# Forty alerts. One of them matters.

> The alert arrives with an address and nothing else. Whisper Intelligence writes the owner, the network, every other name on that address and every feed that lists it onto the alert, inside the SIEM you already run.

*Source: https://www.whisper.security/solutions/soc*
*Last updated: 2026-10-04*

---

Threat intel enrichment that shows its working: each verdict lists the feeds that moved it, their weights and their dates.

- [Run your indicator free](https://console.whisper.security/sign-up?redirect_url=https%3A%2F%2Fwww.whisper.security%2Fsolutions%2Fsoc)
- [Book a demo](https://meetings-eu1.hubspot.com/rsaggar)

## Five tabs, one address, and a queue that keeps growing.

|  | Today | With Whisper Intelligence |
| --- | --- | --- |
| Context | WHOIS, reputation, DNS, ASN and certificate lookups in five tabs, joined by hand. | One query returns the owner, network, certificates, co-hosted names and feed listings, joined, on the alert. |
| Verdict | A score with no reasons, or a list that says yes or no. | A score with every feed that moved it, its weight and its dates. |
| The rest of the campaign | The next domain from the same operator turns up next week, unlisted. | Every name on the same address, certificate or registrant, today. |
| Next step | Copy the indicator into the next tool. | Expand it, build the takedown package, or hand it to Graph XDR to block on your fleet. |

## Answers where your analysts already work.

The answer lands on the event your analyst already has open, so there is no new console to watch.

- **[Splunk](https://www.whisper.security/docs/integrations/splunk/overview) (Live · docs)**: A search command that enriches any IP or domain in place, with lookup and investigation dashboards.
- **[Microsoft Sentinel](https://www.whisper.security/docs/integrations/sentinel/overview) (Live · docs)**: Playbooks that post enrichment to incidents, workbooks, analytics rules and hunting queries.
- **[Wazuh](https://www.whisper.security/docs/integrations/wazuh/overview) (Live · docs)**: Ownership, co-hosting and sourced threat scores on every external indicator in an alert.
- **[OpenCTI](https://www.whisper.security/docs/integrations/opencti/overview) (Live · docs)**: A two-way STIX 2.1 connector that adds addresses, co-hosted domains, shared certificates and registrant pivots.
- **[MISP](https://www.whisper.security/docs/integrations/misp/overview) (Live · docs)**: Expansion and hover modules for IP, domain, hostname and AS attributes. Ships inside misp-modules.
- **[MCP, API and CLI](https://www.whisper.security/ai)**: Seven read-only MCP tools for Claude, Cursor or any MCP client, plus the query API and one signed CLI.

[All integrations](https://www.whisper.security/products/integrations)

## One listed host is rarely the only one.

login-verify.example is listed on a feed. Every other hostname that resolves to the same address is worth a look: some turn up listed too, and most come back on no feed.

login-verify.example is listed on a feed and resolves to one address. Other hostnames on that address include one more that is listed, and two that come back on no feed. The names and the address are reserved examples.

An illustrative pattern. The names and the address are reserved for documentation.

- [Read how the pivot works](https://www.whisper.security/resources/blog/one-phishing-domain-is-never-just-one)

## One graph behind every verdict.

- **47.3B** objects in one graph
- **133** intelligence feeds, joined
- **<10ms** anchored queries, server-side

*Measured 2026-10-25*

## A verdict you can check line by line.

The score for one listed domain, as the graph worked it out: two lists, their weights, the curve and the floor that set the result.

The verdict for one listed domain: a phishing feed at weight 1.5 and a blocklist at weight 1.0 combine to 2.50. The curve gives 2.50 times log base 2 of 3, which is 3.96, below the severity floor of 40, so the score is 40: HIGH, listed on two feeds.

A worked example. An age boost of ×1.12 did not change the result: the floor was higher.

- [See Whisper Intelligence](https://www.whisper.security/products/intelligence)

## Four workflows your analysts will reuse.

Each one runs in the console, and from any MCP client.

