WhisperGraph

What the graph contains: every layer of the internet pre-joined into one connected graph, and where to go deeper.

Published 6 July 2026Last updated 4 October 2026

In this chapter

Graph Schema3 pagesHow WhisperGraph is structured: the internet as one connected graph, joined layer to layer. Start here, then drill into entities and pivots.
Getting StartedRun your first query without a key, then investigate an indicator across the DNS, routing, geo, and threat layers in one request.
Threat Feeds & CategoriesEvery threat-intel feed and category in the graph, with refresh cadence, verdict properties, and example queries.
Procedures9 pagesWhat WhisperGraph's stored procedures do, which ones have a page of their own, and where the full column contracts live.
ChangelogWhat changed in the WhisperGraph engine: schema, procedures and the query API, release by release.

WhisperGraph models the internet as one connected graph. Naming and DNS, addressing and geography, network and routing, ownership and registration, email security, certificates and TLS, threat intelligence, threat actors, physical infrastructure, company and technology (for accounts with company-data access), and phishing-kit paths each sit as a layer, joined to the next. Anchor on a hostname and one statement walks to its address, the prefix that announces it, the network that routes it, a facility its network is present in, and every feed that lists it.

Diagram: the layers of WhisperGraph and the edges that join them. A HOSTNAME RESOLVES_TO an IPV4 in the addressing layer; the IPV4 is ANNOUNCED_BY an ANNOUNCED_PREFIX in the routing layer, which an ASN ROUTES; the ASN is AS_PRESENT_AT a FACILITY in the physical layer. Side branches run from the same walk: the HOSTNAME DMARC_REPORTS_TO a DMARC_RECIPIENT in the email layer, the IPV4 is LISTED_IN a FEED_SOURCE in the threat layer, and the ASN is REGISTERED_BY an ORGANIZATION in the ownership layer. A bottom row joins three more layers: a HOSTNAME is SEEN_IN_CT a CT_OBSERVATION in the certificates layer, an IPV4 is ATTRIBUTED_TO an ACTOR in the threat actors layer, and a HOSTNAME RUNS_TECHNOLOGY of a TECHNOLOGY in the company layer, for accounts with company-data access. — Which edge carries a query from one layer of the graph into the next?

Planes differ in how much they hold. On a thin one, a zero-row result means Whisper holds no observation of that indicator, never that there is nothing to find.

The chapter map above lists every page here. Start with the Graph Schema if you want the label and edge names, or go straight to Recipes for copy-paste Cypher by job.

A chain that crosses layers needs an API key, passed in the X-API-Key header. Sign in to get one — there is no card to enter.

In this chapter

WhisperGraph Documentation