# Whisper Security — Documentation > Index of all documentation pages. Each entry links to its markdown sibling for citation use. *Source: https://www.whisper.security/docs* --- ## Overview - [Products and services](https://www.whisper.security/docs/overview.md) — What Whisper is: one engine, two products built on it, the job each one answers and the chapter where each one's documentation starts. - [Support](https://www.whisper.security/docs/support.md) — Open a ticket with the context that gets it answered on the first reply: the request id, the replica that served you, and the query you ran. ## WhisperGraph - [Entities](https://www.whisper.security/docs/whisper-graph/schema/entities.md) — Every node label in WhisperGraph — what it represents, its count, and the queryable properties on indicators, prefixes, ASNs and ROAs. - [WhisperGraph](https://www.whisper.security/docs/whisper-graph.md) — What the graph contains: seven layers of the internet pre-joined into one queryable graph, and where to go deeper. - [Getting Started](https://www.whisper.security/docs/whisper-graph/getting-started.md) — Run your first query without a key, then investigate an indicator across the DNS, routing, geo, and threat layers in one request. - [Graph Schema](https://www.whisper.security/docs/whisper-graph/schema.md) — How WhisperGraph is structured: the internet as one connected graph, joined layer to layer. Start here, then drill into entities and pivots. - [Connection Types](https://www.whisper.security/docs/whisper-graph/schema/connections.md) — Every edge type in WhisperGraph — direction, source and target labels, and the physical-vs-virtual rules that decide how you traverse it. - [Pivoting Examples](https://www.whisper.security/docs/whisper-graph/schema/pivoting.md) — Worked cross-layer traversals — domain to network, IP to jurisdiction, ASN to registry and peers, actor to techniques. Not exhaustive. - [Threat Feeds & Categories](https://www.whisper.security/docs/whisper-graph/threat-feeds.md) — Every threat-intel feed and category in the graph, with refresh cadence, verdict properties, and example queries. - [Procedures](https://www.whisper.security/docs/whisper-graph/procedures.md) — What WhisperGraph's stored procedures do, which ones have a page of their own, and where the full column contracts live. - [Coverage — what we looked at](https://www.whisper.security/docs/whisper-graph/procedures/coverage.md) — Every Whisper verdict answers two questions: how bad, and what we actually looked at. Read coverage before band. - [explain() — Threat Verdicts](https://www.whisper.security/docs/whisper-graph/procedures/explain.md) — Scored threat verdicts for IPs, hostnames, ASNs, CIDRs, file hashes and CVE ids, with the factors and feed sources behind each score. - [whisper.assessUrl() — URL verdicts](https://www.whisper.security/docs/whisper-graph/procedures/assess-url.md) — A verdict for a full URL, reconciling the apex band with the path band, so a bad path on a clean host doesn't hide behind its reputation. - [whisper.variants() — Lookalike Generation](https://www.whisper.security/docs/whisper-graph/procedures/variants.md) — Generate typosquat and homoglyph lookalikes of a domain, keep only the registered ones, and pivot the hits straight into a threat verdict. - [whisper.history() — Point-in-Time](https://www.whisper.security/docs/whisper-graph/procedures/history.md) — WHOIS registration and BGP routing history for any indicator, as timestamped snapshots you can diff. - [whisper.origins() — Origin Discovery](https://www.whisper.security/docs/whisper-graph/procedures/origins.md) — De-cloak a CDN-fronted domain to its real origin IPs, ranked by confidence and how they were found. - [whisper.identify() — Identity & Assessment](https://www.whisper.security/docs/whisper-graph/procedures/identify.md) — Answer whose infrastructure a host is, whether it's dangerous, and what sits around it. The identity family: identify, assess, walk. - [Helpers — Naming & Lookups](https://www.whisper.security/docs/whisper-graph/procedures/helpers.md) — Utility procedures: apex/public-suffix tests, network rankings, Tor and TLS lookups, typed search, DNS resolution, CVEs, bulk export. - [Procedure Reference](https://www.whisper.security/docs/whisper-graph/procedures/reference.md) — The complete calling contract for every stored procedure: how CALL binds its arguments, and the exact YIELD columns of every family. - [Changelog](https://www.whisper.security/docs/whisper-graph/changelog.md) — Notable changes to WhisperGraph docs, API, MCP server, and Splunk integration. ## Cypher - [Cypher](https://www.whisper.security/docs/cypher.md) — The