Procedures
What WhisperGraph's stored procedures do, which ones have a page of their own, and where the full column contracts live.
In this section
- Coverage — what we looked atEvery Whisper verdict answers two questions: how bad, and what we actually looked at. Read coverage before band.
- explain() — Threat VerdictsScored threat verdicts for IPs, hostnames, ASNs, CIDRs, file hashes and CVE ids, with the factors and feed sources behind each score.
- whisper.assessUrl() — URL verdictsA verdict for a full URL, reconciling the apex band with the path band, so a bad path on a clean host doesn't hide behind its reputation.
- whisper.variants() — Lookalike GenerationGenerate typosquat and homoglyph lookalikes of a domain, keep only the registered ones, and pivot the hits straight into a threat verdict.
- whisper.history() — Point-in-TimeWHOIS registration and BGP routing history for any indicator, as timestamped snapshots you can diff.
- whisper.origins() — Origin DiscoveryDe-cloak a CDN-fronted domain to its real origin IPs, ranked by confidence and how they were found.
- whisper.identify() — Identity & AssessmentAnswer whose infrastructure a host is, whether it's dangerous, and what sits around it. The identity family: identify, assess, walk.
- Helpers — Naming & LookupsUtility procedures: apex/public-suffix tests, network rankings, Tor and TLS lookups, typed search, DNS resolution, CVEs, bulk export.
- Procedure ReferenceThe complete calling contract for every stored procedure: how CALL binds its arguments, and the exact YIELD columns of every family.
On this page (1)
Procedures Documentation
WhisperGraph registers 53 stored procedures you call from Cypher with CALL. Each folds a multi-step computation — threat scoring, lookalike generation, WHOIS and BGP history, origin discovery, infrastructure identity, CVE posture — into one call that returns a clean result set instead of a hand-written traversal.
The procedures with a page of their own
- Coverage — what
whisper.assess()andwhisper.assessUrl()actually looked at, and why to read it before you read the band. explain()— a scored, feed-by-feed threat verdict for an indicator, with the arithmetic and the named feeds behind it.whisper.identify()— who runs a host, with the assess and walk calls that sit beside it.whisper.assessUrl()— a verdict scoped to a URL path rather than to the host serving it.whisper.variants()— lookalike domains for a name, each flagged by whether it is registered.whisper.history()— point-in-time WHOIS and BGP records for an indicator.whisper.origins()— candidate origin addresses behind a CDN, scored by independent evidence, passively.- Helpers — the naming, ranking, lookup, CVE and export calls you reach for inside a larger query.
The procedure reference carries the rest: how CALL binds its arguments, the exact YIELD columns of every family, the advisories channel, and the whole registered surface.
Read
coveragebeforeband. Only known-clean — coverage: known-clean. In coverage, no malicious evidence. licenses the word "clean"; no-data — coverage: no-data. Not in coverage. This is not a verdict — nothing was looked at. means unknown, which is a different thing again; malicious-evidenced — coverage: malicious-evidenced. In coverage, with positive evidence of malice. and ambiguous — coverage: ambiguous. In coverage, and the evidence points both ways. mean there is evidence, whatever the band says. Full contract: Coverage — what we looked at.
A call looks like this, with YIELD naming the columns you want:
CALL whisper.variants("paypal.com")
YIELD variant, method, exists, confidenceLabel
WHERE exists
RETURN variant, method, confidenceLabel
LIMIT 6
Scores and verdicts are live reads: the value reflects whatever data is loaded at query time. Some calls need an API key, passed in the X-API-Key header — sign in to get one.