Endpoint Security
An EDR built on the host's own routable address: what the machine sees, what the network sees, one place to act.
In this chapter
- How the Sensor WorksWhat a host watches, what leaves it, and where the verdict on a destination actually comes from.
- Install5 pagesPut the binary on a machine, give it the address it reports under, and start the service, in that order.
- Operate9 pagesReading an estate, deciding what needs you, and acting on the plane that still works when a machine is lost.
- Endpoints With No SensorA machine you cannot install on still gets a verifiable address, resolution with a verdict, and containment that works off it.
- TroubleshootingThe symptom, what it means, and the command that fixes it, starting with the one that accounts for most cases.
Endpoint Security Documentation
Whisper Endpoint is an EDR whose sensor ships inside the same whisper binary that mints identities. Each host reports under its own routable IPv6 address, so the process the sensor saw on the machine and the flow the network saw leaving it name the same endpoint.
Four ordered commands bring a Linux host up:
curl -fsSL https://get.whisper.online | sh
whisper login --web
whisper enroll
sudo -E whisper service install --now --sensor
Each does one thing. The installer puts the CLI on the machine, signing in gives it your key, binding the host gives it the address it reports under, and the last command installs and starts the service. How the sensor works covers what it watches and what leaves the machine. Install takes both platforms end to end, and carries the service reference and removal.
Once hosts report, Operate is where the work happens: the estate in one view, findings that ask for a decision, and containment that starts at the network layer and holds there even when the host is fully owned.
A machine you cannot install on still gets a verifiable identity, resolution with a verdict, and those same network-layer actions. Endpoints with no sensor is what those machines get, and how to bring one in. When a host installs and runs and nothing arrives, Troubleshooting opens with the cause that accounts for most of it.