read-only Cypher dialect WhisperGraph runs over HTTP: how a query is shaped, and where the clause and function references live. - [Syntax & Clauses](https://www.whisper.security/docs/cypher/syntax.md) — The Cypher clauses, operators, subqueries, parameters, and path syntax WhisperGraph supports, with a working example for each. - [Functions](https://www.whisper.security/docs/cypher/functions.md) — The built-in Cypher function library: aggregation, string, numeric, collection, node, conversion, date and geospatial — with return values. - [Best Practices](https://www.whisper.security/docs/cypher/best-practices.md) — The habits that make WhisperGraph queries return in milliseconds, the traps that look like habits, and the graph's rules as instructions. - [Cheat Sheet](https://www.whisper.security/docs/cypher/cheat-sheet.md) — One-page Cypher cheat sheet: schema, edge directions, traversal chains, procedures with their columns, and query rules. ## HTTP API - [HTTP API](https://www.whisper.security/docs/cypher-api.md) — The REST endpoint in one screen: POST Cypher as JSON, send your key in a header, read the response envelope. - [POST /api/query](https://www.whisper.security/docs/cypher-api/reference/query-post.md) — The main query endpoint: send read-only Cypher as JSON, bind parameters, run batch statements. Reference with code in five languages. - [API Reference](https://www.whisper.security/docs/cypher-api/reference.md) — The Whisper API in three endpoints — POST /api/query, GET /api/query, GET /api/query/stats. Start here, then open the one you need. - [GET /api/query](https://www.whisper.security/docs/cypher-api/reference/query-get.md) — Run a Cypher query from a URL parameter, for quick checks and pasteable links. Reference with code in five languages. - [GET /api/query/stats](https://www.whisper.security/docs/cypher-api/reference/stats.md) — Graph-wide node and edge counts, threat-intel summary, and per-layer freshness and coverage. No key needed. Code in five languages. - [Errors](https://www.whisper.security/docs/cypher-api/errors.md) — Every error a wrong query can cause, keyed on its stable type slug — the problem+json body the API sends and the machine-readable extras. ## CLI - [CLI](https://www.whisper.security/docs/cli.md) — WhisperGraph from your terminal: run Cypher, run any catalog recipe by name, serve the graph to an MCP client, or walk it node by node. - [Query](https://www.whisper.security/docs/cli/query.md) — Run one read-only Cypher statement from the terminal, bind parameters with --param, and read the same JSON envelope the HTTP API returns. - [Recipes from the terminal](https://www.whisper.security/docs/cli/recipes.md) — Run any recipe in the catalog by name. Direct recipes answer with one table; flow recipes stream their steps as NDJSON you can pipe to jq. - [Local MCP server](https://www.whisper.security/docs/cli/mcp.md) — Serve WhisperGraph to any stdio MCP client from the binary on your machine, with the hosted connector's tools plus one per recipe. ## Workflows - [Workflows](https://www.whisper.security/docs/workflows.md) — Prepared investigations you run in the browser against the live graph, grouped by job, each with its Cypher visible and a recipe to paste. ## Recipes - [Recipes](https://www.whisper.security/docs/recipes.md) — The copy-paste Cypher, by job, that you adapt for your indicator — anchoring and fan-out bounds explained, re-run nightly on the live graph. - [Indicator Triage (SOC)](https://www.whisper.security/docs/recipes/soc.md) — From a raw IP or domain to a reconciled verdict, its feeds, network attribution, co-hosted blast radius, and a paste-ready evidence chain. - [Campaign Pivoting](https://www.whisper.security/docs/recipes/threat-intel.md) — Turn one indicator into the whole campaign: co-tenancy, registrant, nameserver, TLS and CT pivots, and the actor/ATT&CK reference layer. - [External Recon](https://www.whisper.security/docs/recipes/pentest-recon.md) — Passive recon: paginated subdomain discovery, IP footprint by prefix/ASN/city, owner attribution, CDN de-cloaking, CT and TLS pivots. - [Lookalike Hunting](https://www.whisper.security/docs/recipes/brand-protection.md) — Find typosquats, lookalike domains, fraudulent registrations, credential-theft infrastructure, and phishing kits reused across domains. - [BGP & RPKI](https://www.whisper.security/docs/recipes/bgp-routing.md) — Detect MOAS conflicts and RPKI-invalid routes, read a network's hijack and leak posture, follow its AS paths, and map its peering footprint. - [Posture Audits](https://www.whisper.security/docs/recipes/dns-email.md) — Cypher for DNS and email posture: nameserver/MX