Integrations

The Whisper Security Add-on for Splunk (TA-whisper-graph) puts the graph inside Splunk: whisperlookup enriches events inline with threat intel, WHOIS, routing, and geolocation; whisperquery runs ad-hoc Cypher from the search bar; modular inputs keep threat-intel KV Store collections and attack-surface baselines current; and an opt-in layer feeds the Splunk Enterprise Security threat-intel framework. Install it from Splunkbase.

The Whisper connector for OpenCTI adds one-click observable enrichment to your threat intel platform. Click Enrich on an IP, domain, or AS number and the connector pulls the DNS, WHOIS, BGP, and threat context Whisper holds for it, then writes it back as STIX 2.1 objects your analysts can pivot on — with the evidence chain for threat-listed observables attached as notes. It runs as a Docker container next to your platform and triggers manually, automatically, or from a playbook. Get it from the Filigran Hub.

The Whisper Security solution for Microsoft Sentinel installs from the Content Hub and enriches every IP, domain, and ASN in your incidents with threat scores, infrastructure context, WHOIS and BGP history, and ASN reputation. Ten incident-triggered playbooks post enrichment back as incident comments, five scheduled pipelines keep baseline intel fresh in custom tables, and five workbooks, eight analytics rule templates, and six hunting queries read from those tables. Get it from the Microsoft Marketplace.

Read coverage before band. Only known-clean — coverage: known-clean. In coverage, no malicious evidence. licenses the word "clean"; no-data — coverage: no-data. Not in coverage. This is not a verdict — nothing was looked at. means unknown, which is a different thing again; malicious-evidenced — coverage: malicious-evidenced. In coverage, with positive evidence of malice. and ambiguous — coverage: ambiguous. In coverage, and the evidence points both ways. mean there is evidence, whatever the band says. whisper.explain does not return coverage at all. Full contract: Coverage — what we looked at.

Any SIEM, SOAR, TIP, or ETL job that can POST JSON can integrate directly. Send Cypher to the query endpoint and get columns and rows back:

curl -s -A "your-app/1.0" \
  -X POST https://graph.whisper.security/api/query \
  -H "Content-Type: application/json" \
  -H "X-API-Key: whisper-YOUR_API_KEY" \
  -d '{"query": "CALL explain(\"185.220.101.1\") YIELD indicator, level, score, explanation"}'

YIELD names the columns you want back. Without it the procedure returns its full column set, including ones that stay empty for most indicators.

The request above carries a key. Sign in to copy yours, or sign up if you do not have an account yet — a request the API cannot attribute to a key is answered as though no key was sent, rather than rejected. Start at the Cypher API landing, use the API reference for request fields and the response envelope, and see Errors for status codes. The query language itself is documented in the Cypher Reference.

MCP-capable clients such as Claude and Cursor connect to the server at https://mcp.whisper.security and get graph queries, schema introspection, threat verdicts, and guided workflows as tools, with no custom code. See AI & Agents for what the server exposes and MCP setup for per-client configuration.

Until a native connector ships, the REST API covers each of these today. If one of them matters to you, or you need a connector not listed here, tell us through Support.