) — plus CDN-origin de-cloaking with `whisper.origins()`. See the [Procedure Reference](/docs/whisper-graph/procedures). - **Bounded analyst search.** `whisper.search()` resolves an untyped token — IP, host, ASN, CIDR, prefix or suffix — without an unanchored scan. ## 2026-05 - **Physical-infrastructure layer.** Data-center facilities, internet exchanges, submarine cables and their landing points, CDN points of presence, and cloud regions — the physical internet, joined to routing. - **RPKI ROA coverage.** Check whether a prefix's origin AS is authorized by a published Route Origin Authorization. - **Threat-actor → MITRE ATT&CK mapping.** Named actors linked to the techniques they use. - **BGP path & adjacency graph.** AS-path observations and a single canonical ASN-to-ASN adjacency edge. - **Typosquat / lookalike generation.** `whisper.variants` (and the `domain_variants` agent tool) generate registered lookalikes across 14+ mutation methods. ## 2026-03 - **RDAP registration data.** Registrant entities ingested from regional-registry WHOIS/RDAP. --- Counts and capabilities are always live — `GET /api/query/stats` reports current totals.