Products and services
What Whisper is: one engine, two products built on it, the job each one answers and the chapter where each one's documentation starts.
On this page (5)
Products and services Documentation
Whisper is one account, one key, and three tiers. WhisperGraph is the engine and the data. Whisper Intelligence and Whisper Graph XDR are the two products built on it. "The Whisper platform" is the plain descriptor for the pair; it is not a third thing to buy. This page says what each one is and which chapter documents it.
WhisperGraph, the engine
WhisperGraph models the internet as one connected graph — naming and DNS, addressing and geography, routing, ownership, email posture, and threat intelligence, each layer joined to the next. Both products read it. Nothing else here stands on its own.
Start at WhisperGraph for what the graph contains, or Getting Started to run a query straight away. Neither needs a key to begin.
Whisper Intelligence: ask the graph about the world
Whisper Intelligence is the query side — anything you want to know about a host, address, network or certificate you do not own. Its documentation starts at Cypher, the read-only query dialect. The HTTP API sends that dialect over the wire and the CLI runs it from a terminal. Workflows run a prepared investigation in the browser without writing a query, and Recipes is the copy-paste Cypher those investigations are built from.
Whisper Graph XDR: enforce it on your own estate
Whisper Graph XDR is the other direction — turning what the graph knows into what your own machines and agents are allowed to reach. Its documentation starts at Agent Identity, where an identity is a routable address a stranger can verify with dig and curl alone.
Network & DNS turns that identity into attributable egress and a policy-aware resolver, Whalenet is the mesh between the nodes that hold one, and the Control Plane API is the one call that mints, governs and revokes them. Endpoint Security is the sensor that runs on a host, watching processes, files and connections, and reporting under that host's own identity. A firm that runs security for other companies works from Partners, reaching each customer's estate as that customer's own account.
Reach either one from where you already work
Two chapters belong to both products rather than to one. Agents & MCP connects any MCP-capable client to the live graph: read-only tools, a coverage-qualified verdict, and an evidence trail behind every answer — Your first investigation works one alert end to end. Integrations puts the same answers inside the tools teams already run, so a verdict lands beside the alert instead of in a second tab.
How the pieces meet
An agent gets an identity, so its egress is attributable and its lookups carry your policy. The sensor reports under that same identity, so a host's detections and its connections are one record rather than two to reconcile by hand. WhisperGraph scores what that object reached, an agent can ask it directly over MCP, and a firm working a book reads all of it, one estate at a time, with the customer's own key.