Threat Investigation

Triage an indicator and the job is the same every time: pull context from half a dozen consoles before you can say whether the alert matters. WhisperGraph pre-joins those sources into one graph, so a single query returns the verdict, the network that routes the asset, where it sits, the feeds that list it (43 feeds across 25 categories), and everything co-hosted beside it.

From there each pivot stays on the same graph. You walk out from one indicator to the adversary infrastructure around it through a shared registrant, nameserver, or announcing ASN, then along the blast radius a compromise could reach. Relationships that flat lookup tools keep on separate screens, such as siblings on the same /24 or a shared upstream network, land in the same result set.

Verdicts carry their evidence. explain() returns the score together with the factors and the exact feeds behind it, each with weight and first/last-seen timestamps you can paste into a ticket. Coverage is explicit too: an indicator no feed lists comes back as no-data, so unknowns are never mistaken for clean.

Run these workflows in your browser

Every workflow below runs live at /use-cases and opens with a result already loaded; swap in your own indicator to re-run it. Anonymous runs are capped at 2 hops; a free API key raises that to 3, no card required.

Workflow	What it does
Indicator Investigation	Paste a domain, IP, ASN, or prefix and get a threat dossier: verdict, hosting, routing anomalies, and the shared infrastructure around it. CDN-aware, and batch-assesses a whole list.
Risk Vector Decomposition	Break one indicator's score into named, sourced risk vectors: listing feeds with weight and recency, threat classes, prefix neighborhood density, and ASN sub-scores.
Domain Risk Hotlist	Score a pasted domain list, rank it worst-first, and name the abuse feeds behind each verdict.
Portfolio Risk Scorecard	Bulk-score a watchlist of domains and IPs with a coverage axis that separates listed, known-clean, and no-data hosts.
Bulk Domain Enrichment	Hydrate a domain list with resolving IP, hosting ASN, registrar, registrant, nameservers, MX, DMARC, and a suspicion band in one batched run.
Map Adversary Infrastructure	Walk from one C2 domain across shared registrant, nameserver, and announcing ASN at once to surface campaign siblings.
Reverse-WHOIS Operator Cluster	Pivot a domain's registrant selectors out to every other asset the same operator registered, with evidence of which selector connected each.
Reverse-IP Co-Tenants	Every IP a domain resolves to, the hostnames sharing each address, and a per-IP dedicated-versus-shared verdict.
TLS-Fingerprint Cluster	From one IP to every other IP emitting the same JA3/JARM fingerprint, enriched with ASN, geo, and threat verdict.
Burner-Domain Detector	Flag short-lived, privacy-protected registrations and pivot on co-registrants.
Bulletproof-Hosting Detector	Flag abuse-tolerant ASNs, prefixes, and IPs by toxic-neighborhood density and bulletproof-hosting signals.
Tor Exit Exposure	Cluster every Tor exit relay an ASN routes by CIDR prefix, announced prefix, and country.
Technique-Convergence Attribution	Rank actors whose tradecraft converges on an observed ATT&CK technique set, weighting rare techniques over commodity ones.
Threat-Hunting Candidate Sweep	A corpus-level hunt with no seed: surface multi-tenant phishing apexes and shared-hosting IPs with malicious tenants.
Time Machine	Diff an indicator's WHOIS and BGP state between its two most recent snapshots.
Attack Path Analysis	From one foothold, find the DNS and registrant choke points, the pivots that cluster its infrastructure, and how close it sits to known-bad.
Dependency Blast Radius	Fan out everything that depends on one asset, round by round, and flag the single points of failure.
Submarine Cable Jurisdictions	Trace the sovereign jurisdictions a subsea cable transits and the co-landing chokepoints where one state sits astride many cables.

Copy-paste recipes

The recipe pages give you the same investigations as Cypher you run yourself, with each query's depth and anchoring explained:

• Indicator Triage (SOC) takes a raw indicator to a reconciled verdict, network attribution, and an evidence chain.
• Campaign Pivoting expands one IOC into the campaign around it: shared registrants, co-tenant hosts, TLS fingerprints, Tor egress.
• Attack Paths & Blast Radius traces the external attack path between organizations and finds the choke point that severs the most routes.

The pivots these recipes are built from are cataloged in Cross-Layer Patterns. For what each feed covers and how the reconciled verdict is computed, see Threat Feeds & Categories.