SOC and threat intel
Forty alerts.
One of them matters.
The alert arrives with an address and nothing else. Whisper Intelligence writes the owner, the network, every other name on that address and every feed that lists it onto the alert, inside the SIEM you already run.
Threat intel enrichment that shows its working: each verdict lists the feeds that moved it, their weights and their dates.
Five tabs, one address, and a queue that keeps growing.
| Today | With Whisper Intelligence |
|---|---|
| Context | |
| WHOIS, reputation, DNS, ASN and certificate lookups in five tabs, joined by hand. | One query returns the owner, network, certificates, co-hosted names and feed listings, joined, on the alert. |
| Verdict | |
| A score with no reasons, or a list that says yes or no. | A score with every feed that moved it, its weight and its dates. |
| The rest of the campaign | |
| The next domain from the same operator turns up next week, unlisted. | Every name on the same address, certificate or registrant, today. |
| Next step | |
| Copy the indicator into the next tool. | Expand it, build the takedown package, or hand it to Graph XDR to block on your fleet. |
Answers where your analysts already work.
The answer lands on the event your analyst already has open, so there is no new console to watch.
Splunk
A search command that enriches any IP or domain in place, with lookup and investigation dashboards.
Live · docsMicrosoft Sentinel
Playbooks that post enrichment to incidents, workbooks, analytics rules and hunting queries.
Live · docsWazuh
Ownership, co-hosting and sourced threat scores on every external indicator in an alert.
Live · docsOpenCTI
A two-way STIX 2.1 connector that adds addresses, co-hosted domains, shared certificates and registrant pivots.
Live · docsMISP
Expansion and hover modules for IP, domain, hostname and AS attributes. Ships inside misp-modules.
Live · docsMCP, API and CLI
Seven read-only MCP tools for Claude, Cursor or any MCP client, plus the query API and one signed CLI.
One listed host is rarely the only one.
login-verify.example is listed on a feed. Every other hostname that resolves to the same address is worth a look: some turn up listed too, and most come back on no feed.
One graph behind every verdict.
Measured
A verdict you can check line by line.
The score for one listed domain, as the graph worked it out: two lists, their weights, the curve and the floor that set the result.
Four workflows your analysts will reuse.
Each one runs in the console, and from any MCP client.
Enrich an indicator
Everything worth knowing about one domain or address on a single card: registrant, hosting, country, mail, name servers and network.
Run a full investigation
The deep dive when something looks bad: related domains, the real servers behind a CDN and the neighbouring infrastructure, each checked.
Expand a domain into its estate
The true owner behind privacy WHOIS and CDNs, and everything else they run.
Build a takedown package
The verdict, the owner, the abuse lists and the infrastructure around a domain, ready for a registrar or host.
See which of your machines reached it.
With Whisper Graph XDR, every connection your fleet makes is logged with the owner and network on the other end. Search login-verify.example once to see which machines reached it, then block it at resolution.
Investigations you can read.
One phishing domain is never just one
How one listed domain leads to the rest of a campaign through shared infrastructure.
World Cup phishing infrastructure
A tournament's look-alike domains, mapped from the first one to the rest.
Prince of Persia
A previously unreported server, and a reserve of domains staged for what comes next.
Why blocklists are always one step behind
Why a list catches a domain after the campaign has moved on.
What SOC teams ask first.
Bring the indicator that went nowhere.
Run it in the console with a free key, or book a demo and we will walk it through the graph with you.