whisper.identify() — Identity & Assessment

whisper.identify() resolves a host to the vendor or service that operates it. Pass one host or a batch (1 to 256 per call — larger batches are rejected, not truncated) and it returns the canonical identity plus the evidence behind it.

CALL whisper.identify(["api.stripe.com", "cdn.shopify.com"])
YIELD host, vendor_id, canonical_name, category, roles, host_class, band
RETURN host, vendor_id, canonical_name, category, host_class, band

Use it to label infrastructure at scale — attributing a list of hostnames from a log or an alert to the services behind them, without a hop-by-hop traversal per host.

whisper.assess() answers the safety question, and — critically — tells you what it actually looked at. It accepts a single host as a bare string or a batch as a list; both return the same seven columns: CALL whisper.assess("github.com") returns band: INFO, coverage: known-clean.

CALL whisper.assess(["example.com", "185.220.101.1"])
YIELD host, label, band, coverage, signals, evidence
RETURN host, label, band, coverage

Every Whisper verdict answers two independent questions. band tells you how bad. coverage tells you what we actually looked at. Read both. They are a grid, not a ladder.

Only known-clean — coverage: known-clean. In coverage, no malicious evidence. licenses the word "clean". Every other value is not-clean — and no-data — coverage: no-data. Not in coverage. This is not a verdict — nothing was looked at. and deadline-hit mean unknown, which is a different thing again.

whisper.assess and whisper.assessUrl return coverage. whisper.explain does not.

Every one of these arrives as a populated row. no-data — coverage: no-data. Not in coverage. This is not a verdict — nothing was looked at. is a row that says no-data — coverage: no-data. Not in coverage. This is not a verdict — nothing was looked at.; it is never an empty result set. If a query returns zero rows, the first hypothesis is that the query is wrong, not that the host is clean.

Which procedure carries coverage —:

structural-onlywalk — a whisper.walk value describing atlas adjacency. Not an assess coverage value. Do not gate on it. is a whisper.walk value describing atlas adjacency. It is not a whisper.assess value, and a branch keyed on it in an assess result is unreachable — see the full contract.

When whisper.identify() has no direct match, whisper.walk() returns a bounded structural neighborhood — the host's siblings and the nearest known vendors — so you still get context to reason about an unknown host. It is depth- and budget-bounded so it stays fast on large networks.

CALL whisper.walk("unknown-host.example", 2, 800)
YIELD host, no_atlas_match, nearest_known_vendors, siblings, coverage
RETURN host, no_atlas_match, nearest_known_vendors, coverage

The optional second argument is the traversal depth (1 to 6, default 2) and the third is a per-arm budget in milliseconds (default 3000). When the budget runs out, the row comes back with partial data and arms.deadline_hit: true — a partial walk is a result, not an error. Keep both modest — this is a fallback for the case where a direct identity lookup came back empty, not a general graph crawler.

The same word, two meanings — and on one indicator they flatly disagree.

• CALL whisper.assess(["185.220.101.1"]) → coverage: "ambiguous" — there is evidence, pointing both ways.
• CALL whisper.walk("185.220.101.1") → coverage: "no-data" — no atlas match, and arms_completed: 7 with nothing truncated.

Both rows are correct. They answer different questions: assess reports threat coverage, walk reports structural adjacency. Never gate a verdict on a walk row. A branch written against walk's vocabulary in an assess result is unreachable, and the branch it leaves you missing is malicious-evidenced — coverage: malicious-evidenced. In coverage, with positive evidence of malice..

• Start with identify to attribute known infrastructure.
• Use assess for the safety verdict on a batch, and always read coverage before you act on label.
• Fall back to walk only when identify returns no match and you need surrounding context.

For a single scored threat verdict with per-feed evidence, use explain(). To band a full URL rather than a host, use whisper.assessUrl() — and read its page first, because its coverage column behaves differently from the one above. For the full procedure catalog, see the Procedures overview.