# Ask who is behind any address. Get the answer with its evidence. > One query crosses routing, DNS, hosting, ownership, email, certificates and threat intelligence. The verdict comes back with its sources, their weights and the sum. Ask in the console, over the API or MCP, from the CLI, or inside your SIEM. *Source: https://www.whisper.security/products/intelligence* *Last updated: 2026-10-04* --- - [Get a free key](https://console.whisper.security/sign-up?redirect_url=https%3A%2F%2Fwww.whisper.security%2Fproducts%2Fintelligence) - [Book a demo](https://meetings-eu1.hubspot.com/rsaggar) ## A feed says yes or no. You need to know what it is connected to. An alert arrives with an address and nothing else. Five tabs later you have a WHOIS record that names a CDN, a reputation score with no reasons, and no idea what else the same operator runs. Left: five separate tools each give a partial answer that you join by hand. Right: one Whisper query on the example address 198.51.100.53 returns the owner Example Resolver Co, the network AS64500 and prefix 198.51.100.0/24, a signed route, the city, two feed listings of which one is a resolver roster, and a verdict of 0.89, informational. The same question, two ways. ## Questions a flat lookup cannot answer. - **A verdict that shows its work**: The score, every feed that moved it, how much each counted, and when each listing was first and last seen. Ready to paste into the ticket. - **The company behind the CDN**: Who actually runs a host, past the proxy in front of it, and the origin servers that leak through mail and sibling hosts. - **The rest of the operator's estate**: From one bad domain to everything the same registrant, certificate, nameserver or network also serves, including what no feed has listed yet. - **A takedown package in one row**: The verdict, the network behind it, that network’s abuse desk, the listing feeds and the co-hosted names. - **Routing exposure, named**: Which of your or your vendors’ services sit behind a route that fails RPKI, and why it fails. - **Look-alikes that exist**: Registered look-alike domains of your brand, and which of them are live and dangerous. All of it passive. Whisper never sends a packet to the thing you are asking about. ## "No data" is not "clean". Most feeds answer yes or no, so a host nobody has reported reads as safe and brand-new attacker infrastructure sails through. Every Whisper verdict says which of three things it is. Three hosts. A yes or no feed calls the first two clean and the third bad. Whisper calls them known clean, no data, and listed with sources. The feed’s clean for the brand-new host is the mistake. Where a yes or no answer hides the risk. - **Known clean**: We looked and found nothing adverse. A conclusion you can act on. - **No data**: We have nothing on this host yet. Not safe, just new. - **Listed**: It appears in threat intelligence, with the feeds and factors behind the verdict. ## Every verdict shows its arithmetic. Take an address that is on a threat list and on a public-resolver roster. The graph counts both, weighs them, and says plainly that a roster is a fact about the node, not a verdict against it. The verdict for the example address 198.51.100.53: two sources, a threat list at weight 1.0 and a public-resolver roster at weight 0.8, combine to 0.80. The base score 0.80 times log base 2 of 3 is 1.27, clamped to 0.80. An age boost of 1.12 gives a final 0.89, informational, and the address is allowlist-vouched. The arithmetic behind one verdict, step by step. ## Guided workflows for the investigations you run most. - **[Workflows](https://www.whisper.security/products/intelligence/use-cases)**: Run a prepared investigation on any indicator and read the result as a guided report. ## However your team already works. Six ways into the same graph: the console in the browser, the query API over HTTPS, the CLI, MCP for AI agents, SIEM and SOAR connectors inside the alert, and your own product. Every way in reaches the same endpoint and returns the same evidence. - **Console**: Explore, investigate, run workflows and write Cypher in the browser. No code needed. - **Query API**: Cypher over HTTP from your own service. A keyless tier answers a first query with no sign-up. - **MCP**: Connect Claude, Cursor or any MCP client once. The agent writes its own cross-layer queries with seven read-only tools and cites the evidence. - **CLI**: One signed binary for queries, named recipes and a local MCP server. - **SIEM and SOAR**: Enrichment inside Splunk, Microsoft Sentinel with ready playbooks and workbooks, Wazuh, OpenCTI and MISP, each with its own docs, and automation in n8n. - **Your product**: The same graph behind your own product, through one endpoint. **Connecting an MCP client** ```bash claude mcp add --transport http whisper-graph https://mcp.whisper.security \ --header "Authorization: Bearer YOUR_API_KEY" ``` - [See all integrations](https://www.whisper.security/products/integrations) - [Embed it in your product](https://www.whisper.security/products/engine/embed) ## What it does not do. - **Not a block**: Intelligence answers. Graph XDR enforces. Use both for a rule that acts on the answer. - **Not malware or breach data**: No malware samples, no leaked credentials. The graph is about infrastructure. - **Not everything live**: Most sources update continuously. WHOIS and physical infrastructure refresh on a slower, published cadence. ## Bring the indicator your stack got wrong. A free key, for good. Paid tiers add history and integrations. - [Get a free key](https://console.whisper.security/sign-up?redirect_url=https%3A%2F%2Fwww.whisper.security%2Fproducts%2Fintelligence) - [Book a demo](https://meetings-eu1.hubspot.com/rsaggar)