inventory with attribution, SPF trees, DKIM signers, DMARC destinations, scorecards. - [Third-Party & Portfolio Posture](https://www.whisper.security/docs/recipes/third-party-posture.md) — Cypher for reading a vendor from the outside: cyber-insurance risk scoring and auditor-verifiable compliance evidence, end to end. - [Attribution & Law Enforcement](https://www.whisper.security/docs/recipes/law-enforcement.md) — Pivot from indicators to operators via WHOIS, registrar ties, hosting providers, routing history, Tor identity and dark-web services. - [Internet Measurement](https://www.whisper.security/docs/recipes/research.md) — Bulk, aggregate Cypher for internet measurement: schema/feed catalogs, peering topology, RPKI coverage, root-server and cross-layer studies. - [Cross-Layer Patterns](https://www.whisper.security/docs/recipes/cross-cutting.md) — Patterns that compose attribution, verdicts, blast radius, history and identity into one investigation, plus batch and automation shapes. - [Attack Paths](https://www.whisper.security/docs/recipes/attack-paths.md) — What an external attack path is on this graph, which edges compose one, and how to read a shared node as evidence. - [Tracing a Path](https://www.whisper.security/docs/recipes/tracing-a-path.md) — Follow one alert from a hostname to a choke point you can act on, in five steps, each with a runnable query. - [Exporting at volume](https://www.whisper.security/docs/guides/bulk-export.md) — whisper.export pulls the reconciled threat corpus a page at a time, by label, with a cursor — for training a classifier or seeding a store. - [Standing watches](https://www.whisper.security/docs/guides/watches-and-alerting.md) — whisper.watch subscribes to a change in the graph and tells you when it happens — a graph-delta subscription, not a detection. ## Agent Identity - [Agent Identity](https://www.whisper.security/docs/identity.md) — One routable address per workload, published in DNS and the public registry, checkable by a stranger with no key. - [The Address as Identity](https://www.whisper.security/docs/identity/address.md) — Where the name comes from, and why forward and reverse DNS have to agree before anything trusts the bits. - [Create an Identity](https://www.whisper.security/docs/identity/create.md) — Mint a routable address for one agent, capture the key it hands back once, and confirm it in public DNS. - [Verify an Identity](https://www.whisper.security/docs/identity/verify.md) — Ask one keyless endpoint whether an address really belongs to a Whisper agent, and read the evidence it returns. - [The Proof Chain](https://www.whisper.security/docs/identity/proofs.md) — Every record and endpoint a stranger can check, what each one asserts, and the command that reads it. - [Verify Without Trusting Us](https://www.whisper.security/docs/identity/trustless.md) — Re-derive the whole answer on your own machine from the DNSSEC root, and read the trust level on each row. - [Revoke an Identity](https://www.whisper.security/docs/identity/revoke.md) — Cut an agent off the network for good, then prove to anyone that the cut happened. - [Nested Identities](https://www.whisper.security/docs/identity/nested.md) — What happens when one agent egresses behind another: how the edge is seen, published and governed. - [Keys, Signing and Encryption](https://www.whisper.security/docs/identity/keys.md) — Per-agent cryptographic material, the DNS records that pin it, and what a recipient can check with stock tools. - [RDAP and WHOIS](https://www.whisper.security/docs/identity/registry.md) — What the public registry publishes for one allocation, and how to read the same record over either protocol. - [The Transparency Log](https://www.whisper.security/docs/identity/transparency.md) — How an issuance becomes a leaf, what a checkpoint commits to, and why a shredded entry leaves the proofs intact. - [Bring Your Own Domain](https://www.whisper.security/docs/identity/own-domain.md) — Delegate an apex you control and publish the matching DS, then mint agents under a name the world already knows. - [Device Identities](https://www.whisper.security/docs/identity/devices.md) — A phone or a laptop gets a resolve-only allocation with a credential that refuses every control call. - [Vehicle Identities](https://www.whisper.security/docs/identity/vehicles.md) — A deterministic allocation derived from a hardware key plus the VIN, checkable by a stranger and cut in one call. ## Network & DNS - [Network & DNS](https://www.whisper.security/docs/network.md) — Where your traffic leaves from, and what answers a name lookup before the answer reaches the agent that