Data Reference
The four Whisper custom tables, the five ingestion pipelines that fill them, and how to watch and manage your API quota.
Data Reference Documentation
The solution writes everything to four custom tables in your Log Analytics workspace. Playbooks fill them on demand; pipelines fill them on schedules. Workbooks, analytics rules, and hunting queries read from them — and so can any KQL of your own.
Custom tables
| Table | Contents | Filled by |
|---|---|---|
WhisperThreatIntel_CL | Threat score (higher = worse), threat level, categorical flags (C2, malware, phishing, Tor, scanner, …), contributing feeds, explanation | Explain/enrichment playbooks, batch enrichment |
WhisperInfraContext_CL | IPs, prefixes, ASNs, geography, registrar/registrant, nameservers, domain age, co-hosted count, SPF includes, BGP status | Infrastructure playbooks, infra-chain pipeline |
WhisperHistory_CL | Point-in-time WHOIS snapshots (registrar, registrant, nameservers, dates) and BGP routing history (origin ASN, prefix, visibility) | History playbooks, daily WHOIS/BGP pipelines |
WhisperASNReputation_CL | ASN reputation score and level, max/avg threat scores, threatening-prefix flag, prefix and peer counts | ASN playbooks, hourly reputation poller |
Column-level schemas are in the repository README.
Quick sanity check that data is flowing:
union withsource=WhisperTable Whisper*_CL
| summarize Rows = count(), Latest = max(TimeGenerated) by WhisperTable
Ingestion pipelines
Five Logic Apps feed the tables alongside the playbooks:
| Pipeline | Trigger | Purpose |
|---|---|---|
Whisper-Enrichment-Pipeline | Incident (wire via automation rule) | explain() enrichment of incident entities into WhisperThreatIntel_CL |
Whisper-InfraChainPipeline | Incident (wire via automation rule) | Infrastructure-chain context into WhisperInfraContext_CL |
Whisper-WhoisHistory-Pipeline | Daily schedule | WHOIS snapshots for your domain watchlist into WhisperHistory_CL |
Whisper-BgpHistory-Pipeline | Daily schedule | BGP routing history for your IP watchlist into WhisperHistory_CL |
Whisper-AsnReputationPoller | Hourly schedule | Reputation refresh for your monitored ASNs into WhisperASNReputation_CL |
The daily pipelines ship with empty watchlists and collect nothing until you set them — see Configuration.
Managing your API quota
Daily quota and concurrency depend on your Whisper plan: Explorer 500/day, Professional 5,000/day, Enterprise 50,000/day, Strategic unlimited. Quota resets daily at 00:00 UTC.
- Watch consumption in the Incident Enrichment Audit workbook.
- Rate limiting: on HTTP 429 the playbooks back off automatically until the quota reset time; enrichment resumes on its own.
- Heaviest consumers:
Whisper-BatchEnrich(one call per indicator, up to 50) and broad automation rules. If quota is tight, scope automation rules to high-severity incidents first. - Plan details and upgrades: whisper.security/pricing.