Changelog

The first published release, and still the only one. Three independent sources give the same date: app.manifest carries releaseDate: 2026-04-29, the v1.0.0 tag was published that day, and Splunkbase says 29 April 2026.

What shipped

• Search commands. whisperlookup streams enrichment for hostnames, IPs and ASNs with a KV Store-backed cache; whisperquery runs parameterised read-only Cypher straight from SPL; whisperschema discovers node labels, relationship types and properties; whisperflush and whisperevict manage the local cache. See Search commands.
• Modular inputs. A threat-intelligence collector, a DNS baseline collector for change detection, and a watchlist collector. See Modular inputs.
• KV Store collections. whisper_enrichment_cache, whisper_precomputed_enrichment, whisper_ip_intel, whisper_domain_intel, whisper_watchlist and whisper_dns_baseline. See Lookups.
• Enterprise Security. CIM compliance for the Network Traffic, DNS and Threat Intelligence data models via field aliases, event types and tags; the threat-intelligence framework fed from the IP and domain collections; an adaptive response action for correlation searches and notable events. See Enterprise Security Integration.
• Dashboards. Investigation, Attack Surface Timeline, Compliance Summary, SPF Compliance and Mail Config. See Dashboards.
• Saved searches. Scheduled cache eviction, population of the threat-intelligence collections, and worked examples that enrich DNS domains, destination IPs and proxy hostnames. See Saved searches.
• Setup and operations. A UCC-based configuration UI that writes credentials to storage/passwords, structured key=value logging through whisper_logging, a [diag] stanza driven by whisper_diag.py for support bundles, and a least-privilege whisper_user role in authorize.conf.

Five places where the repository, the tag list and the Splunkbase listing say different things. None of them is settled silently.

The package id changed after the version bump. The v1.0.0 release notes call the package TA-whisper-security. The commit that renamed it to TA-whisper-graph landed between the version bump and the tag, so the tagged artifact, its app.manifest, its app.conf [package] stanza and the published .spl all say TA-whisper-graph. Splunk keys an installed app by that id, so that is the folder name you will have and the name to use in | rest queries.

Splunkbase and the manifest name the app differently. The listing is titled Whisper Security Graph App for Splunk; the shipped manifest's info.title is Whisper Security Add-on for Splunk. The manifest title is what Splunk Web shows once the app is installed.

Splunkbase declares a platform range the package does not. The listing names Splunk 10.2 through 10.5. The manifest declares no floor at all — three earlier attempts to state one were rejected by Splunkbase's SLIM validator, which checks the declared floor against a bundled release list that stops well below 10.x. The real floor is carried instead by python.required = 3.13 in every extension point, which makes Splunk silently skip those extension points on an older release rather than fail the install.

One date differs by a day. The package changelog dates 0.17.0 to 2026-04-03; its tag was published 2026-04-02 UTC, which is 3 April in the release engineer's timezone. Every date on this page is the tag's publish date in UTC, so this page says 2026-04-02.

Two releases the package changelog does not record

v0.22.0 and v0.23.0 were tagged, had releases cut with full notes, and never got an entry in CHANGELOG.md — in both cases a version bump was reverted or rewound afterwards and the pending entries were lost with it. Their content is not recoverable from the package; it is recoverable from the release list, so it is published here.

0.22.0 — 2026-04-13. The app surface was cut back to enrichment, investigation and attack surface, and the Health input, the Multi-Tenant Attack Surface module and the DNSSEC module were removed. It shipped alongside a Whisper Security SOAR Connector at the same version. That connector was removed one release later and is not part of any published version.

0.23.0 — 2026-04-19. The release that made Splunk Cloud Victoria submission possible. default/indexes.conf was dropped from the package, requests and its transitive dependencies were vendored under package/bin/lib/, log output was namespaced under the add-on's own directory beneath $SPLUNK_HOME/var/log/splunk/, aarch64 wheels were bundled for grpcio, and .spl file permissions were normalised. AppInspect went to zero errors and zero failures across all five tag sets. Python 3.9 support was dropped, moving the floor to 3.11. The Investigation dashboard's panels were repaired so that shared-nameserver, WHOIS-pivot, ASN/BGP/prefix and directed web-link panels each returned what their titles claimed, and a TA Health supportability dashboard was added — the same dashboard removed again in 0.23.1.

Every version below was tagged and had a release cut for it. None reached Splunkbase: the listing shows 1.0.0 and nothing else. There is no 0.1.0 tag and no release candidate; the history starts at 0.2.0.

Their release notes reference issue numbers in a repository that is not public, so the issue numbers are dropped here. The version, the date and what changed are not. If you are running one of these, 1.0.0 is the only version the rest of this documentation describes.

The pre-release tags

• The add-on repository's CHANGELOG.md — what changed in each version. It is authoritative for content and, as shown above, incomplete for versions.
• gh release list --repo whisper-sec/whisper-splunk — which tags exist and when each was published. This is the authority for version numbers and dates on this page, including the two releases the changelog omits.
• The Splunkbase listing for app 8695 — what is actually published, and the compatibility the listing declares.

All three were read on 2026-08-10. Nothing on this page is carried over from prose elsewhere in this documentation.

Give us the installed version and your Splunk version. The first comes from:

| rest /services/apps/local/TA-whisper-graph | table label version

Troubleshooting covers the failures that turn out not to be version-related.