asked. - [Egress](https://www.whisper.security/docs/network/egress.md) — Put an agent's outbound connections behind its own address, and let the far end confirm which one it saw. - [Connectivity Tiers](https://www.whisper.security/docs/network/egress/tiers.md) — What each way of putting an agent behind its own address gives you, and what it asks of the host. - [Send Traffic From Your Address](https://www.whisper.security/docs/network/egress/connect.md) — Bring up a bound egress on this host, run a job through it, and prove the far end saw the identity you expect. - [Egress Authentication](https://www.whisper.security/docs/network/egress/auth.md) — What the proxy accepts as proof that a connection belongs to your identity, and where each credential comes from. - [Serverless and Edge Runtimes](https://www.whisper.security/docs/network/egress/serverless.md) — How a function that can only call fetch still reaches a target from its own identity, with one HTTPS hop. - [Reaching IPv4 Destinations](https://www.whisper.security/docs/network/egress/ipv4.md) — What the far end sees as the source of a connection when it speaks only the older protocol, and where the record of that connection lives. - [Resolver](https://www.whisper.security/docs/network/resolver.md) — Name lookups checked against the graph before they are answered, and the account policy that decides the rest. - [How Resolution Works](https://www.whisper.security/docs/network/resolver/how-it-works.md) — What happens between a name lookup arriving and its answer, and what a refusal looks like on the wire. - [Encrypted DNS](https://www.whisper.security/docs/network/resolver/encrypted-dns.md) — Point a host's name lookups at your account over a private channel, then confirm the answers are coming from it. - [Resolver Policy](https://www.whisper.security/docs/network/resolver/policy.md) — The fields that decide which names your account answers, which it refuses, and who is allowed to ask. - [Devices](https://www.whisper.security/docs/network/devices.md) — What a phone or a laptop gets from your account when it resolves names through Whisper and runs nothing else. - [Set Up a Device](https://www.whisper.security/docs/network/devices/setup.md) — Mint a resolve-only credential, install it on the machine, and confirm the answers now come from your account. - [Authoritative DNS](https://www.whisper.security/docs/network/authoritative.md) — Which zones Whisper answers for, what signs them, and how a name under your own apex joins them. ## Whalenet - [Whalenet](https://www.whisper.security/docs/whalenet.md) — Inspect and govern the fleet you already run, where every member holds a routable address anyone can verify. - [Nodes, Names and Tags](https://www.whisper.security/docs/whalenet/nodes.md) — A fleet member is minted through the control plane, with what it is called derived from the address it holds. - [Inspect Your Fleet](https://www.whisper.security/docs/whalenet/inspect.md) — Read what the shell reports about this machine, its peers, the round trip to one of them, who holds an address. - [The Access Document](https://www.whisper.security/docs/whalenet/access.md) — One HuJSON file per fleet decides which of your own principals may reach which targets, on which ports. - [East-West Reachability](https://www.whisper.security/docs/whalenet/east-west.md) — What decides whether one of your agents may open a connection to another, before any packet is sent. - [Approval and Holds](https://www.whisper.security/docs/whalenet/approval.md) — Decide whether a new member reaches its siblings, admit it deliberately, or unbind one that is already live. - [Serve and Funnel](https://www.whisper.security/docs/whalenet/serve.md) — Put a local port in front of the fleet, or in front of the internet, over a leaf certificate pinned in DNS. - [Whalenet DNS Records](https://www.whisper.security/docs/whalenet/dns.md) — What a fleet publishes in its own subtree, how to read a name through the resolver in effect, the verbs that write. - [SSH Between Nodes](https://www.whisper.security/docs/whalenet/ssh.md) — Open a shell on a fleet member with its host key proven from the IANA DNSSEC root before the session is trusted. - [Managed Settings](https://www.whisper.security/docs/whalenet/settings.md) — What an MDM can pin on a machine so the client arrives pointed at the right control plane with the right key file. - [Plan a Migration](https://www.whisper.security/docs/whalenet/migrate.md) — Read an existing mesh with credentials that cannot write, then study the file that enumerates every change it describes. ## Control Plane API - [Control Plane API](https://www.whisper.security/docs/control-plane.md) — One