The whole product is one fact: your endpoints have a routable identity on the internet.
Because Whisper is also the DNS and the network, seven layers fall out of that one fact. Below, each one, with the drawn mechanism and the keyless check. Start with the identity, which needs no agent and no API key; add the calm sensor only when you want per-process detection.
$ curl -fsSL https://get.whisper.online | shcurl -fsSL https://get.whisper.online | sh
L1identity · the anchor
The address is the identity.
Every host and agent gets a routable, publicly-verifiable IPv6 /128: DNSSEC to DANE to RDAP to did:web, all checkable by a stranger with stock tools. The sensor is optional; the identity is the primitive both tiers share.
Two tiers, one primitive: the left half needs no agent and no API key, so a PLC, a printer or an ephemeral AI agent gets a verifiable identity with nothing installed; the calm sensor is the optional power-up that adds per-process detection at about 1% of one core and 11 MB.
L2sensor · the eyes
One telemetry stream. Detection never touches it.
Four kernel taps, exec over the NETLINK process connector, file over fanotify, conn over sock-diag with an eBPF opt-in, and dns over an AF_PACKET tap on udp/53, feed one stream that always forwards downstream before any detector looks. 1,752 test functions and 93 fuzz targets hold that line.
The hot path forwards telemetry downstream before any detector looks; each engine folds its judgement from a side copy and findings ride back as a fifth detection kind, so detection can never delay, drop or alter telemetry (1,752 test functions and 93 fuzz targets hold that line).
L3calm · the composure
Two schedulers, and you never feel either.
The on-host governor bursts to 10x only when host, network and user are all provably idle and yields the instant any wakes; the fleet planner adds one advisory hint per /128 that can never touch the hot path. Measured at 1.01% of one core and 11 MB; the 25% quota is the distant ceiling we promise never to need.
Two schedulers, one host in charge: the on-host governor is authoritative and fail-open, bursting to ×10 workers only when host, network and user are all provably quiet and collapsing to ×1 otherwise, while the fleet planner computes one advisory hint per /128 that can dampen or confirm but never touch the hot path or the ceiling; strike the whole fleet column and the host is still calm.
Live capture from srv-fin-01: cpu 1.01% of the 25% quota · mem 11 MB of the 150 MB soft ceiling (250 MB hard) · within SLA; the quota is the ceiling we promise never to need.
L4on-host brain · the local verdict
A real detection brain on the box, observe-only.
Six engines fold judgements from the side of the stream, including two industry-standard content engines: a real YARA-X byte-signature scanner and a real SigmaHQ evaluator across all four streams. Every finding carries its rule, author and an ATT&CK technique read from the rule's own tag. Telemetry observes 37/37 matrix techniques, but telemetry is not detection: bundled signature coverage stands at 32/37 (86%).
rule APT_MAL_LNX_Kobalos {
meta:
description = "Kobalos malware"
author = "Marc-Etienne M.Leveille"
license = "BSD 2-Clause"strings:
$password_md5_digest = { 3ADD48192654BD558A4A4CED9C255C4C }
$strings_rc4_key = { AE0E05090F3AC2B50B1BC6E91D2FE3CE }
… 2 of 4 strings showncondition:
uint16(0) == 0x457f and any of them
}
YARA-X VirusTotal engine · BSD-3 · in-process
Byte-signature scans of settled unknown executables (dedup by content hash) and the memory regions the injection scanner flags. Full-file scans run as heavy calm tasks with a 60 s starvation floor; known-good OS-package binaries skip the deep scan.
