Configuration
The one-time post-install steps: playbook permissions, automation rules, analytics rule enablement, and the scheduled-pipeline watchlists.
On this page (4)
Configuration Documentation
The deployment finishes with everything installed, but three one-time steps wire it into your incident workflow, and a fourth tells the scheduled pipelines what to track.
1. Grant Microsoft Sentinel permission to run the playbooks
Automation rules cannot invoke a playbook until Microsoft Sentinel's service principal is allowed to:
- Microsoft Sentinel → Settings → Settings tab → Playbook permissions → Configure permissions.
- Select the resource group you installed into and confirm.
One click — no GUIDs to look up.
2. Create automation rules
The solution intentionally ships no automation rules (they cannot be created before step 1). Wire the ones you want:
- Microsoft Sentinel → Automation → Create → Automation rule.
- Trigger: When incident is created. Add a condition — for example, the analytic rule name — and the action Run playbook with the matching Whisper playbook.
Recommended starting pairings are in Playbooks.
The two incident-triggered ingestion pipelines (Whisper-EnrichmentPipeline, Whisper-InfraChainPipeline — the names the portal shows) are wired the same way. These two pipelines are a precondition, not an option. Five analytics rules and five hunting queries read tables that only they write. Without them those ten content items return zero rows on every run.
One consequence of the wiring is easy to miss and no other page states it: the enrichment pipeline is triggered by an incident, and C2 Communication Detection — which reads what that pipeline writes — is a rule that creates incidents. It can only fire on an indicator that some earlier incident already enriched, so its recall is set by what your other detections happened to raise first, and cannot be judged from the rule alone.
3. Enable analytics rules
Rules install as templates and are off by default:
- Microsoft Sentinel → Content hub → Whisper Security → Manage, or Analytics → Rule templates filtered to Whisper.
- For each rule you want, choose Create rule and review the schedule and thresholds.
C2 Communication Detection, Tor Exit Node Communication, and BGP Route Anomaly with Traffic Spike correlate with CommonSecurityLog — they only fire if you have a data source feeding that table (firewall/CEF logs). The rest run entirely on Whisper tables.
A missing data source is not the only thing that keeps a rule quiet, and the other causes are worth knowing before you judge a silent rule:
| Rule | What keeps it quiet in 3.0.0 |
|---|---|
| C2 Communication Detection · Tor Exit Node Communication | CommonSecurityLog, and WhisperThreatIntel_CL — which only the enrichment pipeline from step 2 writes |
| Co-Hosted Malware Cluster | WhisperInfraContext_CL — which only the infra-chain pipeline from step 2 writes |
| BGP Route Anomaly with Traffic Spike · Domain Registrar Change Anomaly | WhisperHistory_CL, which stays empty until you set the watchlists in step 4 |
| Newly Registered Domain on Threat ASN | domainAge. The infra-chain pipeline composes it as a literal -1 and the rule filters domainAge >= 0, so it cannot fire at all until a release computes a real age |
| SPF Record Unauthorized Include | spfIncludes — a column declared in WhisperInfraContext_CL that nothing in the solution writes. The rule filters isnotempty(spfIncludes), so it cannot fire at all |
| ASN Reputation Degradation | Nothing. It reads WhisperASNReputation_CL, which the hourly poller fills for the ASNs in step 4 |
So on a default install exactly one of the eight can return a row, and it is watching the two ASNs the poller ships with. Workbooks & Detections carries the same reading for the hunting queries.
4. Set the scheduled-pipeline watchlists
The three scheduled pipelines track what you tell them to:
| Setting | Default | Used by |
|---|---|---|
domainWatchlist (comma-separated domains) | empty — no WHOIS history collected until set | Daily WHOIS pipeline |
ipWatchlist (comma-separated IPs/prefixes) | empty — no BGP history collected until set | Daily BGP pipeline |
monitoredAsns (comma-separated ASNs) | 13335,15169 | Hourly ASN reputation poller |
To change them: open the pipeline's Logic App in the Azure portal → Edit → Parameters, update the value, and save.
Put your own domains, egress IPs, and provider ASNs here — that is what turns the history workbooks and the registrar/BGP detections on for your estate.