Your First Connector
Get Whisper answering inside a tool you already run. Pick Splunk, Sentinel, OpenCTI or Wazuh, get a key, install, and see the first enriched event — with the honest list of what will and will not fire on day one.
Your First Connector Documentation
Four connectors ship today: Splunk, Microsoft Sentinel, OpenCTI and Wazuh. Each section below ends in the same place — one enriched record on screen, inside the tool you already run — and each says out loud what will still be empty afterwards, because on every one of them the first install is quieter than the feature list suggests.
Most of what follows needs a Whisper API key. There is no card and nothing to choose: sign in and a key is created for you. Two of the four install and enrich without one — the Splunk search commands and the Wazuh per-alert enrichment both query the graph keyless — and each section says which of its parts are which.
Splunk
What you need first. Splunk Enterprise or Splunk Cloud Platform on Python 3.13 — every extension point in the add-on declares python.required = 3.13, so Splunk picks that interpreter itself. Enterprise Security is optional and needed only for the ES objects. HTTPS egress to the Whisper API. The full list is on Requirements.
Create the index before anything else. The add-on writes to an index named whisper and does not ship an indexes.conf — Splunk Cloud Victoria prohibits app-shipped index definitions, so creating it is the administrator's job. Do it first: a modular input enabled against an index that does not exist writes nowhere and reports nothing. Per-deployment steps are on Installation.
Install. The add-on is on Splunkbase: Whisper Security TA. Install from file, or find it from Apps → Find More Apps inside Splunk Web.
Get to the first enriched record. No key needed for this — whisperquery and whisperlookup query the graph keyless:
| whisperquery query="RETURN 1 AS test LIMIT 1"
A row back means the command is registered and the egress path works. Then run whisperlookup over real events to enrich IPs and domains inline — Enrichment.
What needs a key, and what stays empty. Two macros — whisper_cname_chain and whisper_spf_chain — are refused without an account (measured against production, 2026-08-09). Everything else in the package works before you sign in. The scheduled content stays empty until the modular inputs are enabled and have run at least once, because every saved search reads a whisper index that nothing has written to yet — Configuration.
Microsoft Sentinel
What you need first. A Sentinel workspace, a Key Vault in the Azure RBAC permission model, and role-assignment rights on the resource group that holds both. The full list — and the two constraints that make most installs fail — is on Requirements.
Install. Two steps: put the key in Key Vault, then run the Content Hub install wizard and paste the secret URI into its Whisper API Credentials blade. The exact az commands and the wizard blade-by-blade are on Installation.
Get to the first enriched record. Open an incident that has an IP entity, choose Actions → Run playbook, and run Whisper-ExplainIP. Within a minute the incident carries an enrichment comment and the row is queryable in your workspace:
WhisperThreatIntel_CL
| sort by TimeGenerated desc
| take 10
That is the finish line. If the playbook run history shows a 401, the Key Vault secret does not hold a valid key — see Troubleshooting.
What will not fire on day one — and it is most of it. The solution ships eight analytics rules and six hunting queries. On a default install, 1 of 8 analytics rules and 1 of 6 hunts can produce a non-zero result, and the one rule that works monitors Cloudflare and Google — the reputation poller ships watching ASNs 13335 and 15169 until you set your own. Every other rule and hunt reads a Whisper table that nothing has written yet.
That is not a caveat to skim. Read the row for the detection you are about to depend on, with the reason it is dark, in the precondition table on Workbooks & Detections. Then work through Configuration: its one-time steps are what turn the dark rows on, and until they are done an enabled rule is a rule that returns nothing on every run.
OpenCTI
What you need first. An OpenCTI platform on 7.260701.0 or later, Docker, and a dedicated OpenCTI user for the connector — put it in the Connectors group and do not reuse the admin token. A Whisper API key: the connector sends it as X-API-Key on every query. The connector needs three routes out: the platform, RabbitMQ, and graph.whisper.security. Full list on Requirements.
Match the image tag to your platform. OpenCTI releases the platform and pycti in lockstep and the connector images are tagged to match. A mismatch does not fail quietly — the connector refuses to register and the container log says why, which is the single most common first-install failure here.
Install. Pull opencti/connector-whisper (public — no registry account) and add the service to your compose file. Both steps are on Installation.
Get to the first enriched record. docker logs connector-whisper should show it register and start listening. Then open Data → Ingestion → Connectors and confirm Whisper is Started with the scope you configured. Enrich one observable and read the result — Enriching Observables.
What will not happen on day one. The connector is on-demand: registering it enriches nothing by itself, and nothing appears until an observable is enriched, either by hand or by a playbook you point at it. Its scope and TLP ceiling also gate what it will write back — set both deliberately rather than discovering them later — Configuration.
Wazuh
The Wazuh connector ships from its own repository and its reference documentation lives there rather than here — whisper-sec/whisper-wazuh, latest release v1.1.0 (2026-07-31), verified end to end on Wazuh 4.14.5. This section gets you to the first enriched alert; the repository's own installation guide is the full admin reference.
What you need first. A Wazuh manager 4.x, root on it, and TLS egress to graph.whisper.security. Per-alert enrichment needs no key — the graph is queried keyless. The on-demand investigation CLI and the agent-activity log source do need an account, because they read your own tenant's data.
Install. On the manager, as root:
curl -sSL https://github.com/whisper-sec/whisper-wazuh/releases/latest/download/whisper-wazuh.tar.gz | tar xz
cd whisper-wazuh-*
sudo sh install.sh --group sshd
A one-line bootstrap and .deb/.rpm packages are also published; all three run the same install.sh, which pushes the indexer template, patches ossec.conf with a rollback, restarts the manager and verifies itself. The OS packages deliberately do not auto-activate — activation patches ossec.conf and restarts the manager, so it stays an explicit admin step.
Get to the first enriched record.
grep whisper: /var/ossec/logs/integrations.log # expect invoke → api → emit
Then search data.whisper.ioc:<the IP> in the dashboard: the enrichment arrives as a new alert beside the original.
What will not fire on day one. Enrichment runs on the next alert in a trigger group that carries a public IP or a domain — nothing else. An install on a manager whose active rules never emit a routable indicator is correctly installed and permanently quiet, and that is the first thing to check before debugging the connector. Add the key later for the CLI and the log source; neither is needed to see enrichment working.