Whisper Endpoint

A calm Linux EDR whose endpoints carry a routable identity on the internet, because Whisper is also the DNS and the network. It draws process → DNS name → peer on the host, scores the destination on an internet-scale graph, and holds the off-host kill-switch, the one control a host-only sensor cannot keep once the host is owned.

Whisper Endpoint is an on-host Linux sensor with a difference no host-only EDR has. By default it runs a NETLINK proc-connector exec collector and a fanotify file collector, both pure Go, no GPL, no kernel module; eBPF is an opt-in build. Socket, DNS-attribution and vulnerability-posture collectors ride alongside, and two real detection-content engines, a Sigma evaluator and a YARA-X scanner, run natively on the same stream. What makes it different: it gives every host and every AI agent a routable, publicly-verifiable IPv6 /128 on our own address space (2a04:2a01::/32, announced by AS219419), and it can end a compromised host or agent at the network layer even when the host is fully owned. These pages are the product docs. The full technical library, DNSSEC, RDAP, the control plane, sits one click down the sidebar, shared with whisper.online.

The sensor is optional. The identity is not: any device, a server, a laptop, a printer, an ephemeral AI agent, enrolls a /128 and anyone verifies it keyless, with no agent installed and no API key. The sensor is the power-up you add where you want per-process depth. New here? The Quickstart starts with the keyless half and takes you from nothing to a verified identity on one page.

Install it, on Linux, in one command

The sensor, the identity and the systemd unit, from one line. It needs your API key, because minting an identity and observing a host both require one:

# curl -H "X-API-Key: whisper_live_...redacted" https://get.whisper.online | WHISPER_SENSOR=1 sh
whisper: installed ✓  (run: whisper)
whisper: bound 2a04:2a01:f804:fd8:4b5b:1a4b:4885:9c9c  (a4b5b1a4b48859c9c.td68f56a48850edbd42b1dcd97f680e8d.agents.whisper.online)
whisper: sensor service installed + running (whisper-sensor)

# systemctl status whisper-sensor
whisper-sensor: active (running)

Without a key, the same URL installs the CLI alone and observes nothing: curl -fsSL https://get.whisper.online | sh. Observing a host is never a side effect of installing a tool, which is why the sensor is behind an explicit flag.

Re-running the keyed line is also the repair for a host that got partway: whisper enroll is idempotent, so it re-finds the /128 the host already has instead of minting a second one. Nothing needs removing first. Per-distro detail, every flag and the measured footprint are in Install & verify; the whole Linux story is in The Linux sensor.

The seven layers

The whole product is seven planes stacked on one primitive, the routable /128, with a single thread running through all of them: every layer's claim is checkable from a stranger's terminal, keyless.

• L1 · Identity. Every host and agent gets a routable /128: DNSSEC-anchored reverse DNS, a DANE-EE key pin, a public RDAP record. Keyless, sensor or no sensor. The /128 identity. The same identity can also sit under your own domain instead of ours: DNS & your domain.
• L2 · Sensor. One telemetry stream in four vocabularies (exec, file, conn, dns), forwarded downstream before any detector looks, so detection can never delay, drop or alter telemetry. The Linux sensor and Telemetry collectors.
• L3 · Calm. Two schedulers, an on-host governor and an advisory fleet planner, keep the measured footprint at roughly 2.6% of one core and 16 MB. Calm footprint & SLA.
• L4 · On-host brain. Twelve behavioral engines plus real Sigma and YARA-X rule engines, all observe-first, every confidence deliberately below 1.0. Detection engines.
• L5 · Graph. The sensor attributes each port-53 query to a process; the internet-scale graph scores the destination's owner, ASN, prevalence and threat band. How the sensor works.
• L6 · Policy. Firewall, graded egress, geography, per-device policy and nested sub-agent identities, all expressed against the /128, enforced off-host. Fleet, logs & console.
• L7 · Response. A bounded, opt-in on-host respond tier, and the off-host kill-switch that survives full host compromise. Containment.

The receipt, measured not claimed

We drove real Atomic Red Team atomics against the shipped sensor on a throwaway Debian 12 box (kernel 6.1) and measured what it captured. No mockups.

