# Operate

> Run Whisper Endpoint day to day: the operator console, fleet coverage, alerts, detections, posture, and containment at the network layer.

*Source: https://www.whisper.security/docs/endpoint/operate*

---
Every surface here reads the same control plane your key reads, so the console, the CLI and the API answer the same question the same way. An acknowledgement typed in one of them is the mark the others see.

The estate roster is one call:

```bash
curl -s -X POST https://graph.whisper.online/api/query \
  -H 'content-type: application/json' \
  -H 'X-API-Key: <your key>' \
  --data-binary @- <<'JSON'
{"query": "CALL whisper.agents({op: 'list', kind: 'agents'})"}
JSON
```

[The operator console](/docs/endpoint/operate/console) is the same reading with the joins already made. [Your fleet](/docs/endpoint/operate/fleet) is how to read coverage honestly, on its two separate axes, and why an unscored host is not a clean one.

The rest is what the hosts send. [Alerts and incidents](/docs/endpoint/operate/alerts) is the part that asks for a decision, and how it stays quiet when nothing does. [What the sensor detects](/docs/endpoint/operate/detections) is the reference for the families that raise those findings, and [add your own rules](/docs/endpoint/operate/rules) is how to put your own detection content beside them. [Posture and exposure](/docs/endpoint/operate/posture) is the standing inventory rather than the event stream: what is installed, and what is open against it.

Acting is deliberate and layered. [The response ladder](/docs/endpoint/operate/response) sets out the two planes and what each needs; [contain an endpoint](/docs/endpoint/operate/contain) is the procedure, starting with the hold you can lift. [What the sensor costs](/docs/endpoint/operate/footprint) is for the question a fleet owner asks before any of it: what this does to the machine.