# Workflows

> Run prepared WhisperGraph investigations in the browser: indicator triage, passive attack-surface recon, typosquat takedowns, BGP and RPKI hygiene, DNS and email posture, supply-chain concentration.

*Source: https://www.whisper.security/docs/workflows*

---
A workflow is a prepared investigation: one question, a fixed sequence of steps, and a real Cypher query behind each step, executed against the live graph. You supply the seed — a domain, an IP, an ASN, a prefix, a country code — and read the result.

Which workflows exist is the registry's decision, not this page's, so the cards above are the current set. The headings below say what each job is for.

## How to run one

A workflow page opens with a result already on it, and every step shows the Cypher it executes, editable in place: change the seed and re-run. Running against the live graph needs an account — [Getting Started](/docs/whisper-graph/getting-started) covers signing in. To write the queries yourself, each workflow links its [Recipes](/docs/recipes) sibling; an agent reaches the same set over MCP through the [Workflow gallery](/docs/ai/mcp/workflow-gallery).

![One indicator fanning out into the campaign, routing, brand, email-posture, physical and adversary pivots on the same pre-joined graph](/images/docs/whisper-use-case-pivots.svg)

## Threat Investigation

Triage in one query instead of half a dozen consoles: the verdict, the network that routes the asset, the feeds that list it (134 feeds across 32 categories), and everything co-hosted beside it. By hand: [Indicator Triage](/docs/recipes/soc).

> **Read `coverage` before `band`.** Only `known-clean` licenses the word "clean"; `no-data` means
> *unknown*, which is a different thing again; `malicious-evidenced` and `ambiguous` mean there is
> evidence, whatever the band says. `whisper.explain` does not return `coverage` at all.
> Full contract: [Coverage — what we looked at](/docs/whisper-graph/procedures/coverage).

## Attack Surface & Recon

An org's external footprint, read out of the index of public DNS, BGP, WHOIS, Certificate Transparency and TLS-fingerprint data: no lookup hits their nameservers and no port is scanned. The Cypher is on [External Recon](/docs/recipes/pentest-recon).

## Brand Protection

Telling a parked typosquat from one wired into live phishing infrastructure: generate the lookalikes, resolve the registered ones, read the threat verdict off their hosting. [Lookalike Hunting](/docs/recipes/brand-protection) has the queries.

## Network & Routing

Live announcements, BGP adjacency, MOAS conflicts, RPKI ROAs and threat verdicts on one graph, out to the buildings and cable landings the network sits in. See [BGP & RPKI](/docs/recipes/bgp-routing).

## DNS & Email Security

SPF, DMARC, DNSSEC and mail routing crossed with the live infrastructure behind the records, so a valid SPF include that authorises infrastructure you would not trust reads as a risk. [Posture Audits](/docs/recipes/dns-email) has the queries.

## Infrastructure & Supply Chain

From a vendor domain out to the datacenters, exchanges and submarine cables under it, and the concentration no questionnaire surfaces: two critical vendors in one facility or on one cable. The Cypher is on [Third-Party & Portfolio Posture](/docs/recipes/third-party-posture) and [Cross-Layer Patterns](/docs/recipes/cross-cutting).