• 100% telemetry: 37 of 37 ATT&CK techniques captured across 10 tactics, zero drops.
• 32 of 37 signature (86%): the known tool captured by its own name (nmap really scanned, gpg really encrypted, the /etc/ld.so.preload write captured). The five not named by signature were still captured as telemetry.
• 17,092 exec events captured, zero drops, including one scan loop that alone spawned 10,974 processes.
• Scope: the Atomic Red Team Linux universe is 113 techniques / 483 atomics; this curated cross-tactic run exercised 37 techniques in 10 tactics.

The verbatim captured events, our prove-then-document rule in practice:

[T1003.008 read /etc/shadow]  {"comm":"cat","filename":"/usr/bin/cat","pid":1658,"ppid":1656,"uid":0}
[T1489 service stop]          {"comm":"systemctl","filename":"/usr/bin/systemctl","pid":1718,"uid":0}
[T1053.003 cron persistence]  {"comm":"crontab","filename":"/usr/bin/crontab","pid":1732,"uid":0}
[T1547.006 kernel module]     {"comm":"insmod","filename":"/usr/bin/kmod","pid":1875,"uid":0}
[T1027 obfuscation]           {"comm":"base64","filename":"/usr/bin/base64","pid":1986,"uid":0}
[T1071.001 C2 user-agent]     {"comm":"curl","filename":"/usr/bin/curl","pid":2018,"uid":0}
[T1485 data destruction]      {"comm":"dd","filename":"/usr/bin/dd","pid":7462,"uid":0}
[T1105 ingress transfer]      {"comm":"rsync","filename":"/usr/bin/rsync","pid":7495,"uid":0}
# the config-watch collector, on a critical file write:
[T1574.006 ld.so.preload]     {"kind":"file","event":"create","path":"/etc/ld.so.preload","critical":true}

The full matrix, per-tactic, with the graph-only tactics no host-EDR can see, is in ATT&CK coverage.

Telemetry is not detection, and we say so

This is the load-bearing distinction, and being exact about it is why the numbers above are trustworthy.

The analytic layer that is live today is not a marketing word, it is a named set of engines. Twelve behavioral engines: ransomware behavior (T1486/T1490, an eight-heuristic correlator with canary tripwires and an entropy gate that exonerates plain content), process injection (four memory shapes, no disassembler), the write-then-exec-then-connect event-chain correlator (T1105), a critical-config integrity watch on the classic persistence paths, known-good / known-bad hash verdicts with a per-process trust tier (a bundled allowlist of 3,075 OS-binary hashes clears the calm majority so the analyst sees green, not just red), and internet-scale graph reputation on destinations and hashes. Beside them run two real detection-content engines: a Sigma evaluator (the upstream SigmaHQ engine, 79 bundled rules across all four streams, netcat reverse shells, ngrok tunnels, crypto-mining pools, cron persistence among them) and a YARA-X scanner (VirusTotal's engine, 5 bundled rules including the Kobalos APT and Plague backdoor signatures, file and flagged-memory scanning). Both carry author and license attribution onto every finding, both take operator-supplied rules, and each finding's ATT&CK technique is read from the rule's own metadata, never invented. Architecturally, none of this can slow the stream: the hot path always forwards telemetry downstream before any detector looks. Ransomware behavior detection is live and observe-first: it detects a mass-encrypt or snapshot-destruction pattern and can freeze the offending process tree reversibly, but it holds rather than blocks by default, and copy-on-write rollback is on the roadmap.

Because we serve the DNS: the three graphs

Every EDR sees processes, files and sockets. This sensor draws one edge nobody else can draw cheaply: process → the DNS name it looked up, attributed to the exact PID from a passive port-53 tap, no resolver hook, no eBPF required. That edge is the seam between three graphs:

• The on-host EDR graph. Processes, files, sockets and domains folded into a bounded per-host graph: who spawned whom, who wrote what, who resolved and dialed where. Node-local, fail-open, its blind spots declared (DoT and DoH bypass port 53 and are simply not observed; the tap never claims what it cannot see).
• The internet graph. The whisper.security graph, 7.53B nodes / 40.3B relationships, has already scored the destination's owner, ASN, prevalence and threat band, because Whisper is also the resolver that served the name. A host-only sensor sees an IP; this sees who owns it, across the whole internet.
• The join. Both graphs key on the same canonical host string, so the internet verdict pins verbatim onto the on-host edge, and a resolve and a connect fuse even across different processes on a shared flow key. The join is absolutely fail-open: the local answer always returns; the internet graph is an overlay, never a dependency.

