# The Operator Console

> The Whisper operator console: what the overview surfaces, how its navigation groups by job, and why it only ever shows your own estate.

*Source: https://www.whisper.security/docs/endpoint/operate/console*

---
The console is at `https://console.whisper.online`. Signing in resolves you to your own key, and every call it makes is made on the server side, so nothing in the browser carries your credential and nothing outside your estate is reachable through it. An account that has provisioned nothing yet renders an empty estate rather than an error.

## What the overview answers

The landing view is built to be read top to bottom before you touch anything: how your identities sit across the reputation bands, a worklist of what is asking for a decision, the open incidents, the hosts carrying open detections, how many machines are held under containment right now, a day-by-day trend of what went over the wire, coverage split by connectivity tier and by on-host sensor depth, and the most recent findings the sensors held.

## How the navigation is grouped

Four groups, by the question you are asking.

**Operate** is the worklist and the estate: the overview, the attention list, incidents, the fleet, activity, devices, an investigation view per host, and the respond surface.

**Understand** is the evidence behind a row: an identity and its proofs, what came inbound, what left as egress, the map, insights, hunt, the ATT&CK matrix, campaigns, and the registrants behind the names you saw.

**Assure** is what you show someone else: exposure and compliance.

**Control** is what you change: policy, with its own recorded history per control, and settings.

Hunt is read-only, and scoped to your own estate. Investigation reads the same process trees, event chains, logs and destination verdicts that the [detections](/docs/endpoint/operate/detections) reference describes, joined per host.

## Two doors onto a machine

The devices surface holds both ways a machine can be covered. "Protect a computer" walks the install on a machine you can reach, and lands it in the fleet. "Add device" mints a resolve-only identity for one you cannot, which is what [endpoints with no sensor](/docs/endpoint/no-sensor) covers. Endpoints already carrying a sensor live in the fleet view, never in devices.

Nothing here is a separate API. The console reads the control plane, and so can you: [Control Plane API](/docs/control-plane) is the same surface, and [your fleet](/docs/endpoint/operate/fleet) is the reading that matters most. You get a key by signing in at `https://console.whisper.security`.