Data Reference

The solution writes everything to four custom tables in your Log Analytics workspace. Workbooks, analytics rules, and hunting queries read from them — and so can any KQL of your own.

What writes what

Only the five ingestion pipelines write to these tables. The ten playbooks call the Whisper API and post their result as a comment on the incident; none of them writes a row.

Both incident-triggered pipelines are a precondition, not an option — see Configuration.

Column contracts

Every column below comes from the shipped table schema and its writer's field mapping in solution 3.0.0. Guarantee is one of:

• guaranteed — present on every row the writer produces.
• conditional — present only when the graph had that data for the indicator.
• declared, never emitted — the column exists in the table and nothing in the solution writes it.

A row appears at all only when the pipeline reaches its ingestion step; a failed API call is logged and the row is skipped, so a missing indicator is not a clean indicator.

Read coverage before band. Only known-clean — coverage: known-clean. In coverage, no malicious evidence. licenses the word "clean"; no-data — coverage: no-data. Not in coverage. This is not a verdict — nothing was looked at. means unknown, which is a different thing again; malicious-evidenced — coverage: malicious-evidenced. In coverage, with positive evidence of malice. and ambiguous — coverage: ambiguous. In coverage, and the evidence points both ways. mean there is evidence, whatever the band says. Full contract: Coverage — what we looked at.

WhisperThreatIntel_CL

Written by Whisper-EnrichmentPipeline from CALL whisper.explain().

WhisperInfraContext_CL

Written by Whisper-InfraChainPipeline.

WhisperHistory_CL

One table, two shapes. Whisper-WhoisHistoryPipeline writes the WHOIS columns for domains; Whisper-BgpHistoryPipeline writes the BGP columns for IPs. Neither writes the other's columns, so every row has one half of this table empty.

Both writers are scheduled and read a watchlist. An empty watchlist means an empty table, and an empty table is indistinguishable from an indicator with no history.

WhisperASNReputation_CL

Written by Whisper-AsnReputationPoller, hourly, for the ASNs named in monitoredAsns.

Watch for a table that stops receiving rows

A union over the four tables tells you what arrived. It cannot tell you about a table that has never received a row, because a wildcard union matches nothing for a table with no data — and a table that is silently missing reads exactly like an indicator that is genuinely clean.

Name the four tables and join them back with rightouter, so an absent table appears as a row rather than as nothing:

let Expected = datatable(TableName: string)
[
    "WhisperThreatIntel_CL", "WhisperInfraContext_CL",
    "WhisperHistory_CL", "WhisperASNReputation_CL"
];
union isfuzzy=true withsource = TableName
    WhisperThreatIntel_CL, WhisperInfraContext_CL,
    WhisperHistory_CL, WhisperASNReputation_CL
| summarize Rows = count(), Latest = max(TimeGenerated) by TableName
| join kind=rightouter (Expected) on TableName
| project Table = TableName1, Rows = coalesce(Rows, long(0)), Latest
| where Rows == 0 or Latest < ago(24h)

The rightouter is the whole point. An inner join drops a table that has never been written, which is the same mistake as reading no-data as clean, one layer down. The last line keeps only what is worth acting on — a table with no rows at all, and a table whose newest row is over a day old — so this query returning nothing is the answer you want.

Ingestion pipelines

Five Logic Apps feed the tables. Deployed name is what you will see in the Azure portal; repo file is the template it is deployed from, which is the name to quote in a support request.

Four of the five take their deployed name from a template parameter, so a deployment that overrode it will show something else; Whisper-InfraChainPipeline is fixed in the template and is always that string.

The daily pipelines ship with empty watchlists and collect nothing until you set them — see Configuration.