Threat Feeds & Categories

Feeds are collected by whisper-feeds, a companion data service that pulls from public and commercial sources and refreshes on hourly incremental and daily full cycles. Inside the graph, the threat-intelligence layer surfaces three ways:

• LISTED_IN edges. An IPV4, IPV6, or HOSTNAME node connects to each FEED_SOURCE that lists it. Each edge carries firstSeen, lastSeen, and the feed's weight. This is the evidence behind every verdict.
• BELONGS_TO edges. A FEED_SOURCE connects to its CATEGORY (there is no IN_CATEGORY edge), so you can turn feed names into threat categories in one hop.
• Verdict properties on nodes. Listed indicators carry raw threat properties (threatScore, threatLevel from NONE to CRITICAL, threatSources, threatFirstSeen, threatLastSeen) plus a reconciled verdict: verdictScore, verdictLevel, verdictBlocking, and verdictAdvisory (IPs only). Prefer the reconciled verdict* properties for triage decisions; they are the authoritative signal.

Listed nodes also carry 17 boolean flags derived from the categories of the feeds that list them: isThreat, isAnonymizer, isC2, isMalware, isPhishing, isSpam, isBruteforce, isScanner, isBlacklist, isTor, isProxy, isVpn, isWhitelist, isReputation, isBotnet, isDga, and isStateActor. Flags like isTor and isAnonymizer matter for triage even when the score is moderate: a login from a Tor exit reads very differently than the same login from a residential IP.

Two mechanics to know before querying:

• LISTED_IN and the feed-to-category BELONGS_TO step are computed at query time. Write them as explicit single hops, never inside a variable-length [*..] pattern, and bound the feed list with WITH f LIMIT 10 before expanding to categories. See Best Practices.
• Curated allowlists clamp the verdict surfaces (threatLevel, isThreat, verdictLevel) to INFO/false for well-known public DNS resolvers such as 1.1.1.1 and 8.8.8.8, which appear on aggressive blocklists for reasons that rarely matter to a defender. The raw threatScore is never clamped, so it keeps the full feed evidence.

Click to expandHow feed listings become graph edges and node verdicts

The live catalog holds 43 feeds. All feeds follow the same refresh policy (see cadence below).

The feed set evolves as sources are added or rebalanced. The first query on this page returns the current list, and GET /api/query/stats reports the live feedSourceCount and categoryCount (see the API Reference).

Refresh cadence

• Hourly incremental refresh. Newly listed indicators flow into the graph within about 60 minutes of source publication. A hot C2 IP added to ThreatFox is queryable through its LISTED_IN edge within the hour.
• Daily full refresh. Every feed is re-fetched in full, and entries no longer present on the source are removed from the graph.

Because the graph reflects whichever feeds are currently loaded, treat scores and listings as a live read, not a fixed record.

Every feed belongs to one of 25 categories, and the categories fall into three groups. Threat categories mark confirmed or suspected badness. Anonymizer categories mark infrastructure that hides origin without being malicious in itself. Reference categories carry context data, including trust lists: a Tranco or Cloudflare Radar listing is a popularity signal, so a LISTED_IN edge alone does not mean an indicator is malicious. Check the category, or read the reconciled verdict, before escalating.

Use the category to scope a hunt: filter to C2 Servers plus Malware Distribution for confirmed-bad, or exclude the Reference group when counting threat evidence.

FEED_SOURCE and CATEGORY are small reference labels, so they are safe to scan without an anchor:

// List the live feed catalog
MATCH (f:FEED_SOURCE)
RETURN f.name AS feed
ORDER BY f.name
LIMIT 50

For an indicator, read the listings and the reconciled verdict together in one anchored query:

// Feeds listing this IP, plus its reconciled verdict and posture flags
MATCH (ip:IPV4 {name: "185.220.101.1"})
OPTIONAL MATCH (ip)-[:LISTED_IN]->(f:FEED_SOURCE)
RETURN ip.name AS ip, ip.verdictScore AS score, ip.verdictLevel AS level,
       ip.verdictBlocking AS blocking, ip.isTor AS isTor,
       collect(DISTINCT f.name) AS feeds
LIMIT 1

Several feeds naming the same indicator is a stronger signal than one. To turn the feed names into categories, pivot each feed through BELONGS_TO, bounding the feed list with WITH f LIMIT 10 between the two hops. The full recipe, along with batch enrichment patterns, is in Indicator Triage. For the scored reasoning behind a verdict, with the exact feeds, weights, and first/last-seen timestamps, call explain(). Labels, edges, and properties for the whole threat layer are in the Graph Schema.