Graph Schema Reference

WhisperGraph has two kinds of structure. Most nodes and edges are stored directly. A second set — the virtual infrastructure and threat-intelligence layers — is synthesized at query time from live data. Virtual edges behave like stored edges in almost every way, with one rule that matters: you must anchor the source node before traversing a virtual edge. More on that under Edge types.

There is no DOMAIN or FQDN label. Every DNS name — including nameservers and mail servers — is a HOSTNAME.

CALL db.labels() returns all 20 labels with live row counts.

Edges have a direction. A wrong-direction traversal returns zero rows with no error, so direction matters — you can always traverse an edge backwards by writing <-[:TYPE]-. The tables below give the storage direction.

DNS resolution

BGP and routing

WHOIS and registration

Geo

Threat intelligence

Web

SPF

Registry

Virtual edges must be anchored

Some edges are physical (stored directly), some are virtual (synthesized at query time), and a few are a mix. The virtual and mixed edges — ANNOUNCED_BY, ROUTES into ANNOUNCED_PREFIX, HAS_NAME, BELONGS_TO into REGISTERED_PREFIX, LISTED_IN, CONFLICTS_WITH, and OPERATES — are only produced when the source node of the traversal is anchored. An unanchored probe like MATCH (a:ASN)-[:HAS_NAME]->(n) returns nothing; the anchored form MATCH (a:ASN {name: "AS13335"})-[:HAS_NAME]->(n) returns CLOUDFLARENET - Cloudflare, Inc. Always anchor before traversing a virtual edge, and never put a virtual edge inside a variable-length pattern. To chain two virtual edges (for example LISTED_IN into BELONGS_TO), insert a WITH between them so the intermediate node is materialised before the second hop.

Click to expandEntity Relationship Diagram

Solid lines are physical edges stored on disk. Dashed lines are virtual edges computed at query time from live infrastructure and threat intelligence data.

These are the most common traversal chains through the graph.

Domain to network owner:

HOSTNAME -[:RESOLVES_TO]-> IPV4 -[:ANNOUNCED_BY]-> ANNOUNCED_PREFIX -[:ROUTES]-> ASN -[:HAS_NAME]-> ASN_NAME

Domain to nameservers:

HOSTNAME(ns) -[:NAMESERVER_FOR]-> HOSTNAME(domain)

Domain to mail servers:

HOSTNAME(mx) -[:MAIL_FOR]-> HOSTNAME(domain)

IP to GeoIP location:

IPV4 -[:LOCATED_IN]-> CITY -[:HAS_COUNTRY]-> COUNTRY

IP to threat feeds:

IPV4 -[:LISTED_IN]-> FEED_SOURCE -[:BELONGS_TO]-> CATEGORY

Domain WHOIS chain:

HOSTNAME -[:HAS_REGISTRAR]-> REGISTRAR
HOSTNAME -[:HAS_EMAIL]-> EMAIL
HOSTNAME -[:REGISTERED_BY]-> ORGANIZATION

DNS hierarchy:

HOSTNAME -[:CHILD_OF]-> HOSTNAME(parent) -[:CHILD_OF]-> TLD

RIR allocation chain:

IPV4 -[:BELONGS_TO]-> REGISTERED_PREFIX -[:REGISTERED_BY]-> ORGANIZATION

Registry operator:

TLD_OPERATOR -[:OPERATES]-> TLD