Install on Windows

Open PowerShell as Administrator and run all four steps in that one session, under one account. The service needs elevation to install, and the marker written in step 3 lands in the profile of whoever ran it, so switching accounts halfway leaves the service unable to find it.

1. Install the CLI

irm https://get.whisper.online/install.ps1 | iex

The binary lands in C:\Program Files\Whisper and configuration lives under C:\ProgramData\Whisper. This step installs the CLI and nothing else.

2. Sign in

whisper login --web

The command opens a browser at https://console.whisper.security and, on approval, saves your key for the signed-in account.

3. Bind the machine

whisper enroll

whisper: bound 2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478  (app-1)

That address is what this machine reports as from now on. The command is idempotent, so a re-run after a rebuild re-finds the same address instead of minting a second one. It records the result at %USERPROFILE%\.config\whisper\bound, which is why step 4 belongs to the same account. Bind the host has the detail.

4. Install and start the service

whisper service install --now --sensor

The service is named whisper-sensor. It runs as LocalSystem, starts automatically with the machine and restarts itself on failure. Real-time event collection needs that level, which is why the install is elevated.

5. Confirm it is running and reporting

sc query whisper-sensor
whisper service status --sensor

sc query answers with the service state, which reads RUNNING once step 4 has taken. whisper service status --sensor is the one that tells you whether the sensor found the machine's address, rather than just that the process started.

The rolling log is here if you want to watch it work:

Get-Content C:\ProgramData\Whisper\logs\whisper-sensor.log -Tail 20 -Wait

The machine now appears in your fleet, and the address it reports under is checkable by anyone with no key and nothing installed: see verifying an identity.