# MISP integration — overview

> The Whisper expansion module for MISP: supported attribute types, what lands on the event, the keyed settings, and where the module is distributed from.

*Source: https://www.whisper.security/docs/integrations/misp/overview*

---
The Whisper module for MISP takes an IP address, domain, hostname or AS attribute and returns the ASN, DNS, WHOIS and threat-intelligence context WhisperGraph holds for it, as MISP objects and attributes an analyst pivots on inside the platform they already run. It is distributed inside `misp-modules`, the third-party enrichment library MISP itself ships — there is nothing separate to install.

**Key concepts:** [Threat Intelligence](/glossary/threat-intelligence), [Indicator of Compromise](/glossary/indicator-of-compromise), [Infrastructure Intelligence](/glossary/infrastructure-intelligence).

---

## What you get

Enriching an attribute sends its value to the Whisper API. For each attribute you enrich, the module queries WhisperGraph and returns MISP objects and attributes for whatever Whisper holds on that indicator: an `asn` object for the network context, a `domain-ip` object linking a domain to what it resolves to, and standalone `ip-dst`, `domain`, `whois-registrant-email` and `whois-registrar` attributes for the rest. The Whisper edge behind each fact rides along, either in the object's own reference relationship or in the attribute's comment, so the provenance of a fact is never lost on the way into the event.

The module's output UUIDs are derived deterministically from the indicator, so enriching the same attribute a second time dedups on import instead of piling up a second copy of the same objects.

---

## Two module types, one settings block

The module registers as both an **expansion** module — the enrichment above, added to the event on request — and a **hover** module, which previews the same infrastructure and threat-intelligence context in place, without adding anything to the event — the lookup still queries the Whisper API, so the same TLP ceiling applies. Any threat-intelligence context the module surfaces is evidence for the analyst to weigh, never a cleared verdict:

> **Read `coverage` before `band`.** Only `known-clean` licenses the word "clean"; `no-data` means
> *unknown*, which is a different thing again; `malicious-evidenced` and `ambiguous` mean there is
> evidence, whatever the band says. `whisper.explain` does not return `coverage` at all.
> Full contract: [Coverage — what we looked at](/docs/whisper-graph/coverage).

Both module types read one shared settings block:

| Setting | What it controls |
| --- | --- |
| `api_url` | The Whisper graph API host to query. Defaults to the production graph host. Changing it sends both the attribute value and your API key to that host. |
| `api_key` | **Required.** Without one, MISP enables the module but every enrichment returns a configuration error. |
| `max_tlp` | The most sensitive TLP marking the module may send to the Whisper API. An attribute tagged above this is refused before any value leaves MISP. Defaults to `tlp:amber+strict`; `tlp:red` disables the gate. |
| `timeout` | The module's own enrichment budget for a single lookup. |

**This module always needs a key** — unlike the Whisper connector for Wazuh, whose per-alert path runs keyless, there is no keyless mode here. Get one in [the console](https://console.whisper.security/settings).

---

## Supported attribute types

`ip-src`, `ip-dst`, `domain` and `hostname` attributes, plus an `AS` attribute (an autonomous system number). Anything else is left alone.

---

## What it does not do

**It never resolves location.** WhisperGraph's location layer is not part of what the module converts into MISP objects, so no country or city ever lands on an enriched event from this module — the ASN and DNS context is the ceiling of what arrives, not a full geo picture.

---

## Where it comes from

The module ships inside `misp-modules` — the module page is [`misp.github.io/misp-modules/expansion/#whisper`](https://misp.github.io/misp-modules/expansion/#whisper). Its runtime dependency, the `whisper-misp` package, is published on PyPI under the MIT license. No end-to-end verification against a named MISP core release exists yet; what is verified is that the module ships in `misp-modules` and needs a MISP instance running the modules enrichment service.

---

## Install it

- [Install and configure the MISP module](/docs/integrations/misp/installation) — upgrading the modules service, the settings, and how to confirm enrichment fired