Operate
Reading an estate, deciding what needs you, and acting on the plane that still works when a machine is lost.
In this section
- The Operator ConsoleOne signed-in view of your own estate, grouped by the question each surface answers.
- Your FleetThe roster, the two coverage axes that are easy to confuse, and what an unscored row actually means.
- Alerts and IncidentsWhy something interrupts you, what a person did to it, and how a quiet answer proves itself.
- What the Sensor DetectsThe behavioural families that raise a finding, the rule formats accepted beside them, and the key that turns one off.
- Posture and ExposureThe standing inventory beside the event stream: what is installed on a machine, and what is open against it.
- Contain an EndpointPut a reversible hold on a machine at the network layer, lift it again, or cut the address for good.
- Add Your Own RulesPut a Sigma rule on a host, map it to an event kind the collectors emit, and confirm it fired.
- The Response LadderTwo planes to act on, what each one needs from the machine, and which of them survives a fully owned host.
- What the Sensor CostsWhere the work happens, what holds it back under load, and how to read the ceilings on your own machine.
Operate Documentation
Every surface here reads the same control plane your key reads, so the console, the CLI and the API answer the same question the same way. An acknowledgement typed in one of them is the mark the others see.
The estate roster is one call:
curl -s -X POST https://graph.whisper.online/api/query \
-H 'content-type: application/json' \
-H 'X-API-Key: <your key>' \
--data-binary @- <<'JSON'
{"query": "CALL whisper.agents({op: 'list', kind: 'agents'})"}
JSON
The operator console is the same reading with the joins already made. Your fleet is how to read coverage honestly, on its two separate axes, and why an unscored host is not a clean one.
The rest is what the hosts send. Alerts and incidents is the part that asks for a decision, and how it stays quiet when nothing does. What the sensor detects is the reference for the families that raise those findings, and add your own rules is how to put your own detection content beside them. Posture and exposure is the standing inventory rather than the event stream: what is installed, and what is open against it.
Acting is deliberate and layered. The response ladder sets out the two planes and what each needs; contain an endpoint is the procedure, starting with the hold you can lift. What the sensor costs is for the question a fleet owner asks before any of it: what this does to the machine.