# Procedures

> The WhisperGraph stored procedures: which ones have a page of their own, what each answers, and where the full column contracts live.

*Source: https://www.whisper.security/docs/whisper-graph/procedures*
*Published: 2026-06-18*
*Last updated: 2026-10-01*

---
WhisperGraph registers 53 stored procedures you call from Cypher with `CALL`. Each folds a multi-step computation — threat scoring, lookalike generation, WHOIS and BGP history, origin discovery, infrastructure identity, CVE posture — into one call that returns a clean result set instead of a hand-written traversal.

![Diagram: on the left, the traversal a query writes by hand: a HOSTNAME RESOLVES_TO an IPV4, which is ANNOUNCED_BY an ANNOUNCED_PREFIX that an ASN ROUTES. On the right, CALL whisper.enrich returns the same answer as one row: name, asn (the origin network of one resolved address), owner (that network's operator), country (its registration country), band and coverage. Rows come back by canonical name, not in input order.](/media/Po-AWkRfMdSf3ODW_whisper-procedure-fold.svg "What does a procedure fold into one call?")

## The procedures with a page of their own

- [Coverage](/docs/whisper-graph/procedures/coverage) — what `whisper.assess()` and `whisper.assessUrl()` actually looked at, and why to read it before you read the band.
- [`explain()`](/docs/whisper-graph/procedures/explain) — a scored, feed-by-feed threat verdict for an indicator, with the arithmetic and the named feeds behind it.
- [`whisper.identify()`](/docs/whisper-graph/procedures/identify) — who runs a host, with the assess and walk calls that sit beside it.
- [`whisper.assessUrl()`](/docs/whisper-graph/procedures/assess-url) — a verdict scoped to a URL path rather than to the host serving it.
- [`whisper.variants()`](/docs/whisper-graph/procedures/variants) — lookalike domains for a name, each flagged by whether it is registered.
- [`whisper.history()`](/docs/whisper-graph/procedures/history) — point-in-time WHOIS and BGP records for an indicator.
- [`whisper.origins()`](/docs/whisper-graph/procedures/origins) — candidate origin addresses behind a CDN, scored by independent evidence, passively.
- [Helpers](/docs/whisper-graph/procedures/helpers) — the naming, ranking, lookup, CVE and export calls you reach for inside a larger query.

The [procedure reference](/docs/whisper-graph/procedures/reference) carries the rest: how `CALL` binds its arguments, the exact `YIELD` columns of every family, the advisories channel, and the whole registered surface.

> **Read `coverage` before `band`.** Only `known-clean` licenses the word "clean"; `no-data` means
> *unknown*, which is a different thing again; `malicious-evidenced` and `ambiguous` mean there is
> evidence, whatever the band says.
> Full contract: [Coverage — what we looked at](/docs/whisper-graph/procedures/coverage).

A call looks like this, with `YIELD` naming the columns you want:

```cypher expect=rows>0 seed=paypal.com verified=2026-09-02
CALL whisper.variants("paypal.com")
YIELD variant, method, exists, confidenceLabel
WHERE exists
RETURN variant, method, confidenceLabel
LIMIT 6
```

Scores and verdicts are live reads: the value reflects whatever data is loaded at query time. Some calls need an API key, passed in the `X-API-Key` header — [sign in](https://console.whisper.security/sign-in?redirect_url=https%3A%2F%2Fwww.whisper.security%2Fdocs%2Fwhisper-graph%2Fprocedures) to get one.