# Whisper Endpoint A calm Linux EDR whose endpoints carry a routable identity on the internet, because Whisper is also the DNS and the network. It draws process -> DNS name -> peer on the host, scores the destination on an internet-scale graph, and holds the off-host kill-switch, the one control a host-only sensor cannot keep once the host is owned. Whisper Endpoint is an on-host Linux sensor with a difference no host-only EDR has. By default it runs a NETLINK proc-connector exec collector and a fanotify file collector, both pure Go, no GPL, no kernel module; eBPF is an opt-in build. Socket, DNS-attribution and vulnerability-posture collectors ride alongside, and two real detection-content engines, a Sigma evaluator and a YARA-X scanner, run natively on the same stream. What makes it different: it gives every host and every AI agent a routable, publicly-verifiable IPv6 /128 on our own address space (2a04:2a01::/32, announced by AS219419), and it can end a compromised host or agent at the network layer even when the host is fully owned. Measured numbers: roughly 2.6% of one core and 16 MB resident on a live host under the full default engine set (the 250M memory ceiling and 25% CPU quota are kernel-enforced guardrails it never approaches); 2,112 test functions plus 93 fuzz targets in the sensor package; twelve behavioral engines plus 79 bundled Sigma rules, naming 91 on-host ATT&CK techniques; a 7.52B-node / 38.6B-relationship security graph behind every destination verdict. The sensor is optional. The identity is not: any device, a server, a laptop, a printer, an ephemeral AI agent, enrolls a /128 and anyone verifies it keyless, with no agent installed and no API key. The sensor is the power-up you add where you want per-process depth. New here? The Quickstart (/docs/quickstart) starts with the keyless half and takes you from nothing to a verified identity on one page. ## Install it, on Linux, in one command The sensor, the identity and the systemd unit, from one line. It needs your API key, because minting an identity and observing a host both require one: ``` # curl -H "X-API-Key: whisper_live_...redacted" https://get.whisper.online | WHISPER_SENSOR=1 sh whisper: installed ✓ (run: whisper) whisper: bound 2a04:2a01:f804:fd8:4b5b:1a4b:4885:9c9c (a4b5b1a4b48859c9c.td68f56a48850edbd42b1dcd97f680e8d.agents.whisper.online) whisper: sensor service installed + running (whisper-sensor) ``` ``` # systemctl status whisper-sensor whisper-sensor: active (running) ``` Without a key, the same URL installs the CLI alone and observes nothing: `curl -fsSL https://get.whisper.online | sh`. Observing a host is never a side effect of installing a tool, which is why the sensor is behind an explicit flag. Re-running the keyed line is also the repair for a host that got partway: `whisper enroll` is idempotent, so it re-finds the `/128` the host already has instead of minting a second one. Nothing needs removing first. Per-distro detail, every flag and the measured footprint are in Install & verify (/docs/install-verify); the whole Linux story is in The Linux sensor (/docs/linux-sensor). ## The seven layers The whole product is seven planes stacked on one primitive, the routable /128, with a single thread running through all of them: every layer's claim is checkable from a stranger's terminal, keyless. L1 IDENTITY a routable /128 anyone can check: DNSSEC, DANE, RDAP | L2 SENSOR four telemetry streams; forwards first | L3 CALM two schedulers; measured ~2.6% of one core, 16 MB | verify it L4 BRAIN twelve engines + Sigma + YARA-X, observe-first | yourself, L5 GRAPH process -> DNS -> verdict, 7.52B nodes / 38.6B relationships | keyless L6 POLICY firewall, graded egress, geo, per-device, nesting | L7 RESPONSE bounded on-host; off-host revoke at DNS-TTL | - L1 Identity: every host and agent gets a routable /128: DNSSEC-anchored reverse DNS, a DANE-EE key pin, a public RDAP record. Keyless, sensor or no sensor. See /docs/wire-identity. The same identity can also sit under your own domain instead of ours; see /docs/domains. - L2 Sensor: one telemetry stream in four vocabularies (exec, file, conn, dns), forwarded downstream BEFORE any detector looks, so detection can never delay, drop or alter telemetry. See /docs/linux-sensor and /docs/collectors. - L3 Calm: two schedulers, an on-host governor and an advisory fleet planner, keep the measured footprint at roughly 2.6% of one core and 16 MB. See /docs/footprint. - L4 On-host brain: twelve behavioral engines plus real Sigma and YARA-X rule engines, all observe-first, every confidence deliberately below 1.0. See /docs/detections. - L5 Graph: the sensor attributes each port-53 query to a process; the internet-scale graph scores the destination's owner, ASN, prevalence and threat band. See /docs/architecture. - L6 Policy: firewall, graded egress, geography, per-device policy and nested sub-agent identities, all expressed against the /128, enforced off-host. See /docs/fleet. - L7 Response: a bounded, opt-in on-host respond tier, and the off-host kill-switch that survives full host compromise. See /docs/kill-switch. ## The receipt, measured not claimed We drove real Atomic Red Team atomics against the shipped sensor on a throwaway Debian 12 box (kernel 6.1) and measured what it captured. No mockups. - 100% telemetry: 37 of 37 ATT&CK techniques captured across 10 tactics, zero drops. - 32 of 37 signature (86%): the known tool captured by its own name (nmap really scanned, gpg really encrypted, the /etc/ld.so.preload write captured). The five not named by signature were still captured as telemetry. - 17,092 exec events captured, zero drops, including one scan loop of 10,974. - Scope: the Atomic Red Team Linux universe is 113 techniques / 483 atomics; this curated cross-tactic run exercised 37 techniques in 10 tactics. Verbatim captured events: ``` [T1003.008 read /etc/shadow] {"comm":"cat","filename":"/usr/bin/cat","pid":1658,"ppid":1656,"uid":0} [T1489 service stop] {"comm":"systemctl","filename":"/usr/bin/systemctl","pid":1718,"uid":0} [T1053.003 cron persistence] {"comm":"crontab","filename":"/usr/bin/crontab","pid":1732,"uid":0} [T1547.006 kernel module] {"comm":"insmod","filename":"/usr/bin/kmod","pid":1875,"uid":0} [T1027 obfuscation] {"comm":"base64","filename":"/usr/bin/base64","pid":1986,"uid":0} [T1071.001 C2 user-agent] {"comm":"curl","filename":"/usr/bin/curl","pid":2018,"uid":0} [T1485 data destruction] {"comm":"dd","filename":"/usr/bin/dd","pid":7462,"uid":0} [T1105 ingress transfer] {"comm":"rsync","filename":"/usr/bin/rsync","pid":7495,"uid":0} [T1574.006 ld.so.preload] {"kind":"file","event":"create","path":"/etc/ld.so.preload","critical":true} ``` The full matrix, per tactic, is in ATT&CK coverage (/docs/attack-coverage). ## Telemetry is not detection, and we say so - Telemetry (visibility): the sensor sees the technique and names its signature process. Measured 100% across the run. Exactly what MITRE Evaluations report first. - Detection (an analytic verdict that alerts): it runs on live telemetry and is narrower than the visibility number by design. The analytic layer live today is a named set of engines. Twelve behavioral engines: ransomware behavior (T1486/T1490, an eight-heuristic correlator with canary tripwires and an entropy gate that EXONERATES plain content), process injection (four memory shapes, no disassembler), the write-then-exec-then-connect event-chain correlator (T1105), a critical-config integrity watch on the classic persistence paths, known-good / known-bad hash verdicts with a per-process trust tier (a bundled allowlist of 3,075 OS-binary hashes clears the calm majority), and internet-scale graph reputation on destinations and hashes. Beside them run two real detection-content engines: a Sigma evaluator (the upstream SigmaHQ engine, 79 bundled rules across all four streams, netcat reverse shells, ngrok tunnels, crypto-mining pools, cron persistence among them) and a YARA-X scanner (VirusTotal's engine, four rule files in the tree including the Kobalos APT and Plague backdoor signatures, zero of them in the default build, file and flagged-memory scanning). Both carry author and license attribution onto every finding, both take operator-supplied rules, and each finding's ATT&CK technique is read from the rule's own metadata, never invented. Architecturally, none of this can slow the stream: the hot path always forwards telemetry downstream before any detector looks. Ransomware detection is live and observe-first: it can freeze the offending process tree reversibly but holds rather than blocks by default, and copy-on-write rollback is on the roadmap. We never claim a detection or a block we cannot demonstrate. Enforcement is opt-in and observe-first, so the console reads held, never contained, until an operator arms it. The ransomware verdict is live today and the Windows deep tier is live, proven on Windows Server 2022; still ahead, named plainly: copy-on-write rollback, the ETW-TI tier (built but dark, gated on Microsoft's anti-malware attestation), and a public MITRE Evaluation in 2027. ## Because we serve the DNS: the three graphs Every EDR sees processes, files and sockets. This sensor draws one edge nobody else can draw cheaply: process -> the DNS name it looked up, attributed to the exact PID from a passive port-53 tap, no resolver hook, no eBPF required. That edge is the seam between three graphs: - The on-host EDR graph. Processes, files, sockets and domains folded into a bounded per-host graph: who spawned whom, who wrote what, who resolved and dialed where. Node-local, fail-open, its blind spots declared (DoT and DoH bypass port 53 and are simply not observed; the tap never claims what it cannot see). - The internet graph. The whisper.security graph, 7.52B nodes / 38.6B relationships, has already scored the destination's owner, ASN, prevalence and threat band, because Whisper is also the resolver that served the name. A host-only sensor sees an IP; this sees who owns it, across the whole internet. - The join. Both graphs key on the same canonical host string, so the internet verdict pins verbatim onto the on-host edge, and a resolve and a connect fuse even across DIFFERENT processes on a shared flow key. The join is absolutely fail-open: the local answer always returns; the internet graph is an overlay, never a dependency. The full pipeline is in /docs/architecture; the engines are in /docs/detections. ## Calm is engineered, twice Scheduling is the key