Installation

Store the API key in Key Vault, install from the Content Hub or the Marketplace listing, verify first data, and upgrade in place.

Updated July 2026Microsoft Sentinel

Installing takes two steps: put your Whisper API key in Key Vault, then run the install wizard from the Content Hub or the Marketplace listing. Deployment typically completes in a few minutes.

Check the Requirements first — the resource-group and Key Vault constraints are the two things that make installs fail.

Step 1 — Store the API key in Key Vault

Create the secret and capture its URI:

az keyvault secret set \
  --vault-name <your-vault> \
  --name whisper-api-key \
  --value "<your-whisper-api-key>"

az keyvault secret show \
  --vault-name <your-vault> --name whisper-api-key \
  --query id -o tsv

The second command prints the secret URI the install wizard asks for. Both versioned (with the 32-character suffix) and unversioned URIs are accepted. Use the unversioned form (https://yourvault.vault.azure.net/secrets/whisper-api-key) if you want the solution to always resolve the latest secret version — handy for key rotation.

Step 2 — Install the solution

From Content Hub (recommended)

Azure portal → Microsoft Sentinel → select your workspace.
Content management → Content hub.
Search for Whisper, select Whisper Security, and choose Install.

From the Marketplace listing

On the Marketplace page, choose Get It Now and sign in — you land in the same Azure portal install wizard.

The install wizard

Blade	What to do
Basics	Pick the subscription, the resource group containing your workspace and vault, and a Region. Then select your workspace from the dropdown.
Whisper API Credentials	Paste the Key Vault secret URI from Step 1.
Workbooks / Analytics / Hunting Queries / Playbooks	Informational — review what will be installed.
Review + create	Validate, then Create.

When the deployment finishes, continue to Configuration — three one-time steps wire the solution into your incident workflow.

Verify the install

Resources. The resource group should contain 15 Logic Apps (10 Whisper-* playbooks and 5 pipelines), the WhisperSecurityConnector custom connector, and 4 data collection rules. The 5 workbooks appear under Microsoft Sentinel → Workbooks → My workbooks.

API connectivity. Open (or create) an incident with an IP entity, choose Actions → Run playbook, and run Whisper-ExplainIP. Within a minute the incident gets an enrichment comment and a row lands in the threat intel table:

WhisperThreatIntel_CL
| sort by TimeGenerated desc
| take 10

A 401 in the playbook run history means the Key Vault secret does not hold a valid Whisper API key.

First-data timeline. Empty tables right after install are normal:

Data	Appears
`WhisperThreatIntel_CL`, `WhisperInfraContext_CL`	After the first playbook run / incident enrichment
`WhisperASNReputation_CL`	Within ~1 hour (hourly poller; defaults to ASNs `13335,15169` until you set your own)
`WhisperHistory_CL`	Within ~24 hours after you set the domain/IP watchlists — empty watchlists collect nothing
Incident Enrichment Audit workbook	~15 minutes after the first Logic App run (Azure diagnostics ingestion latency)

Upgrading

When a new version ships, Content Hub shows an Update button on the Whisper Security solution — select it and re-run the wizard. Upgrades reconcile in place: tables, Key Vault, managed identities, and role assignments are preserved; Logic App definitions and workbook content update.

PreviousRequirements NextConfiguration