Installation
Store the API key in Key Vault, install from the Content Hub or the Marketplace listing, verify first data, and upgrade in place.
On this page (7)
Installation Documentation
Installing takes two steps: put your Whisper API key in Key Vault, then run the install wizard from the Content Hub or the Marketplace listing. Deployment typically completes in a few minutes.
Check the Requirements first — the resource-group and Key Vault constraints are the two things that make installs fail.
Step 1 — Store the API key in Key Vault
Create the secret and capture its URI:
az keyvault secret set \
--vault-name <your-vault> \
--name whisper-api-key \
--value "<your-whisper-api-key>"
az keyvault secret show \
--vault-name <your-vault> --name whisper-api-key \
--query id -o tsv
The second command prints the secret URI the install wizard asks for. Both versioned (with the 32-character suffix) and unversioned URIs are accepted. Use the unversioned form (https://yourvault.vault.azure.net/secrets/whisper-api-key) if you want the solution to always resolve the latest secret version — handy for key rotation.
Step 2 — Install the solution
From Content Hub (recommended)
- Azure portal → Microsoft Sentinel → select your workspace.
- Content management → Content hub.
- Search for Whisper, select Whisper Security, and choose Install.
From the Marketplace listing
On the Marketplace page, choose Get It Now and sign in — you land in the same Azure portal install wizard.
The install wizard
| Blade | What to do |
|---|---|
| Basics | Pick the subscription, the resource group containing your workspace and vault, and a Region. Then select your workspace from the dropdown. |
| Whisper API Credentials | Paste the Key Vault secret URI from Step 1. |
| Workbooks / Analytics / Hunting Queries / Playbooks | Informational — review what will be installed. |
| Review + create | Validate, then Create. |
When the deployment finishes, continue to Configuration — three one-time steps wire the solution into your incident workflow.
Verify the install
Resources. The resource group should contain 15 Logic Apps (10 Whisper-* playbooks and 5 pipelines), the WhisperSecurityConnector custom connector, and 4 data collection rules. The 5 workbooks appear under Microsoft Sentinel → Workbooks → My workbooks.
API connectivity. Open (or create) an incident with an IP entity, choose Actions → Run playbook, and run Whisper-ExplainIP. Within a minute the incident gets an enrichment comment and a row lands in the threat intel table:
WhisperThreatIntel_CL
| sort by TimeGenerated desc
| take 10
A 401 in the playbook run history means the Key Vault secret does not hold a valid Whisper API key.
First-data timeline. Empty tables right after install are normal:
| Data | Appears |
|---|---|
WhisperThreatIntel_CL, WhisperInfraContext_CL | After the first playbook run / incident enrichment |
WhisperASNReputation_CL | Within ~1 hour (hourly poller; defaults to ASNs 13335,15169 until you set your own) |
WhisperHistory_CL | Within ~24 hours after you set the domain/IP watchlists — empty watchlists collect nothing |
| Incident Enrichment Audit workbook | ~15 minutes after the first Logic App run (Azure diagnostics ingestion latency) |
Upgrading
When a new version ships, Content Hub shows an Update button on the Whisper Security solution — select it and re-run the wizard. Upgrades reconcile in place: tables, Key Vault, managed identities, and role assignments are preserved; Logic App definitions and workbook content update.