Integrations
The best enrichment is the kind
nobody has to remember to use.
Whisper is a layer, not a destination. It scores the connection inside the SIEM where the alert already landed, in the playbook already running, and in the agent loop already looping.
Inside the tools you already run.
Splunk
ShippedA search command that enriches any IP or domain in place, plus Lookup and Investigation dashboards for ad-hoc pivots. Nothing leaves your indexers.
Microsoft Sentinel
ShippedIncident-triggered playbooks that post enrichment back as comments, scheduled pipelines that keep baseline intel fresh, and workbooks, analytics rules and hunting queries over the same tables.
OpenCTI
ShippedBidirectional connector, STIX 2.1. Hydrates observables with resolving IPs, co-hosted domains, shared certificates and registrant pivots.
SOAR and XSOAR
ShippedPlaybook actions for enrichment, expansion and evidence collection.
Wazuh
ShippedEnrichment for alerts and threat hunts on every external indicator — ASN ownership, co-hosting and sourced threat scores.
n8n
ShippedNode for automation workflows.
Enrichment result on a MISP event, with the ASN and domain-ip objects Whisper added
MISP
ShippedExpansion and hover modules that enrich an IP, domain, hostname or AS attribute with ASN, DNS, WHOIS and threat-intelligence context. Ships inside misp-modules.
index=proxy | whisperlookup ip
→ whisper_asn_name, whisper_country, whisper_threat_level, whisper_is_tor, whisper_is_c2One endpoint. Any agent. Plain language.
Point Claude, Cursor, VS Code, Windsurf or anything else that speaks MCP at one endpoint. The keyless tier lets an agent verify an identity and run a lookup with no account at all, so you can test it before you procure it.
One detail that matters more than it sounds: the graph can tell an agent the difference between “no data” and “known clean”. Flat reputation APIs cannot, and that single ambiguity is where most agent reasoning about infrastructure quietly goes wrong.
claude mcp add --transport http whisper-graph https://mcp.whisper.security \ --header "Authorization: Bearer YOUR_API_KEY"
An answer that admits what it does not know
Most feeds answer yes or no, so a host nobody has reported reads as benign and brand-new attacker infrastructure sails through. Coverage is a first-class field here, so the agent can tell “checked, clean” from “never seen”.
- Known-clean
- We looked and found nothing adverse. A safe conclusion the agent can act on.
- No data
- We have no information on this host. Not safe, just new. An agent that reads absence of evidence as evidence of safety is exactly the failure this prevents.
- Listed
- The host appears in threat intelligence, returned with the feeds and factors behind the verdict so the agent can weigh it.
Every verdict comes back with its factors and the exact source feeds, dated. For the agent that is a check against its own confidence; for the analyst reviewing its work it is the difference between “the model said so” and a sourced finding that goes into a ticket.
The seven tools your agent gets
The agent chooses among these on its own. Every one is read-only and returns structured rows, so the surface you grant is the whole surface. Input schemas and example calls are in the tool reference.
queryRun a Cypher query against the graph and get back columns, rows, statistics and an evidence block. The primary tool.
explain_indicatorA threat verdict for an IP, hostname, CIDR or ASN, with a score, a severity level, and the reasoning and sources behind it.
explain_schemaThe schema, on demand. No argument returns the label catalogue; pass a label to get its properties, edges and a runnable sample traversal.
read_docsPull the Whisper docs on demand — list, search, or fetch one page as Markdown — so the Cypher reference stays out of the always-on context.
list_workflowsSearch the shared workflow and recipe gallery. Each item comes back with its summary and full parameter space.
run_workflowRun one or more gallery playbooks by slug in a single call — a multi-step investigation collapsed into one tool call, with chained results and an evidence trail.
identifyWhose infrastructure a set of hostnames belongs to — vendor and role attribution, deliberately not a threat verdict.
One real question, end to end
A real run_workflow call against the live graph — the question, the tool call, an abridged response, and what the agent says back.
- 01Ask
Is anyone impersonating github.com right now, and is any of it dangerous?
- 02Call
{ "method": "tools/call", "params": { "name": "run_workflow", "arguments": { "runs": [{ "slug": "typosquat", "input": "github.com" }] } } } - 03Return
{ "totalLatencyMs": 5396, "steps": [ { "title": "Registered look-alikes", "rowCount": 170 }, { "title": "Threat-feed listings (popularity excluded)", "rowCount": 1 }, { "title": "Where they point (IP \u2192 prefix \u2192 ASN)", "rowCount": 67 }, { "title": "Shared registrant email / nameserver / mail", "rowCount": 50 } ], "evidence": [ "170 registered look-alike(s) found for github.com", "1 third-party look-alike listed in a threat feed: xn--ithub-qmc.com (hagezi-tif-full, phishing-database-domains)", "28 third-party look-alikes resolve to live hosting", "6 operator clusters of look-alikes share one registrant" ] } - 04Answer
170 registered look-alikes of github.com exist. One — xn--ithub-qmc.com, a punycode homograph — is already listed on two threat feeds (hagezi-tif-full, phishing-database-domains) for phishing and malware distribution. 28 more resolve to live hosting right now, and 6 operator clusters share a registrant across multiple squats. The whole investigation, eleven chained Cypher queries, ran in 5.4 seconds — every number above traces back to the query that produced it.