- **[Enrich an indicator](https://www.whisper.security/products/intelligence/use-cases/dns-email-security/indicator-enrichment)**: Everything worth knowing about one domain or address on a single card: registrant, hosting, country, mail, name servers and network.
- **[Run a full investigation](https://www.whisper.security/products/intelligence/use-cases/threat-investigation/indicator)**: The deep dive when something looks bad: related domains, the real servers behind a CDN and the neighbouring infrastructure, each checked.
- **[Expand a domain into its estate](https://www.whisper.security/products/intelligence/use-cases/infrastructure-supply-chain/infrastructure-mapping)**: The true owner behind privacy WHOIS and CDNs, and everything else they run.
- **[Build a takedown package](https://www.whisper.security/products/intelligence/use-cases/brand-protection/build-takedown-evidence-package)**: The verdict, the owner, the abuse lists and the infrastructure around a domain, ready for a registrar or host.

[All workflows](https://www.whisper.security/products/intelligence/use-cases)

## See which of your machines reached it.

With Whisper Graph XDR, every connection your fleet makes is logged with the owner and network on the other end. Search login-verify.example once to see which machines reached it, then block it at resolution.

![Graph XDR console, Egress: how each identity reaches out, liveness by tier, and active flows with the top destination, the policy decision and the traffic volume.](https://www.whisper.security/media/fV3yy1z7W24w1yJW_products-v3-xdr_egress-2x.png)

- [See Graph XDR](https://www.whisper.security/products/graph-xdr)
- [Rules for your whole fleet](https://www.whisper.security/solutions/security-leaders#rules)

## Investigations you can read.

- **[One phishing domain is never just one](https://www.whisper.security/resources/blog/one-phishing-domain-is-never-just-one)**: How one listed domain leads to the rest of a campaign through shared infrastructure.
- **[World Cup phishing infrastructure](https://www.whisper.security/resources/blog/world-cup-phishing-infrastructure)**: A tournament's look-alike domains, mapped from the first one to the rest.
- **[Prince of Persia](https://www.whisper.security/resources/blog/prince-of-persia-mapping-the-backend-and-a-reserve-of-domains-staged-for-what-comes-next)**: A previously unreported server, and a reserve of domains staged for what comes next.
- **[Why blocklists are always one step behind](https://www.whisper.security/resources/blog/why-blocklists-are-always-one-step-behind)**: Why a list catches a domain after the campaign has moved on.

## What SOC teams ask first.

- **Is this another threat feed or WHOIS lookup?**: No. Feeds and WHOIS records are layers of the graph. Whisper joins them to DNS, hosting, routing and certificates, so one question crosses all of them: every name on this address, who registered them, which network routes them and which feeds list them.
- **[Does it work inside Splunk or Microsoft Sentinel?](https://www.whisper.security/products/integrations)**: Yes. Whisper enriches inside Splunk, Microsoft Sentinel, Wazuh, OpenCTI and MISP, each with its own docs. The answer lands on the event, so there is no new console to watch.
- **[What leaves our SIEM?](https://www.whisper.security/docs/integrations/splunk/deployment-architecture)**: Only the indicators you enrich. Each address or name goes to the Whisper API over HTTPS, and your events stay where they are. In Splunk the calls leave from the search heads only.
- **[Can our AI assistant run the investigation?](https://www.whisper.security/ai#mcp)**: Yes. Connect Claude, Cursor or any MCP client to the Whisper MCP server once. It has seven read-only tools and cites the evidence behind each answer. It takes a free key.
- **Do you touch the things we look up?**: No. All of it is passive. Whisper never sends a packet to the thing you are asking about.
- **How fresh is the data?**: WhisperGraph sorts its data into four classes of freshness: live, regular, periodic snapshot and slow-changing reference. Live data, like routing and threat listings, reaches the graph through the day. Physical infrastructure and threat actors are reference data that changes slowly.

## Bring the indicator that went nowhere.

Run it in the console with a free key, or book a demo and we will walk it through the graph with you.

- [Run your indicator free](https://console.whisper.security/sign-up?redirect_url=https%3A%2F%2Fwww.whisper.security%2Fsolutions%2Fsoc)
- [Book a demo](https://meetings-eu1.hubspot.com/rsaggar)