WhisperGraph
What's inside the graph, and
how it stays fast.
WhisperGraph is Whisper's own graph engine, and every layer is joined to the next. Query it directly over one endpoint, or let Whisper Intelligence and Whisper Graph XDR query it for you. It is one graph of 7.5B nodes and 39.8B edges.
Fast, even at full scale.
Every figure here comes from the graph itself. Anchored queries return in single-digit milliseconds, server-side.
Measured
Every kind of data, and how it changes.
The ledger below names each layer’s data and how it stays current. The table beneath it breaks the same answer down by freshness class.
- Livenew data arrives continuously
- Regularrefreshed on a schedule
- Snapshottaken from periodic snapshots
- Referenceslow-changing records
- Naming & DNSLivehostnames, DNS records, nameservers, DNSSECLive
- Addressing & geographySnapshotIPv4 and IPv6 addresses, address blocks, city, country, cloud regionsSnapshot
- Network & routingLivenetworks, announced routes, BGP paths and peering, RPKI, origin conflictsLive
- Ownership & registrationRegularregistrants, registrars, registries, RDAP recordsRegular
- Email securityRegularMX, SPF, DMARC, DKIMRegular
- Certificates & TLSRegularcertificate transparency names, TLS fingerprintsRegular
- Threat intelligenceLivefeed listings, risk signals, Tor relays, VPN and proxy exitsLive
- Threat actors & ATT&CKReferencenamed actors, ATT&CK techniquesReference
- Phishing-kit pathsRegularpage paths shared by phishing-kit hosts, and the hosts serving themRegular
- Physical infrastructureReferencedata centres, internet exchanges, subsea cables, landing stations, CDN points of presenceReference
- Company & technologySnapshotcompanies, subsidiaries, peers and the technology they runSnapshot
Where the graph has never seen an indicator, the answer says no data. It never reads that as clean.
How each kind of data stays current.
- Live
New data reaches the graph through the day, as its sources publish updates.
DNS resolutions · Routing table · Route-origin records · Threat listings
- Regular
Refreshed on a recurring cycle as its sources publish changes.
Ownership & registration · Email security · Certificates & TLS · Phishing-kit paths
- Snapshot
Taken from periodic snapshots.
Addressing & geography · Company & technology, for accounts with company-data access
- Reference
These are curated records that change rarely.
Physical infrastructure · Threat actors & ATT&CK
No data is never clean.
Every verdict says which of four things it found, with the evidence behind it.
Listed, with evidence
Each feed that lists it, with its weight and when it last saw it.
Known clean
Seen in the graph, with no malicious evidence against it.
Ambiguous
The signals disagree. Escalate it to a person, and do not automate the call.
No data
The graph has nothing on it yet. That is not the same as clean.
Four ways to reach the graph.
Pick the one that fits how your team already works.
Query API
Ask in Cypher, the open graph query language, over one HTTPS endpoint, from any language.
MCP server for AI agents
Connect once and an agent walks the graph itself. Every tool it offers is read-only.
SIEM and TIP integrations
Splunk, Sentinel, OpenCTI, MISP and Wazuh, each with its own connector.
We run the network we describe.
Whisper operates its own autonomous system, AS219419, with RPKI-signed routes you can check yourself. The same address space gives every Graph XDR identity its public address.
Three ways the graph reaches you.
Graph XDR
Decides what your machines and agents may reach, and logs who is on the other end.
Run a query against it.
The query API's keyless tier answers without an account. Examples and the MCP server take a free key.