Skip to content
Endpoint Security
Skip navigation
Endpoint Security
View as Markdown

Your Fleet

The roster, the two coverage axes that are easy to confuse, and what an unscored row actually means.

Published

On this page (3)

Your Fleet Documentation

The roster is one read, and the console's fleet view is the same rows with the joins made.

bash
curl -s -X POST https://graph.whisper.online/api/query \
  -H 'content-type: application/json' \
  -H 'X-API-Key: <your key>' \
  --data-binary @- <<'JSON'
{"query": "CALL whisper.agents({op: 'list', kind: 'agents'})"}
JSON

Each row carries the label you gave it, its name in DNS, its address, its connectivity tier, its sensor state, its parent, its children and its depth. The last three are there because an identity can hold identities beneath it; nested identities is what that means and what it does to policy.

Two separate coverage readings

Reading these two as one number is the mistake this view is shaped to prevent.

Connectivity tier is how the host's traffic reaches the internet: Tier 1 routed, Tier 1.5 source-bound egress, Tier 2 resolver only. It says what the network can see and act on. Connectivity tiers is the full contract.

On-host sensor depth is whether the machine's own sensor is shipping, slow, stale, or absent. It is depth of visibility, never depth of protection: a host with no sensor is not an unprotected host, because the network-layer actions in the response ladder need nothing installed to work. What a shipping sensor adds is process, file and hash detail the network cannot see.

A host can sit high on one axis and low on the other, and both readings are useful on their own.

Quiet is a measurement, unscored is not

Identities are grouped by reputation band. Quiet means Whisper looked and found nothing of interest. Unscored means the indicator is not resident in the graph, so nobody has looked. Treating the second as the first is how a real finding gets closed, which is why the two are never folded together here or in Coverage.

Where a host is not in the fleet

Machines carrying a sensor live in the fleet. Resolve-only identities, which hold an address and can look names up but run nothing, live in the console's devices view instead: see endpoints with no sensor. A registry state of confirmed on one of those rows means registered and not revoked. It is a statement about the registry, not about whether the machine is switched on.

The per-host reads behind a row, the process census and the activity logs, are list and logs on the control plane.