# How Whisper Endpoint works - the sensor, the identity, and the off-host kill-switch

Whisper Endpoint is a real EDR built around one idea a host-only sensor
cannot reach: govern who a machine is, and whether the network still answers to it.
Four parts do the work, and each is verifiable. This walkthrough follows the Linux
sensor; Windows deep detection is live too, and /docs/platforms has the full matrix.

## Part 1 - the on-host sensor

The shipped Linux sensor is event-driven; the kernel wakes it when something
happens, so it costs nothing while nothing is happening.

- Process exec collector: a GPL-free NETLINK exec collector captures every process
  the moment it runs, enriched from /proc with the command, path, pid, ppid and uid.
- fanotify file collector: sees writes across the filesystem, so staging, archiving
  and data-destruction show up as they land.
- Critical-config watch: flags writes to the files attackers abuse. A create on
  /etc/ld.so.preload is captured with "critical":true.

Verbatim captured events (real, from the live run):

    [T1003.008 read /etc/shadow]  {"comm":"cat","filename":"/usr/bin/cat","pid":1658,"ppid":1656,"uid":0}
    [T1547.006 kernel module]     {"comm":"insmod","filename":"/usr/bin/kmod","pid":1875,"uid":0}
    [T1574.006 ld.so.preload]     {"kind":"file","event":"create","path":"/etc/ld.so.preload","critical":true}

Measured on a real Debian 12 box (kernel 6.1): 17,092 exec events captured with
zero drops, including one scan loop that alone spawned 10,974 processes.

## Part 2 - the graph brain

The sensor sees the host; the graph sees the internet. We already run the ATT&CK
taxonomy in the graph: 712 techniques across 15 tactics. Reconnaissance (46
techniques) and resource-development (50) are the attacker's own domains, IPs and
certificates. A host-only sensor is structurally blind there; our graph scores that
infrastructure directly. The graph is consulted graph-first, then the sensor fails
open: if the graph is slow or unreachable, resolution and the host keep working.

## Part 3 - the identity

Every host and agent gets a routable IPv6 /128 out of 2a04:2a01::/32, announced by
AS219419, with DNSSEC-anchored reverse DNS, a DANE-EE key pin, and a public RDAP
record. Verify any identity yourself, keyless:

    $ dig -x 2a04:2a01:e32a:155f:26cc:967b:8c5b:70a1 +short
    a26cc967b8c5b70a1.t0f1c527d1cada8c6e8dfc46c74e013e5.agents.whisper.online.

The reverse name resolves against the IANA root, so anyone can confirm the identity
without trusting our API. That property is what makes containment credible: you can
prove which machine you cut off.

## Part 4 - the off-host kill-switch

This is the move no host-only EDR can make. An agent that isolates a host from
inside the host is asking a fully-owned machine to police itself, and the moment the
attacker has root, that request can be refused. Whisper containment lives on our
infrastructure, not on the host: one call revokes a compromised host or agent, its
resolution and its egress stop worldwide at DNS-TTL, and it works even when the host
is fully owned. Calm is the composure of power held in reserve.

## Calm and fail-open

The sensor's limits are a published cgroup SLA, enforced by the kernel:

- CPUQuota=25%: a hard ceiling of a quarter of one core.
- MemoryMax=250M: a hard cap in the unit, the same on every host.
- Event-driven, fail-open: no busy polling; if the sensor is down, the host still
  resolves and runs.

## Next
- /setup                 Install and verify, one command, then dig -x
- /docs/attack-coverage  The full ATT&CK matrix, per tactic
- /docs/kill-switch      The off-host kill-switch, in depth