# Endpoint Security

> Whisper Endpoint: install the host sensor on Linux or Windows, read your estate in the operator console, and contain a machine at the network layer.

*Source: https://www.whisper.security/docs/endpoint*

---
Whisper Endpoint is an EDR whose sensor ships inside the same `whisper` binary that mints identities. Each host reports under its own routable IPv6 address, so the process the sensor saw on the machine and the flow the network saw leaving it name the same endpoint.

Four ordered commands bring a Linux host up:

```bash
curl -fsSL https://get.whisper.online | sh
whisper login --web
whisper enroll
sudo -E whisper service install --now --sensor
```

Each does one thing. The installer puts the CLI on the machine, signing in gives it your key, [binding the host](/docs/endpoint/install/enroll) gives it the address it reports under, and the last command installs and starts the service. [How the sensor works](/docs/endpoint/how-it-works) covers what it watches and what leaves the machine. [Install](/docs/endpoint/install) takes both platforms end to end, and carries the service reference and removal.

Once hosts report, [Operate](/docs/endpoint/operate) is where the work happens: the estate in one view, findings that ask for a decision, and containment that starts at the network layer and holds there even when the host is fully owned.

A machine you cannot install on still gets a verifiable identity, resolution with a verdict, and those same network-layer actions. [Endpoints with no sensor](/docs/endpoint/no-sensor) is what those machines get, and how to bring one in. When a host installs and runs and nothing arrives, [Troubleshooting](/docs/endpoint/troubleshooting) opens with the cause that accounts for most of it.