Cypher verb over one HTTP endpoint mints addresses, sets resolver rules, reads logs and cuts access. - [The Request Envelope](https://www.whisper.security/docs/control-plane/envelope.md) — How to build the Cypher map literal by hand, and the columns every answer comes back in. - [Keys and Scopes](https://www.whisper.security/docs/control-plane/auth.md) — Where a credential comes from, how it travels on the wire, and the authority each call has to carry. - [Operations](https://www.whisper.security/docs/control-plane/operations.md) — One page for each verb the plane accepts, with its arguments, its return columns and the authority it needs. - [Mint an Identity](https://www.whisper.security/docs/control-plane/operations/register.md) — Two ways to get a routable address: a new principal with a key of its own, or one more on the key you hold. - [Read Your Fleet](https://www.whisper.security/docs/control-plane/operations/list.md) — The roster of everything the account holds, and the full record behind any single address. - [Request Connectivity](https://www.whisper.security/docs/control-plane/operations/connect.md) — Ask for the credentials and configuration that make traffic leave from an agent's own address. - [Set Policy](https://www.whisper.security/docs/control-plane/operations/policy.md) — Write the account's resolver rules, or read back the ones in force, with one call each way. - [Read Query Logs](https://www.whisper.security/docs/control-plane/operations/logs.md) — Pull the lookups, connections and allocations the plane recorded for one agent over a window you choose. - [Revoke](https://www.whisper.security/docs/control-plane/operations/revoke.md) — One call that takes an address, its names, its pinned key and its egress out of service for good. - [Manage a Domain](https://www.whisper.security/docs/control-plane/operations/domain.md) — Attach a name you already own, read what the plane observes about it, and list the ones attached. - [Firewall and Response](https://www.whisper.security/docs/control-plane/operations/contain.md) — The reversible hold at the network edge, and the action dispatched to the sensor on a host. - [Error Codes](https://www.whisper.security/docs/control-plane/errors.md) — Every failure the plane reports, keyed on its stable slug, with the status it carries and whether sending the call again helps. - [Keyless Endpoints](https://www.whisper.security/docs/control-plane/keyless.md) — What anyone can check about an address with no account: the verdict, the registry record and the signed log. - [Discovery Files](https://www.whisper.security/docs/control-plane/discovery.md) — Machine-readable manifests an agent reads to find the plane, its spec, its onboarding path and the skills it offers. ## Endpoint Security - [Endpoint Security](https://www.whisper.security/docs/endpoint.md) — An EDR built on the host's own routable address: what the machine sees, what the network sees, one place to act. - [How the Sensor Works](https://www.whisper.security/docs/endpoint/how-it-works.md) — What a host watches, what leaves it, and where the verdict on a destination actually comes from. - [Install](https://www.whisper.security/docs/endpoint/install.md) — Put the binary on a machine, give it the address it reports under, and start the service, in that order. - [Install on Linux](https://www.whisper.security/docs/endpoint/install/linux.md) — Four commands take a server from nothing to a service that reports under the host's own address. - [Install on Windows](https://www.whisper.security/docs/endpoint/install/windows.md) — Four PowerShell commands, run as one account, leave a service that reports under the machine's own address. - [Bind the Host](https://www.whisper.security/docs/endpoint/install/enroll.md) — The step that gives a machine the address it reports under, and the reason root needs to keep your environment. - [The Sensor Service](https://www.whisper.security/docs/endpoint/install/service.md) — Every verb, both units, the files they write, and the ceilings declared where you can read them. - [Upgrade and Remove](https://www.whisper.security/docs/endpoint/install/remove.md) — Move a host to a newer binary without losing its address, take the service off, or take the machine off entirely. - [Operate](https://www.whisper.security/docs/endpoint/operate.md) — Reading an estate, deciding what needs you, and acting on the plane that still works when a machine is lost. - [The Operator Console](https://www.whisper.security/docs/endpoint/operate/console.md) — One signed-in view of your own estate, grouped by the question each surface answers. - [Your