Glossary
What Is Reconciled Verdict?
A reconciled verdict is Whisper's single, blocking-aware threat assessment for an indicator — a score, a level, and a block/allow recommendation reconciled across many feeds and signals.
How Whisper models it
explain() reconciles every feed listing into one sourced verdict — score, level, factors, and named feeds with timestamps.
Raw threat feeds disagree: one lists an IP as malicious, another as benign, a third is stale. A reconciled verdict resolves that noise into one defensible answer — `verdictScore`, `verdictLevel`, and `verdictBlocking` — so triage is a single read instead of a judgement call.
Unlike a black-box score, the verdict stays inspectable: you can pull the contributing feeds, factors, and first/last-seen timestamps behind it. Prefer the verdict over the raw `threatScore` for blocking decisions.
See it in practice
Run it live in these use cases: Triage an alert in one query, Ground your agent in live infra.
Where this shows up
See it in a live investigation: Build the takedown evidence package, Ground your AI agent before it acts.
Go hands-on with the threat-intel recipes and the MCP setup guide.
Workflows that use this
Runnable workflows where this concept does the work.