whisper-sec/whisper-graph
Investigation playbooks for the WhisperGraph internet-infrastructure graph: indicator triage that reads coverage before it reports a verdict, bulk triage over a SIEM export, Cypher that passes the server's validator, and brand-protection sweeps.
WhisperGraph brand-protection and takedown playbook — find registered lookalike domains impersonating a brand, work out which ones are actually dangerous, attribute them to a registrant, and assemble evidence a registrar or hosting provider will act on. Use when the user asks about typosquats, lookalike or copycat domains, homoglyph or punycode domains, bitsquatting, domain impersonation, phishing domains targeting their company, brand or domain monitoring, a watchlist of domains an attacker might register, or preparing a takedown, abuse report or evidence package. Separates registered from weaponised so a defensive registration is never reported as an attack, and tells the user what the sweep did not cover. Requires the WhisperGraph MCP connector.
WhisperGraph bulk indicator triage — score a list of hostnames, IPs, ASNs, CIDRs or prefixes in one pass and return a ranked table an analyst can act on. Use when the user pastes or points at many indicators at once, mentions a list, batch, spreadsheet, CSV, SIEM export, EDR export, firewall log, proxy log, alert queue or blocklist, asks which of these are malicious, asks to prioritise or rank a set of hosts, or asks for a first pass over an estate before deciding what to dig into. Uses the bulk band mode rather than scoring each indicator individually, splits results into assessed, never-seen and check-failed so an unobserved indicator is never counted as clean, and reports what was truncated. Requires the WhisperGraph MCP connector.
WhisperGraph Cypher authoring — write read-only queries that pass the server's safety validator and return in milliseconds instead of timing out on billion-node labels. Use when a question has no ready-made WhisperGraph workflow and needs a custom query, when a query was rejected, rewritten, timed out, or returned zero rows unexpectedly, when the user asks about the graph schema, node labels, edge types or edge directions, when an aggregate or comparison across many entities is needed, or when the user asks how to reach the graph over its HTTP API instead of the connector. Covers anchoring, the physical versus query-time edge distinction, the edge directions that silently return nothing, the traps that succeed while matching nothing, and the typed error and self-correction contract. Requires the WhisperGraph MCP connector for the query tool.
WhisperGraph investigation playbook — triage a domain, IP, ASN, CIDR or prefix against an internet-infrastructure graph covering DNS, BGP and RPKI, WHOIS ownership, GeoIP, email (SPF/DMARC/DKIM), certificate transparency, TLS fingerprints, web links and threat feeds. Use when the user asks whether an indicator is malicious or safe, says to investigate or enrich an IOC, asks who owns, hosts, registered or runs something, asks what a domain resolves to or depends on, wants an attack surface or supply chain mapped, wants a subdomain takeover, DNS delegation or BGP hijack check, or wants an investigation written up with evidence. Also use to check WhisperGraph connectivity. Chooses the right server-side workflow instead of hand-rolling queries, and reads the coverage fields so an unseen indicator is never reported as clean. Requires the WhisperGraph MCP connector.