Fleet](https://www.whisper.security/docs/endpoint/operate/fleet.md) — The roster, the two coverage axes that are easy to confuse, and what an unscored row actually means. - [Alerts and Incidents](https://www.whisper.security/docs/endpoint/operate/alerts.md) — Why something interrupts you, what a person did to it, and how a quiet answer proves itself. - [What the Sensor Detects](https://www.whisper.security/docs/endpoint/operate/detections.md) — The behavioural families that raise a finding, the rule formats accepted beside them, and the key that turns one off. - [Add Your Own Rules](https://www.whisper.security/docs/endpoint/operate/rules.md) — Put a Sigma rule on a host, map it to an event kind the collectors emit, and confirm it fired. - [Posture and Exposure](https://www.whisper.security/docs/endpoint/operate/posture.md) — The standing inventory beside the event stream: what is installed on a machine, and what is open against it. - [The Response Ladder](https://www.whisper.security/docs/endpoint/operate/response.md) — Two planes to act on, what each one needs from the machine, and which of them survives a fully owned host. - [Contain an Endpoint](https://www.whisper.security/docs/endpoint/operate/contain.md) — Put a reversible hold on a machine at the network layer, lift it again, or cut the address for good. - [What the Sensor Costs](https://www.whisper.security/docs/endpoint/operate/footprint.md) — Where the work happens, what holds it back under load, and how to read the ceilings on your own machine. - [Endpoints With No Sensor](https://www.whisper.security/docs/endpoint/no-sensor.md) — A machine you cannot install on still gets a verifiable address, resolution with a verdict, and containment that works off it. - [Troubleshooting](https://www.whisper.security/docs/endpoint/troubleshooting.md) — The symptom, what it means, and the command that fixes it, starting with the one that accounts for most cases. ## Partners - [Partners](https://www.whisper.security/docs/partners.md) — Work a book of customers from one console, with each estate reached as that customer's own account and every action kept on the record. - [Firms, Customers, Endpoints](https://www.whisper.security/docs/partners/model.md) — The four levels the portal counts in, from the company you sign in as down to the address one machine answers on. - [Join a Firm](https://www.whisper.security/docs/partners/join.md) — Two calls put partner authority on an operator's key: one from an administrator, and one from the person taking it up. - [Onboard a Customer](https://www.whisper.security/docs/partners/onboard.md) — Take one company live end to end, from naming it to a first endpoint that answers, with checks anyone can repeat. - [Customer Keys and Grants](https://www.whisper.security/docs/partners/keys.md) — How a firm holds the authority to act inside an estate, where that authority lives, and what ends it. - [The Queue](https://www.whisper.security/docs/partners/queue.md) — Which of your customers needs a human right now, worst first, and the change feed that list is drawn from. - [Incidents and Cases](https://www.whisper.security/docs/partners/incidents.md) — A detection is something the plane saw; the record you open from it is the thing you work, and it keeps the evidence. - [Hunt Across the Book](https://www.whisper.security/docs/partners/hunt.md) — One indicator, every customer at once: which estates have it in their records, and what the graph says about it. - [Shared Infrastructure](https://www.whisper.security/docs/partners/overlap.md) — What two or more of your customers reached, the verdict on each destination, and how one answer becomes a rule for all of them. - [Response Verbs](https://www.whisper.security/docs/partners/respond.md) — Each containment action the portal can dispatch, what it changes, whether it needs the sensor, and what it writes to a case. - [Playbooks](https://www.whisper.security/docs/partners/playbooks.md) — A written response the portal runs unattended, the questions it still hands back to a person, and the version each run records. - [Policy Across Customers](https://www.whisper.security/docs/partners/policy.md) — What each estate's resolver blocks, allows and answers by default, and the one decision you can take for a whole book at once. - [Prove and Report](https://www.whisper.security/docs/partners/prove.md) — Answer the negative question for a customer, then hand over the answer, the census behind it and the identity checks. - [Audit and Compliance](https://www.whisper.security/docs/partners/audit.md) — Who did what in whose estate, how much of a framework the book covers, and the export that reconciles