Whisper Intelligence
Ask who is behind any address.
Get the answer with its evidence.
One query crosses routing, DNS, hosting, ownership, email, certificates and threat intelligence. The verdict comes back with its sources, their weights and the sum. Ask in the console, over the API or MCP, from the CLI, or inside your SIEM.
A feed says yes or no. You need to know what it is connected to.
An alert arrives with an address and nothing else. Five tabs later you have a WHOIS record that names a CDN, a reputation score with no reasons, and no idea what else the same operator runs.
Questions a flat lookup cannot answer.
A verdict that shows its work
The score, every feed that moved it, how much each counted, and when each listing was first and last seen. Ready to paste into the ticket.
The company behind the CDN
Who actually runs a host, past the proxy in front of it, and the origin servers that leak through mail and sibling hosts.
The rest of the operator's estate
From one bad domain to everything the same registrant, certificate, nameserver or network also serves, including what no feed has listed yet.
A takedown package in one row
The verdict, the network behind it, that network’s abuse desk, the listing feeds and the co-hosted names.
Routing exposure, named
Which of your or your vendors’ services sit behind a route that fails RPKI, and why it fails.
Look-alikes that exist
Registered look-alike domains of your brand, and which of them are live and dangerous.
All of it passive. Whisper never sends a packet to the thing you are asking about.
"No data" is not "clean".
Most feeds answer yes or no, so a host nobody has reported reads as safe and brand-new attacker infrastructure sails through. Every Whisper verdict says which of three things it is.
- Known clean
We looked and found nothing adverse. A conclusion you can act on.
- No data
We have nothing on this host yet. Not safe, just new.
- Listed
It appears in threat intelligence, with the feeds and factors behind the verdict.
Every verdict shows its arithmetic.
Take an address that is on a threat list and on a public-resolver roster. The graph counts both, weighs them, and says plainly that a roster is a fact about the node, not a verdict against it.
Guided workflows for the investigations you run most.
Workflows
Run a prepared investigation on any indicator and read the result as a guided report.
Threat investigation and indicator enrichment
Attack-surface mapping and subdomain-takeover detection
Digital infrastructure mapping, up to the vendor border
Supply-chain dependencies and single points of failure
Typosquat scanning and takedown evidence packages
BGP hijack and routing-hygiene audits
However your team already works.
- Console
Explore, investigate, run workflows and write Cypher in the browser. No code needed.
- Query API
Cypher over HTTP from your own service. A keyless tier answers a first query with no sign-up.
- MCP
Connect Claude, Cursor or any MCP client once. The agent writes its own cross-layer queries with seven read-only tools and cites the evidence.
- CLI
One signed binary for queries, named recipes and a local MCP server.
- SIEM and SOAR
Enrichment inside Splunk, Microsoft Sentinel with ready playbooks and workbooks, Wazuh, OpenCTI and MISP, each with its own docs, and automation in n8n.
- Your product
The same graph behind your own product, through one endpoint.
claude mcp add --transport http whisper-graph https://mcp.whisper.security \
--header "Authorization: Bearer YOUR_API_KEY"What it does not do.
Not a block
Intelligence answers. Graph XDR enforces. Use both for a rule that acts on the answer.
Not malware or breach data
No malware samples, no leaked credentials. The graph is about infrastructure.
Not everything live
Most sources update continuously. WHOIS and physical infrastructure refresh on a slower, published cadence.
Bring the indicator your stack got wrong.
A free key, for good. Paid tiers add history and integrations.