Configuration
The one-time post-install steps: playbook permissions, automation rules, analytics rule enablement, and the scheduled-pipeline watchlists.
Configuration Documentation
The deployment finishes with everything installed, but three one-time steps wire it into your incident workflow, and a fourth tells the scheduled pipelines what to track.
1. Grant Microsoft Sentinel permission to run the playbooks
Automation rules cannot invoke a playbook until Microsoft Sentinel's service principal is allowed to:
- Microsoft Sentinel → Settings → Settings tab → Playbook permissions → Configure permissions.
- Select the resource group you installed into and confirm.
One click — no GUIDs to look up.
2. Create automation rules
The solution intentionally ships no automation rules (they cannot be created before step 1). Wire the ones you want:
- Microsoft Sentinel → Automation → Create → Automation rule.
- Trigger: When incident is created. Add a condition — for example, the analytic rule name — and the action Run playbook with the matching Whisper playbook.
Recommended starting pairings are in Playbooks. The two incident-triggered ingestion pipelines (Whisper-Enrichment-Pipeline, Whisper-InfraChainPipeline) are wired the same way if you want every new incident enriched into the custom tables automatically.
3. Enable analytics rules
Rules install as templates and are off by default:
- Microsoft Sentinel → Content hub → Whisper Security → Manage, or Analytics → Rule templates filtered to Whisper.
- For each rule you want, choose Create rule and review the schedule and thresholds.
C2 Communication Detection, Tor Exit Node Communication, and BGP Route Anomaly with Traffic Spike correlate with CommonSecurityLog — they only fire if you have a data source feeding that table (firewall/CEF logs). The rest run entirely on Whisper tables.
4. Set the scheduled-pipeline watchlists
The three scheduled pipelines track what you tell them to:
| Setting | Default | Used by |
|---|---|---|
domainWatchlist (comma-separated domains) | empty — no WHOIS history collected until set | Daily WHOIS pipeline |
ipWatchlist (comma-separated IPs/prefixes) | empty — no BGP history collected until set | Daily BGP pipeline |
monitoredAsns (comma-separated ASNs) | 13335,15169 | Hourly ASN reputation poller |
To change them: open the pipeline's Logic App in the Azure portal → Edit → Parameters, update the value, and save.
Put your own domains, egress IPs, and provider ASNs here — that is what turns the history workbooks and the registrar/BGP detections on for your estate.