The SigmaHQ rule format over the whole telemetry surface: exec → process_creation, file → file_event, conn → network_connection, dns → dns_query. Pure in-memory matching on the hot path, capped at 512 rules; the technique rides each rule’s own attack tag.
confidence is the rule author’s own level, from critical down to low.
bundled rules · 8, all SigmaHQstream · technique
Linux Shell Pipe to Shellexec · T1140
Process Execution From Shared Memory Directoryexec · T1027.011
Potentially Suspicious Execution From Tmp Folderexec · T1036
Communication To Ngrok Tunneling Serviceconn · T1567 +4
Linux Crypto Mining Pool Connectionsconn · T1496
New Cron File Createdfile · T1053.003
DNS Query to External Service Interaction Domainsdns · T1190
plus the featured netcat reverse shell (exec · T1059). Attribution and license ride every finding, per DRL 1.1.
bring your own rules · drop .yar / .yml into .whisper/yara + .whisper/sigmaTwo industry-standard detection-content engines run natively inside the sensor, observe-only, across file, memory and all four event streams. Every finding carries the rule name, its author and license, and an ATT&CK technique read from the rule’s own tag, never invented. 79 Sigma rules bundled, and the YARA engine behind a build-time opt-in that ships zero rules by default; operators extend both by dropping .yar / .yml files into .whisper/.
initial access1
T1190
Exploit Public-Facing Application
sigma · dns
ext-service interaction domains · + T1595.002 on the tag
execution2
T1059
Command & Scripting Interpreter
sigma · exec
netcat reverse shell · level high
T1204.002
User Execution: Malicious File
yara
EICAR self-test rule
persistence4
T1053.003
Scheduled Task: Cron
sigma + config-watch
new cron file · /etc/cron.* writes
T1543.002
Systemd Service
config-watch
systemd/system · init.d · rc.local
T1574.006
Dynamic Linker Hijacking
config-watch
ld.so.preload · caught at creation
T1098.004
SSH-config tamper
config-watch
sshd_config watch · adjacent coverage
priv-esc1
T1548.003
Sudo & Sudo Caching
config-watch
sudoers · sudoers.d
defense evasion5
T1055
Process Injection
injection
rwx_anon · hollow · + T1055.012 · each fires alone once screened
T1620
Reflective Code Loading
injection
memfd exe · no disassembler, the map is the tell
T1140
Deobfuscate / Decode
sigma · exec
shell pipe to shell
T1027.011
Fileless Storage
sigma · exec
exec from /dev/shm · level high
T1036
Masquerading
sigma · exec
execution from tmp
c2 · exfil2
T1105
Ingress Tool Transfer
event-chain
write → exec → connect · bounded confidence, never 1.0
T1567
Exfil Over Web Service
sigma · conn
ngrok tunnel · + T1568.002 T1572 T1090 T1102
impact3
T1486 live
Data Encrypted for Impact
ransomware · 8-signal fusion
mass-encrypt burst convicted, 0 FP · 78 tests
T1490
Inhibit System Recovery
ransomware
argv-classified destroys · fire on their own
T1496
Resource Hijacking
sigma · conn
crypto-mining pool connections
verified-live · fired on a real burst in a live end-to-end run bundled detection content · exercised by 1,752 test functions + 93 fuzz targets telemetry-only techniques are not drawn here: telemetry is not detection
A slice of what the 12 engines + 79 Sigma rules can put on the wire: 18 techniques across seven tactic groups, drawn with the ids findings actually carry, out of the 103 a shipped rule or engine names. On the live fleet matrix telemetry observes 37/37 techniques while signature coverage stands at 32/37 (86%); the self-test and adjacent cells say so on their face; YARA cells ride the opt-in -tags yara build; and a rule with no ATT&CK tag ships technique:unmapped, never an invented id.
mass-encrypt burstfired · T1486encrypt to .locked, then unlink · high_entropy + mass_write + mass_delete
encrypted-vault create burstsilentcreates only, no destruction: content never convicts on its own
compile-and-delete build burstsilentshape alone would flag; plain content exonerates: plain samples read as exactly what they are
One process’s ten-second window, fused. In a live end-to-end run on a real host the paced mass-encrypt burst fired and a canary rename fired alone, while the vault and compile bursts stayed silent: the collector saw all four bursts (121/100/150/180 file events) and convicted only the two attacks. 0 false positives, 78 tests on this engine alone; entropy is the only disk I/O and stays on a tightly capped budget host-wide. Observe-only: it emits a detection, never blocks.
L5the graph · the moat
Because we serve the name, we score the destination.
