Whisper Intelligence
The alert gives you an address.This gives you everything it touches.
The alert arrives with an address and nothing else. One Whisper query returns the network that routes it, the company that owns it, the certificate it presents and the feeds it is listed in, with the reasoning attached.
Not a threat-feed replacement.
Whisper Intelligence maps the infrastructure behind an address. Keep the feeds you already buy.
Three kinds of data are not in the graph at all.
No file hashes
No malware samples and no file reputation.
No URLs
It resolves hostnames and addresses. Paths are out of scope.
No compromised-identity data
No breach, credential or personal-data feeds.
Five tabs, one indicator, no time.
The alert gives you an address and stops there. So you open a WHOIS lookup, a certificate search, an ASN lookup and a feed check, then join the answers by hand.
Then the next alert arrives, and you do it again. The one that matters looks like all the others until someone happens to look closely.
Four lookups, one query.
A hostname goes in. Its addresses come back with the network, the operator, the city and the feeds for each.
MATCH (h:HOSTNAME {name: "example.com"})-[:RESOLVES_TO]->(ip:IPV4)
CALL { WITH ip
MATCH (ip)-[:ANNOUNCED_BY]->(:ANNOUNCED_PREFIX)-[:ROUTES]->(a:ASN)-[:HAS_NAME]->(n:ASN_NAME)
RETURN a.name AS asn, n.name AS network LIMIT 1 }
CALL { WITH ip MATCH (ip)-[:DELEGATED_TO]->(v:VENDOR) RETURN collect(v.name) AS operator }
CALL { WITH ip MATCH (ip)-[:LOCATED_IN]->(c:CITY) RETURN collect(c.name) AS city }
CALL { WITH ip MATCH (ip)-[:LISTED_IN]->(f:FEED_SOURCE) RETURN collect(f.name) AS feeds }
RETURN ip.name AS address, asn, network, operator, city, feeds
LIMIT 5What comes back.
Each column is an edge in the graph, so the reason for every value comes back in the same query.
- address
Every address the hostname resolves to right now.
- asn, network
The autonomous system announcing that address, read from the live route rather than a registration record.
- operator
The cloud or service company actually running the address space, which the WHOIS owner often is not.
- city
Where the address sits, to city level.
- feeds
Every intelligence feed that lists the address today, by name.
Three questions, one query each.
Who owns this, really
Ownership, network, geography, email posture, certificates and threat context, with the evidence behind the verdict.
Who runs the host
Attribution that survives a CDN: the company behind the host, past the proxy in front of it.
What else do they run
One seed expands to the estate: shared certificates, co-hosting, registrant, nameserver and network.
We will show you the arithmetic.
A score you cannot audit is a score you cannot defend to a regulator, a customer or a board. Every verdict comes back with its sources, their weights and the sum.
Sources and weights
Each feed and signal that moved the verdict, and how much it counted.
Network reputation
Threat density, topology, history and prefix age, each weighted and shown.
First and last seen
When each piece of evidence appeared, so an old listing reads as old.
However your team already works.
- Console
Sign in and query from the browser, with the graph drawn as you go. No code.
- Direct API
Send Cypher over HTTP from your own service and read rows back.
- MCP
Connect an agent once. It walks the graph itself.
- CLI
One signed binary for Cypher, named recipes and a local MCP server.
- SIEM
Splunk, Sentinel, OpenCTI and more score each alert against the graph as it arrives.
Enrichment belongs where the alert already is.
Splunk, Microsoft Sentinel, OpenCTI, Wazuh, n8n, MCP, MISP
Put it inside your own product.
The same graph can sit behind your own product. Your product sends the query and shows the answer under your brand. Start with the embed guide.
What it will not do.
- Not live telemetry
Most signal updates continuously. A few sources, such as WHOIS and physical infrastructure, refresh on a slower, published cadence.
- Not an enforcement point
Intelligence answers a question. It does not block a connection or revoke an identity.
- Not unlimited depth
A query runs inside a bounded depth, so the cost of a question stays predictable as the graph grows.
Where to next.
WhisperGraph, the engine
What it holds, how it stays fast, and why we built it ourselves.
Investigate a suspicious address
A worked example: verdict, owner and everything connected, in one pass.
Map who owns an address
Trace one indicator to its real owner and the rest of what they run.
Pricing
Community is free forever. Paid plans add history, integrations and enforcement.
Compare Whisper Intelligence
Where it sits beside the passive-DNS or EASM tool you already run.
Running this for clients?
Whisper for MSSPs and MSPs, under your own brand.