what you delivered. - [Your Team and Roles](https://www.whisper.security/docs/partners/team.md) — Who in the firm may read, respond, tune, provision and act on people, and the screen where each of those is set. ## Agents & MCP - [Agents & MCP](https://www.whisper.security/docs/ai.md) — Ground AI agents in the live WhisperGraph over MCP: 7 tools, all read-only, a shared workflow gallery, and evidence behind every answer. - [Setup](https://www.whisper.security/docs/ai/mcp/setup.md) — Connect any MCP client to the Whisper graph: the Connectors Directory listing, per-client config, OAuth and API-key auth, scope grants. - [Your first investigation](https://www.whisper.security/docs/ai/mcp/investigation.md) — One alert, worked end to end over the connector: read the verdict's scope, find why it's listed, follow the pivot the score misses. - [Workflow gallery](https://www.whisper.security/docs/ai/mcp/workflow-gallery.md) — The shared gallery of investigation workflows behind the MCP server: discover with list_workflows, run with run_workflow, cite the evidence. - [Reference](https://www.whisper.security/docs/ai/mcp/reference.md) — Every tool, resource and prompt the MCP server exposes — arguments, batch shapes, response fields, the evidence model, and coverage. - [Agent Skills](https://www.whisper.security/docs/ai/mcp/skills.md) — Open-source investigation playbooks for the Whisper MCP connector — triage, Cypher authoring, brand protection — as a Claude Code plugin. - [Query language](https://www.whisper.security/docs/ai/mcp/query.md) — What the query tool accepts, what it refuses before the database sees it, and how to read what comes back. - [Programmatic Signup (for Agents)](https://www.whisper.security/docs/ai/agent-signup.md) — Two HTTP calls to a working Whisper API key — built for agents and automated runtimes, no browser or CAPTCHA, email verification only. - [Changelog](https://www.whisper.security/docs/ai/mcp/changelog.md) — What changed on the Whisper MCP connector, dated; plus the deprecation policy and how to check the live shape right now. ## Integrations - [Integrations](https://www.whisper.security/docs/integrations.md) — Ways to connect WhisperGraph to your stack: native connectors, the REST Cypher API for pipelines, and MCP for AI assistants. - [What Every Connector Guarantees](https://www.whisper.security/docs/integrations/contract.md) — The field contract the four table-writing connectors share: guaranteed/conditional columns, what's absent on failure, and verdict semantics. - [Splunk Integration](https://www.whisper.security/docs/integrations/splunk/overview.md) — Connect Splunk to WhisperGraph for IOC enrichment, ad-hoc graph queries, threat intel and attack-surface monitoring — components, commands. - [Install & Configure](https://www.whisper.security/docs/integrations/splunk/install.md) — What the Whisper add-on needs, how to install it on Enterprise or Splunk Cloud, create the whisper index it writes to, and its settings. - [Deployment Architecture](https://www.whisper.security/docs/integrations/splunk/deployment-architecture.md) — Where the add-on runs in a distributed deployment: Splunk roles, deployment/search-head/indexer clusters, forwarders, Splunk Cloud. - [Using It](https://www.whisper.security/docs/integrations/splunk/using-it.md) — What the add-on does once installed: the five search commands and their field contract, what the pipeline reaches, and its scheduled inputs. - [Splunk Dashboards Reference](https://www.whisper.security/docs/integrations/splunk/dashboards.md) — Pre-built dashboards for investigation, attack surface, compliance, and add-on health. - [Reference](https://www.whisper.security/docs/integrations/splunk/reference.md) — Every sourcetype, field alias, lookup, collection, macro and saved search the add-on ships, with a status on each row. - [Enterprise Security Integration](https://www.whisper.security/docs/integrations/splunk/es-integration.md) — Splunk ES compatibility: threat-intel collections and what blocks them populating, adaptive response, CIM aliases, and corrected detections. - [Troubleshooting](https://www.whisper.security/docs/integrations/splunk/troubleshooting.md) — Common errors, diagnostic commands, log locations, file precedence, known issues, and where to get support. - [Changelog](https://www.whisper.security/docs/integrations/splunk/changelog.md) — Every tagged version of the Whisper add-on for Splunk, dated from the release tags, with what shipped in the version you can install. - [OpenCTI Integration](https://www.whisper.security/docs/integrations/opencti/overview.md) — Connect OpenCTI to WhisperGraph for one-click observable