Integrations

The best enrichment is the kind
nobody has to remember to use.

Whisper is a layer, not a destination. It scores the connection inside the SIEM where the alert already landed, in the playbook already running, and in the agent loop already looping.

Book a DemoFree Sign Up
Security platforms

Inside the tools you already run.

src_ipownerverdict176.123.0.55ALEXHOST SRLevidenced104.18.32.7Cloudflare, Inc.clean| whisper lookup src_ip

Splunk

Shipped

A search command that enriches any IP or domain in place. Published on Splunkbase.

entityownerwatchlist45.137.215.48Scalaxy B.V.added104.18.32.7Cloudflare, Inc.noenrichment plus watchlist sync

Microsoft Sentinel

Shipped

Enrichment and watchlist integration.

observableownerstixipv4-addrALEXHOST SRLimporteddomain-nameAS204601exportedSTIX 2.1, both directions

OpenCTI

Shipped

Bidirectional connector, STIX 2.1.

IFplaybook step: enrichinput: alert indicatorEXPANDenrich, expand, collect evidence

SOAR and XSOAR

Shipped

Playbook actions for enrichment, expansion and evidence collection.

agentdest ownerverdictwazuh-014AS204601evidencedwazuh-027Akamaiclean

Wazuh

Shipped

Enrichment for the open source stack.

IFtrigger: new indicatornode: Whisper lookupROUTEa node in the workflow you already run

n8n

Shipped

Node for automation workflows.

index=proxy | whisperlookup ip
→ whisper_asn_name, whisper_country, whisper_threat_level, whisper_is_tor, whisper_is_c2
MCP

One endpoint. Any agent. Plain language.

Point Claude, Cursor, VS Code, Windsurf or anything else that speaks MCP at one endpoint. The keyless tier lets an agent verify an identity and run a lookup with no account at all, so you can test it before you procure it.

One detail that matters more than it sounds: the graph can tell an agent the difference between “no data” and “known clean”. Flat reputation APIs cannot, and that single ambiguity is where most agent reasoning about infrastructure quietly goes wrong.

>is any of our vendor infrastructure registered outside the EU?1 of 38 vendor prefixes resolves to an operatorregistered outside the EU.vendor F: AS200019 — ALEXHOST SRL, MDcoverage: 37 of 38 vendors fully resolved1 of 38 unresolvedcoverage stated, never implied
Device & fleet management

Deploy through the management you already use.

PlatformStatus
Microsoft IntuneShipped
JamfShipped
KandjiShipped
OmnissaShipped
HexnodeShipped
RMM-agnostic universal installerShipped
Formats & delivery

Out in any shape, delivered any way.

OutUse
JSONDefault
STIX 2.1Intelligence platform exchange
MISPCommunity sharing
CSVAnalyst and reporting workflows
DeliveryUse
REST pollingSimplest
Server sent eventsContinuous stream
WebSocketLow latency push
WebhookWatch subscriptions, on change

If it is not on
this list, ask.

One endpoint and Cypher. Most integrations take an afternoon.

Book a DemoFree Sign Up