to any telemetry system, and Whisper runs two schedulers. On the host, an autonomous governor: the hot path never rides it, deferrable work waits for a measured-calm host on nice-19, idle-IO workers, bursts up to tenfold only when host, network and user are all quiet, and every task carries a deadline floor so a busy box cannot starve a scan. Off the host, an advisory fleet planner shapes per-/128 vigilance from graph history; it can only dampen, confirm or defer, never touch the hot path, and the host is fully calm with the backend gone. The posture itself is a personality: ten named presets on an aggression-by-loudness plane, projected deterministically onto 18 levers, with a safety floor no preset, quiz or drag can cross. Measured live today on a working host: 2.61% of one core and 16 MB resident, settled after startup. The 25% cgroup quota is the ceiling we promise never to need; measured usage stays an order of magnitude under it. See /docs/footprint. ## Policy is expressed against the address Governance never depends on software running on the governed machine. Every shape is keyed by the agent's /128 and enforced in our resolver and egress plane, off-host, through one control verb: - Per-agent egress firewall: an ordered allow/deny rule-set (host, CIDR, IP, port) consulted on every CONNECT in the egress plane. A compromised agent cannot disable its own firewall; every write lands in the containment audit trail. - Graded egress: each process is bucketed into a trust tier from known-bad to verified, and the tier maps to an egress freedom ladder (none to unrestricted): a known-bad process on an endpoint drops that endpoint's egress to DNS-only, decided in the network. Byte caps, budgets and a per-run scoped allowlist ride the same plane. - Geography: country allow/deny bundles evaluated live per resolution against the graph, deny wins. Jurisdiction-TAGGED addressing (the /128 allocated inside a country-tagged block, published in RDAP and a geofeed) is opt-in and DISABLED by default. - Per-device policy: the same policy verb takes an optional device selector, so one call governs a whole fleet or one routable identity; a device override only ever escalates, never downgrades a graph-critical block. - Nesting: a parent agent's sub-agents each get their own governed /128; the fleet topology records the measured transit tree, an ancestor's deny binds every descendant, and revoking or kill-switching the parent cuts the whole subtree on its next connect. Cut the parent, cut the branch. Where a policy lever is stored but not yet enforced, the API says so on read-back (enforcement=stored), and these docs carry the same label. Details in /docs/fleet and /docs/kill-switch. ## And yes, it is a real EDR The same surfaces a security team already operates, Overview, Incidents, Host, Exposure, Hunt, an ATT&CK matrix and a drawn containment rail, built around the identity moat rather than as a Falcon clone. Every screen is a live capture reading real wire data on our lab fleet. Nothing is a mockup. See /shots/console-host.png: the Host page for web-edge-01, its routable /128, an Identity verified panel reading 4 checks passed keyless, and a live who-resolved feed. ## What a host-only EDR cannot do - The kill-switch that survives compromise. One call revokes a compromised host or agent; its resolution and egress stop worldwide at DNS-TTL. The lever lives on our infrastructure, not on the host, so it works even when the host is fully owned. There is also a complementary on-host respond tier (opt-in, observe-first, reversible). - The verdict that rides the name. A host-only sensor ends at an IP address. Because Whisper serves the DNS, the process-to-name edge exists on the host and the name's whole neighbourhood, owner, ASN, prevalence, reputation, exists in the graph, joined on one key. A standalone EDR would have to become a resolver and build a 7.52B-node graph to copy it. - Coverage of the uncoverable. A PLC, a camera, a partner laptop, or an ephemeral AI agent will never run a kernel sensor. Each still gets a verifiable /128 and can be contained from the network, with no agent installed. ## The guides - /docs/quickstart Quickstart - keyless verify first, then the sensor - /docs/install-verify Install & verify - one command, then dig -x - /docs/architecture How the sensor works - the end-to-end pipeline - /docs/linux-sensor The Linux sensor - every capability and knob - /docs/collectors Telemetry collectors - every shipped collector and its build - /docs/detections Detection engines - twelve engines + Sigma + YARA-X, each labelled live, observe or roadmap - /docs/attack-coverage The 15-tactic matrix and the verified-live column - /docs/kill-switch Containment - on-host respond plus the off-host kill-switch - /docs/wire-identity The /128 identity - reverse DNS, DANE, RDAP, the tiers - /docs/domains DNS and your domain - the same identity under your own apex - /docs/footprint Calm - measured ~2.6% of one core, two schedulers, ten personas - /docs/fleet Fleet, logs & console - policy, firewall, nesting, the operator surface - /docs/platforms Platform support - one matrix: live, gated and roadmap - /docs/evidence Compliance evidence - the tamper-evident ledger and mapping