enrichment: DNS, WHOIS, BGP and threat context written back as STIX 2.1 objects. - [Requirements](https://www.whisper.security/docs/integrations/opencti/requirements.md) — Platform versions, accounts and network access — with the connector tag this page was verified against and the date it was checked. - [Installation](https://www.whisper.security/docs/integrations/opencti/installation.md) — Pull the public image from Docker Hub, add the connector container to your compose stack, and verify it registered. - [Configuration](https://www.whisper.security/docs/integrations/opencti/configuration.md) — Every environment variable with defaults: OpenCTI settings, connector scope, auto-enrichment, the TLP gate, and retry behavior. - [Enriching Observables](https://www.whisper.security/docs/integrations/opencti/enrichment.md) — What enrichment returns for IPs, domains, and AS numbers, the notes that carry threat evidence, and how to read the results. - [Data Mapping](https://www.whisper.security/docs/integrations/opencti/data-mapping.md) — WhisperGraph labels and edges to STIX 2.1 objects: deterministic IDs, hostname validation, what a bundle contains, and current limitations. - [Troubleshooting](https://www.whisper.security/docs/integrations/opencti/troubleshooting.md) — Common failure modes in the order you'll hit them: registration, empty results, auth errors, transport failures, and where to escalate. - [Microsoft Sentinel Integration](https://www.whisper.security/docs/integrations/sentinel/overview.md) — Bring WhisperGraph into Microsoft Sentinel: playbooks, pipelines, workbooks, analytics rules and hunting queries from the Content Hub. - [Requirements](https://www.whisper.security/docs/integrations/sentinel/requirements.md) — Azure permissions, the Sentinel workspace, the RBAC-mode Key Vault and the Whisper API key, with the solution version verified against. - [Installation](https://www.whisper.security/docs/integrations/sentinel/installation.md) — Store the API key in Key Vault, install from the Content Hub or the Marketplace listing, verify first data, and upgrade in place. - [Configuration](https://www.whisper.security/docs/integrations/sentinel/configuration.md) — The one-time post-install steps: playbook permissions, automation rules, analytics rule enablement, and the scheduled-pipeline watchlists. - [Playbooks](https://www.whisper.security/docs/integrations/sentinel/playbooks.md) — The ten incident-triggered enrichment playbooks: what each answers, which table it writes, typical latency, and its automation-rule pairing. - [Workbooks & Detections](https://www.whisper.security/docs/integrations/sentinel/workbooks-detections.md) — Five workbooks, eight analytics rules and six hunts — the table each reads, what writes it, and whether it fires on a default install. - [Data Reference](https://www.whisper.security/docs/integrations/sentinel/data-reference.md) — The four Whisper custom tables with their full column contracts, and the five ingestion pipelines that fill them. - [Troubleshooting](https://www.whisper.security/docs/integrations/sentinel/troubleshooting.md) — Install-time failures, API error codes in playbook runs, data that does not appear, and where to escalate — with diagnostics that work. - [Release History](https://www.whisper.security/docs/integrations/sentinel/changelog.md) — Every released version of the Whisper solution for Microsoft Sentinel and what shipped, taken from Microsoft's own release notes. - [Wazuh integration — overview](https://www.whisper.security/docs/integrations/wazuh/overview.md) — Enrich Wazuh alerts with Whisper context on external indicators, and optionally bring agent DNS and egress activity into Wazuh. - [Install the Wazuh integration](https://www.whisper.security/docs/integrations/wazuh/installation.md) — Four install paths on a Wazuh 4.x manager — bootstrap, tarball, .deb/.rpm, or the official integrations repo — and how to verify enrichment. - [Configure the Wazuh integration](https://www.whisper.security/docs/integrations/wazuh/configuration.md) — Trigger groups, the API key file, the enrichment envelope field by field, the verdict gates, and what to check when nothing appears. - [MISP integration — overview](https://www.whisper.security/docs/integrations/misp/overview.md) — Enrich a MISP attribute — IP, domain, hostname or AS number — with ASN, DNS, WHOIS and threat-intel context, returned as MISP objects. - [Install and configure the MISP module](https://www.whisper.security/docs/integrations/misp/installation.md) — Upgrade the modules service to pick up the Whisper expansion module, set its four settings, and confirm enrichment is firing.