Integrations

Whisper, inside the tools
you already run.

Intelligence answers inside your SIEM, your threat-intel platform and your AI agents. Graph XDR installs through the device management you already use, and gives agents on any framework an identity.

For IntelligenceFor Graph XDR
Whisper Intelligence

Enrichment where the alert already is.

SIEM ALERToutbound to a rare hostsrc agent-7f3adst login-verify.example203.0.113.24indicatorWHISPER CONNECTORSplunk commandSentinel playbookWazuh · OpenCTI · MISPone queryWHISPERGRAPHevery layerevidenceTHE SAME ALERT, ENRICHEDownerExample Hosting LtdnetworkAS64511 · /24co-hosted14 other namesfeeds3, with weightsverdictHIGH · listedrulebulletproof
Enrichment lands on the alert your analyst already has open.

  • Splunk

    A search command that enriches any IP or domain in place, with lookup and investigation dashboards and Enterprise Security support. Nothing leaves your indexers.

    Live · docs

  • Microsoft Sentinel

    Playbooks that post enrichment to incidents, scheduled pipelines, workbooks, analytics rules and hunting queries.

    Live · docs

  • Wazuh

    Ownership, co-hosting and sourced threat scores on every external indicator in an alert.

    Live · docs

  • OpenCTI

    A two-way STIX 2.1 connector that adds resolving addresses, co-hosted domains, shared certificates and registrant pivots.

    Live · docs

  • MISP

    Expansion and hover modules for IP, domain, hostname and AS attributes. Ships inside misp-modules.

    Live · docs

  • n8n

    A node for automation workflows.

    Live
AI agents

One endpoint. Any agent.

Connect an MCP client once and the agent walks the graph itself. Every tool is read-only and returns structured rows, so the surface you grant is the whole surface.

  • Claude Code

    One command, with your own key.

  • Cursor and VS Code

    Add an HTTP MCP server with your key.

  • Claude

    Listed in the Claude connectors directory, on web, desktop and mobile.

query

Runs read-only Cypher against the whole graph.

explain_indicator

A coverage-qualified verdict for an IP, hostname, CIDR or ASN.

explain_schema

What an entity is and how it connects.

identify

Attributes who runs a host.

list_workflows

Lists the prepared, multi-step investigations.

run_workflow

Runs one of those investigations.

read_docs

Fetches the whisper.security docs.

Formats

JSON by default, STIX 2.1, MISP, CSV

Delivery

REST, server-sent events, WebSocket, webhooks for watches

Whisper Graph XDR

Deploy through what you already manage.

DEVICE MANAGEMENTIntune · Jamf · KandjiOmnissa · Hexnodesigned profileLAPTOPS AND DESKTOPS/128 identityINSTALLERSone line on Linuxuniversal, any RMMinstallSERVERS/128 identityAGENT FRAMEWORKSone commandSDK for serverless, edgeone commandAI AGENTS/128 identityBROWSER STORESChrome · FirefoxextensionBROWSERSname checkedWHISPERedge and graphidentity · policycontainmenteventsCONSOLEone fleet view
Every deploy path ends at the same edge, graph and console.

Machines and devices

  • Device management

    One signed profile through Microsoft Intune, Jamf, Kandji, Omnissa or Hexnode gives every device its own identity.

  • Linux

    One line installs the identity and, if you want it, the sensor.

  • Windows

    The sensor packaged for Intune.

  • Any RMM

    A universal installer for the tools not named here.

  • Live today

    Intune, Jamf, Kandji, Omnissa, Hexnode, and the universal installer.

AI agents and browsers

Chrome Web StoreFirefox Add-ons

  • Agent frameworks

    One command hands an agent built on a supported framework its identity and routes its traffic.

  • Serverless and edge

    An SDK for runtimes where a binary cannot run.

  • Self-service

    An MCP server an agent can use to manage its own identity.

  • Browsers

    Whisper Guard checks every site you open against the graph. Only the hostname leaves the browser.

  • Partner portal

    Run every client's fleet from one queue. Cases open in ConnectWise, Autotask, HaloPSA or Syncro, and events export as OCSF.

    Live · docs

  • Alerts from Intelligence

    Watches on your fleet deliver by email, webhook or Slack.

If it is not on this list, ask.

One endpoint and Cypher. Most integrations take an afternoon.

Talk to usRead the docs