# Whisper, inside the tools you already run.

> Intelligence answers inside your SIEM, your threat-intel platform and your AI agents. Graph XDR installs through the device management you already use, and gives agents on any framework an identity.

*Source: https://www.whisper.security/products/integrations*
*Last updated: 2026-09-28*

---

- [For Intelligence](#i-intel)
- [For Graph XDR](#i-xdr)

## Enrichment where the alert already is.

A SIEM alert carries an indicator to the Whisper connector in Splunk, Sentinel, Wazuh, OpenCTI or MISP. One query to the graph returns the owner, network, co-hosted names, feeds with their weights and a verdict, written back onto the same alert.

Enrichment lands on the alert your analyst already has open.

- **[Splunk](https://www.whisper.security/docs/integrations/splunk/overview) (Live · docs)**: A search command that enriches any IP or domain in place, with lookup and investigation dashboards and Enterprise Security support. Nothing leaves your indexers.
- **[Microsoft Sentinel](https://www.whisper.security/docs/integrations/sentinel/overview) (Live · docs)**: Playbooks that post enrichment to incidents, scheduled pipelines, workbooks, analytics rules and hunting queries.
- **[Wazuh](https://www.whisper.security/docs/integrations/wazuh/overview) (Live · docs)**: Ownership, co-hosting and sourced threat scores on every external indicator in an alert.
- **[OpenCTI](https://www.whisper.security/docs/integrations/opencti/overview) (Live · docs)**: A two-way STIX 2.1 connector that adds resolving addresses, co-hosted domains, shared certificates and registrant pivots.
- **[MISP](https://www.whisper.security/docs/integrations/misp/overview) (Live · docs)**: Expansion and hover modules for IP, domain, hostname and AS attributes. Ships inside misp-modules.
- **n8n (Live)**: A node for automation workflows.

## One endpoint. Any agent.

Connect an MCP client once and the agent walks the graph itself. Every tool is read-only and returns structured rows, so the surface you grant is the whole surface.

- **Claude Code**: One command, with your own key.
- **Cursor and VS Code**: Add an HTTP MCP server with your key.
- **Claude**: Listed in the Claude connectors directory, on web, desktop and mobile.

- **query**: Runs read-only Cypher against the whole graph.
- **explain_indicator**: A coverage-qualified verdict for an IP, hostname, CIDR or ASN.
- **explain_schema**: What an entity is and how it connects.
- **identify**: Attributes who runs a host.
- **list_workflows**: Lists the prepared, multi-step investigations.
- **run_workflow**: Runs one of those investigations.
- **read_docs**: Fetches the whisper.security docs.

- **Formats**: JSON by default, STIX 2.1, MISP, CSV
- **Delivery**: REST, server-sent events, WebSocket, webhooks for watches

## Deploy through what you already manage.

Four ways onto Graph XDR. Device management tools Intune, Jamf, Kandji, Omnissa and Hexnode push a signed profile to laptops and desktops. Installers cover Linux servers and any RMM. Agent frameworks take one command or an SDK. Whisper Guard installs from the Chrome and Firefox stores and checks each site name. All of it reports to one console.

Every deploy path ends at the same edge, graph and console.

## Machines and devices

- **Device management**: One signed profile through Microsoft Intune, Jamf, Kandji, Omnissa or Hexnode gives every device its own identity.
- **Linux**: One line installs the identity and, if you want it, the sensor.
- **Windows**: The sensor packaged for Intune.
- **Any RMM**: A universal installer for the tools not named here.
- **Live today**: Intune, Jamf, Kandji, Omnissa, Hexnode, and the universal installer.

## AI agents and browsers

- **Agent frameworks**: One command hands an agent built on a supported framework its identity and routes its traffic.
- **Serverless and edge**: An SDK for runtimes where a binary cannot run.
- **Self-service**: An MCP server an agent can use to manage its own identity.
- **Browsers**: Whisper Guard checks every site you open against the graph. Only the hostname leaves the browser.

- [Chrome Web Store](https://chromewebstore.google.com/detail/whisper-guard/ipiabkcdkhokcanmnfihfhgbjaofpakn)
- [Firefox Add-ons](https://addons.mozilla.org/en-US/firefox/addon/whisper-guard/)

- **[Partner portal](https://www.whisper.security/docs/partners) (Live · docs)**: Run every client's fleet from one queue. Cases open in ConnectWise, Autotask, HaloPSA or Syncro, and events export as OCSF.
- **Alerts from Intelligence**: Watches on your fleet deliver by email, webhook or Slack.

## If it is not on this list, ask.

One endpoint and Cypher. Most integrations take an afternoon.

- [Talk to us](https://meetings-eu1.hubspot.com/rsaggar)
- [Read the docs](https://www.whisper.security/docs)