Release History
Every released version of the Whisper solution for Microsoft Sentinel and what shipped in it, taken from the release notes Microsoft's own UI renders.
On this page (8)
Release History Documentation
This page is the solution's own release notes — the file the Content Hub renders on the listing — reformatted for reading. It is not a summary and nothing is added to it here.
3.0.0 — 13 July 2026
Initial solution release. Published to the Content Hub on 2026-07-14.
What shipped
| Content | Detail | Version |
|---|---|---|
| Data connector | Whisper Security custom-API connector for the Whisper graph API | 1.0.0 |
| Custom tables | WhisperThreatIntel_CL, WhisperInfraContext_CL, WhisperHistory_CL, WhisperASNReputation_CL, with their data collection endpoints and rules | 1.0.0 |
| Ingestion pipelines | Five scheduled Logic Apps that enrich indicators and watchlists into the custom tables | 1.0.0 |
| Playbooks | Ten on-demand enrichment playbooks: ExplainIP, ExplainDomain, ExplainASN, ExplainNetwork, BatchEnrich, CheckAsnReputation, DiscoverCoHosted, GetInfraChain, GetBgpHistory, GetWhoisHistory | 1.0.0 |
| Analytics rules | Eight scheduled detections covering C2 communication, Tor exit-node traffic, newly registered domains on threat ASNs, co-hosted malware clusters, ASN reputation degradation, BGP route anomalies, registrar change anomalies, and unauthorized SPF includes | 1.0.0 |
| Hunting queries | Six queries for attack-surface discovery, newly registered domain hunting, shared-infrastructure clustering, pivot analysis, domain-to-ASN migration, and BGP anomalies | 1.0.0 |
| Workbooks | Five workbooks: External Attack Surface Overview, Infrastructure Threat Landscape, ASN Reputation Monitoring, Domain Registration Anomaly, Incident Enrichment Audit | 1.0.0 |
Shipping a detection and a detection producing results are different facts. Which of the eight rules and six hunts can return a non-zero result on a default install, and what each one needs before it can, is stated per rule on Workbooks & Detections.
Deployment reliability
Nested Microsoft.Resources/deployments are pinned to API version 2025-04-01: the 2025-07-01 the V3 packaging tool emits is rejected by ARM at deploy time, and older versions fail ARM-TTK's recency rule. createUiDefinition's outputs.location uses the standard [location()], which ARM-TTK's "Location Should Be In Outputs" requires and the marketplace wizard populates from the Basics blade. Versioned Key Vault secret URIs (.../secrets/<name>/<32-hex-version>) are accepted.
Observability
diagnosticSettings (WorkflowRuntime and AllMetrics) are auto-provisioned on all ten playbooks and five pipelines and routed to the workspace, so the Incident Enrichment Audit workbook populates without manual setup. The workbook gained a prerequisite banner explaining the first-run latency until AzureDiagnostics receives Logic App records.
Workbook fixes
AsnReputationMonitoring's Top Degraded ASNs query was rewritten with tuple destructuring of arg_min / arg_max. All five workbooks are registered in WorkbooksMetadata.json, which V3 packaging requires for inclusion. IncidentEnrichmentAudit now wraps every AzureDiagnostics column in column_ifexists() so its panels parse before the schema is populated.
Certification hardening
The ARM-TTK sanitizer wraps contentProductId alongside the other id fields to satisfy "IDs Should Be Derived From ResourceIDs". The keyVaultSecretUri parameter is standardized to securestring. workspaceResourceId was added as a top-level template output so ARM-TTK's "Variables Must Be Referenced" rule sees it.
Release pipeline
release.yml sparse-checks-out Azure/Azure-Sentinel@master, runs createSolutionV3.ps1 -VersionMode catalog, then the post-processor, then the sanitizer, then the version stamp. That order is load-bearing. Frozen role_seed values in the pipeline table preserve the guid()-derived role-assignment names across upgrades.
Certification feedback fixes — 13 July 2026
The logo SVG's gradient was converted from a CSS <style> class to inline fill attributes, because the Azure portal sanitizer strips <style> blocks and that broke rendering. The publisher ID was aligned with Partner Center as whisper-security.azure-sentinel-solution-whisper, and support links were updated to https://whisper.security/contact.