The full pipeline, taps to verdict, is in How the sensor works; the engines that consume it are in Detection engines.

Calm is engineered, twice

Scheduling is the key to any telemetry system, and Whisper runs two schedulers. On the host, an autonomous governor: the hot path never rides it, deferrable work waits for a measured-calm host on nice-19, idle-IO workers, bursts up to tenfold only when host, network and user are all quiet, and every task carries a deadline floor so a busy box cannot starve a scan. Off the host, an advisory fleet planner shapes per-/128 vigilance from graph history; it can only dampen, confirm or defer, never touch the hot path, and the host is fully calm with the backend gone. The posture itself is a personality: ten named presets on an aggression-by-loudness plane, projected deterministically onto 18 levers, with a safety floor no preset, quiz or drag can cross. Measured live today on a working host: 2.61% of one core and 16 MB resident, settled after startup. The 25% cgroup quota is the ceiling we promise never to need; measured usage stays an order of magnitude under it. Calm footprint & SLA has the whole system.

Policy is expressed against the address

Governance never depends on software running on the governed machine. Every shape is keyed by the agent's /128 and enforced in our resolver and egress plane, off-host, through one control verb:

• Per-agent egress firewall. An ordered allow/deny rule-set (host, CIDR, IP, port) consulted on every CONNECT in the egress plane. A compromised agent cannot disable its own firewall; every write lands in the containment audit trail.
• Graded egress. Each process is bucketed into a trust tier from known-bad to verified, and the tier maps to an egress freedom ladder (none to unrestricted): a known-bad process on an endpoint drops that endpoint's egress to DNS-only, decided in the network. Byte caps, budgets and a per-run scoped allowlist ride the same plane.
• Geography. Country allow/deny bundles evaluated live per resolution against the graph, deny wins. Jurisdiction-tagged addressing (the /128 allocated inside a country-tagged block, published in RDAP and a geofeed) is opt-in and disabled by default.
• Per-device policy. The same policy verb takes an optional device selector, so one call governs a whole fleet or one routable identity; a device override only ever escalates, never downgrades a graph-critical block.
• Nesting. A parent agent's sub-agents each get their own governed /128; the fleet topology records the measured transit tree, an ancestor's deny binds every descendant, and revoking or kill-switching the parent cuts the whole subtree on its next connect. Cut the parent, cut the branch.

Where a policy lever is stored but not yet enforced, the API says so on read-back (enforcement=stored), and these docs carry the same label. Details in Fleet, logs & console and Containment.

And yes, it is a real EDR

The same surfaces a security team already operates, Overview, Incidents, Host, Exposure, Hunt, an ATT&CK matrix and a drawn containment rail, built around the identity moat rather than as a Falcon clone. Every screen is a live capture reading real wire data on our lab fleet. Nothing is a mockup.

What a host-only EDR cannot do

Three structural gaps, each closed one layer down at the network:

• The kill-switch that survives compromise. One call revokes a compromised host or agent; its resolution and egress stop worldwide at DNS-TTL. The lever lives on our infrastructure, not on the host, so it works even when the host is fully owned and the local agent is dead. There is also a complementary on-host respond tier (opt-in, observe-first, reversible). Both are covered in Containment.
• The verdict that rides the name. A host-only sensor ends at an IP address. Because Whisper serves the DNS, the process-to-name edge exists on the host and the name's whole neighbourhood, owner, ASN, prevalence, reputation, exists in the graph, joined on one key. A standalone EDR would have to become a resolver and build a 7.53B-node graph to copy it.
• Coverage of the uncoverable. A PLC, a camera, a partner laptop, or an ephemeral AI agent will never run a kernel sensor. Each still gets a verifiable /128 and can be contained from the network, with no agent installed.

The guides