The port-53 tap pins the query to a PID, then the internet-scale whisper.security graph, 7.52B nodes and 38.6B relationships, has already scored the destination's owner, ASN, prevalence and reputation band. Every verdict is a re-runnable Cypher with a provenance receipt, overlaid verbatim and fail-open.
Three graphs, one key: the sensor folds process → name → peer into a bounded per-host graph, the whisper.security graph scores the same name across 7.52B nodes and 38.6B relationships, and they join on the byte-identical canonical name, overlaid verbatim and fail-open, so the local answer never waits on the global one.Because Whisper serves the name, the port-53 tap pins the query to a PID, the resolver's verdict rides the answer back to the same /128, and one flow key, srcPort 51244, fuses the resolve to the connect across two processes: temporal 100 + severity 90 = 190 of 200.
L6policy · the control
Govern the /128, off the host.
Firewall, graded egress across five trust tiers, geography (opt-in and disabled by default), per-device policy, and nesting: a parent spawns sub-agents each with its own governed /128, and one kill cuts the measured subtree at its next CONNECT.
measured transit · enforceddeclared · display-onlydepth capped at 32 · fails closed past itfan-out reported to 256 · surplus counteda deny at any layer wins
Cut the parent, cut the branch: one kill flip on ::a denies every descendant on the measured transit chain at its next CONNECT (depth-bounded, fail-closed, and a declared-but-never-transiting edge counts for nothing), while a hard op:revoke goes further and tears the /128 out of DNS worldwide and drops its RDAP record to a covering allocation naming no agent worldwide.
the mapping is yours, per tenant · a non-monotone mapping warns, then stores · only none and dns-only refuse
One op:policy call maps the five graph-scored trust tiers onto the five egress freedoms, and every CONNECT then folds the endpoint's worst observed process onto the rung it earned: a single suspicious process pulls the whole endpoint down to dns-only, off-host, with nothing on the box to disable.
Firewall
live
A per-identity egress ACL consulted once per CONNECT, in Whisper's egress plane, not on the box: a compromised agent cannot switch off its own firewall.
first match wins · up to 1000 rules per identity · every write lands in the containment audit trail · revoke clears the set, so a recycled /128 inherits nothing
Geo-fenced resolution decided live at the resolver, and a jurisdiction you can read off the address itself.
geo:deny:RU,KP · blocked at resolve · deny wins livegeo:allow:NL,DE,US · allow-list · up to 250 codesjurisdiction-tagged /128 · RDAP + geofeed off by default
address tagging stays disabled until you opt in · a geo lookup never blocks an allocation, fail-open by design
op:policy {bundles:['geo:allow:NL,DE,US']}
Every card is the same one verb, whisper.agents({op, args}), keyed to the agent's /128 and enforced off the host; each lever reads back enforcement=live or enforcement=stored, and a stored lever never wears a live badge.
L7response · the containment
The off-switch that survives a fully owned box.
On-host, a bounded response (kill, quarantine, service-restart, patch) that is opt-in, poll-only, allowlist-only and audited. Off-host, the kill-switch a host agent cannot match: revoke the /128 and it goes to authenticated NXDOMAIN, the RDAP record shows no assignment, the DANE pin is gone, worldwide at DNS-TTL. A host-only agent keeps its off-switch on the machine it has lost.
Kill the agent on the left and the off-switch dies with it. On the right the sensor only observes; the identity and the revoke lever sit on the Whisper network, so op:revoke reaches the box from outside even after it is fully owned.
✓verify it yourself · through all seven
One proof a stranger can walk, keyless.
Identity and control events are written to a signed, independently-witnessed transparency log: DNSSEC to DANE to an RFC 6962 inclusion proof to an OpenTimestamps anchor on Bitcoin. Tamper-evident today, publicly verifiable once a second independent witness joins the quorum.
One chain a stranger can walk keyless: the DNSSEC-signed zone, the DANE pin, an RFC 6962 inclusion proof in a signed checkpoint (tree 181,091, captured 2026-08-25), the log and an independent witness cosigning, and an OpenTimestamps anchor in Bitcoin block 957,330 · tamper-evident today, publicly verifiable once a second independent witness joins the quorum.