Glossary
What Is Reconciled Verdict?
Published Last updated
A reconciled verdict is Whisper's single, blocking-aware threat assessment for an indicator — a score, a level, and a block/allow recommendation reconciled across many feeds and signals.
How Whisper models it
explain() reconciles every feed listing into one sourced verdict — score, level, factors, and named feeds with timestamps.
Raw threat feeds disagree: one lists an IP as malicious, another as benign, a third is stale. A reconciled verdict resolves that noise into one defensible answer — `verdictScore`, `verdictLevel`, and `verdictBlocking` — so triage is a single read instead of a judgement call.
Unlike a black-box score, the verdict stays inspectable: you can pull the contributing feeds, factors, and first/last-seen timestamps behind it. Prefer the verdict over the raw `threatScore` for blocking decisions.
See it in practice
Run it live in these use cases: Triage an alert in one query, Ground your agent in live infra.
Where this shows up
See it in a live investigation: Build the takedown evidence package, Ground your AI agent before it acts.
Go hands-on with the threat-intel recipes and the MCP setup guide.
Workflows that use this
Runnable workflows where this concept does the work.
Takedown Evidence Package
When you've found a malicious domain, the next hurdle is proving it. This assembles a one-pass takedown package — the reputation verdict, who owns it, the abuse lists naming it, and the infrastructure around it — laid out ready to hand to a registrar or hosting provider so the takedown actually sticks.
