Integrations

The Whisper Security Add-on for Splunk (TA-whisper-graph) puts the graph inside Splunk: whisperlookup enriches events inline with threat intel, WHOIS, routing, and geolocation; whisperquery runs ad-hoc Cypher from the search bar; modular inputs keep threat-intel KV Store collections and attack-surface baselines current; and an opt-in layer feeds the Splunk Enterprise Security threat-intel framework. Install it from Splunkbase.

Any SIEM, SOAR, TIP, or ETL job that can POST JSON can integrate directly. Send Cypher to the query endpoint and get columns and rows back:

curl -s -A "your-app/1.0" \
  -X POST https://graph.whisper.security/api/query \
  -H "Content-Type: application/json" \
  -H "X-API-Key: whisper-YOUR_API_KEY" \
  -d '{"query": "CALL explain(\"185.220.101.1\")"}'

Anonymous requests run without a key at a 2-hop traversal cap. A free key raises the cap to 3 hops and the rate limit with it, and an invalid key degrades to the anonymous tier instead of failing the request. Start at the Cypher API landing, use the API reference for request fields and the response envelope, and see Errors & Rate Limits for status codes and quotas. The query language itself is documented in the Cypher Reference.

MCP-capable clients such as Claude and Cursor connect to the server at https://mcp.whisper.security and get graph queries, schema introspection, threat verdicts, and guided workflows as tools, with no custom code. See AI & Agents for what the server exposes and MCP setup for per-client configuration.

Until a native connector ships, the REST API covers each of these today. If one of them matters to you, or you need a connector not listed here, tell us through Support.