# Install Whisper Endpoint - one command, then verify the identity yourself

Installing an EDR should not be a project, and it should not ask you to take the
vendor's word for anything. Whisper Endpoint installs with one line, mints a
routable identity, and hands you the tools to check that identity against the
internet's own root.

## Step 1 - install (one command, zero config)

The bare line installs the CLI and the resolver, and nothing observes your host:

    curl -fsSL https://get.whisper.online | sh

To also install the sensor, add a key and ask for it. Observing a host is an
explicit choice, never a side effect of minting a /128, so the sensor is opt-in:

    curl -H "X-API-Key: $WHISPER_KEY" https://get.whisper.online | WHISPER_SENSOR=1 sh

Prefer to read before you pipe? Fetch the script first:

    curl -fsSL https://get.whisper.online -o whisper.sh

With `WHISPER_SENSOR=1` the installer does three things and then gets out of the
way:

- Installs the calm sensor as `whisper-sensor`, running under a cgroup SLA
  (CPUQuota=25%, MemoryMax=250M), event-driven and fail-open.
- Mints the identity: a routable IPv6 /128 out of 2a04:2a01::/32 (AS219419), with
  DNSSEC-anchored reverse DNS, a DANE-EE key pin, and a public RDAP record.
- Starts shipping signal, mapped to ATT&CK; the off-host kill-switch is available
  from the first minute.

Check it with `systemctl status whisper-sensor`.

## Step 2 - verify it yourself, keyless (no account)

Do not trust us. Check the identity against the IANA root with tools you already
have; our API is never in the trust path.

    # reverse DNS names the address, anchored at the IANA root
    $ dig -x 2a04:2a01:e32a:155f:26cc:967b:8c5b:70a1 +short
    a26cc967b8c5b70a1.t0f1c527d1cada8c6e8dfc46c74e013e5.agents.whisper.online.

    # the whole chain validates to the IANA root, our service is nowhere in it
    $ delv -x 2a04:2a01:e32a:155f:26cc:967b:8c5b:70a1
    ; fully validated

    # the key is pinned in DANE (TLSA 3 1 1 = DANE-EE, SPKI, SHA-256), no public CA
    $ dig +dnssec TLSA _443._tcp.a26cc967b8c5b70a1.t0f1c527d1cada8c6e8dfc46c74e013e5.agents.whisper.online

A "; fully validated" line means every link was checked cryptographically and
Whisper's API is nowhere in the trust decision.

## What you get, from the first minute

- A verifiable /128 identity the internet can check with dig -x.
- Telemetry mapped to ATT&CK: measured 100% telemetry across the live run, 37 of 37
  techniques, 17,092 exec events, zero drops.
- The off-host kill-switch, ready: one call cuts resolution and egress worldwide at
  DNS-TTL, even if the host is later fully owned.

## Platform support, stated honestly

- Linux, live today: the deep sensor tier ships on Debian, Ubuntu, and the RHEL
  family (RHEL, Rocky, Alma). Every ATT&CK number on this site was measured on Linux
  (Debian 12, kernel 6.1).
- Windows, live today: ETW telemetry (exec, file, connections, DNS, image loads,
  pure Go, no kernel driver) plus the ransomware, dropper-chain and process-injection
  engines run on-host, proven end to end on a real Windows Server 2022 host. The
  ETW-TI tier is built but dark, gated on Microsoft's anti-malware attestation, and
  we do not claim it before it ships.
- macOS, in development: the engines are exercised on Apple-silicon over the bridge datapath (the exec, file and socket collectors are proven on real Apple hardware; the /dev/bpf qname tap needs root and is exercised through a scripted read seam rather than a live device; the engines are exercised in datapath tests rather than fired by a live Endpoint Security feed); the live
  Endpoint Security feed is entitlement-gated, so it is internal and dev-only today.
  Identity, resolution and the off-host kill-switch already cover any host on the
  network, sensor or no sensor.

## Next
- /docs/install-verify     Full install and uninstall steps, per distro
- /how-it-works     The sensor, the graph, the identity, the kill-switch