# Installation

> Install the Whisper solution for Microsoft Sentinel: the Key Vault secret, the Content Hub wizard, verification, and when the first data arrives.

*Source: https://www.whisper.security/docs/integrations/sentinel/installation*

---
Installing takes two steps: put your Whisper API key in Key Vault, then run the install wizard from the Content Hub or the Marketplace listing. Deployment typically completes in a few minutes.

Check the [Requirements](/docs/integrations/sentinel/requirements) first — the resource-group and Key Vault constraints are the two things that make installs fail.

## Step 1 — Store the API key in Key Vault

Create the secret and capture its URI:

```bash
az keyvault secret set \
  --vault-name <your-vault> \
  --name whisper-api-key \
  --value "<your-whisper-api-key>"

az keyvault secret show \
  --vault-name <your-vault> --name whisper-api-key \
  --query id -o tsv
```

The second command prints the **secret URI** the install wizard asks for. Both versioned (with the 32-character suffix) and unversioned URIs are accepted. Use the unversioned form (`https://yourvault.vault.azure.net/secrets/whisper-api-key`) if you want the solution to always resolve the latest secret version — handy for key rotation.

## Step 2 — Install the solution

### From Content Hub (recommended)

1. Azure portal → **Microsoft Sentinel** → select your workspace.
2. **Content management → Content hub**.
3. Search for **Whisper**, select **Whisper Security**, and choose **Install**.

### From the Marketplace listing

On the [Marketplace page](https://marketplace.microsoft.com/en-us/product/whisper-security.azure-sentinel-solution-whisper), choose **Get It Now** and sign in — you land in the same Azure portal install wizard.

### The install wizard

| Blade | What to do |
| --- | --- |
| **Basics** | Pick the subscription, the **resource group containing your workspace and vault**, and a Region. Then select your workspace from the dropdown. |
| **Whisper API Credentials** | Paste the Key Vault **secret URI** from Step 1. |
| **Workbooks / Analytics / Hunting Queries / Playbooks** | Informational — review what will be installed. |
| **Review + create** | Validate, then **Create**. |

When the deployment finishes, continue to [Configuration](/docs/integrations/sentinel/configuration) — three one-time steps wire the solution into your incident workflow.

## Verify the install

**Resources.** The resource group should contain 15 Logic Apps (10 `Whisper-*` playbooks and 5 pipelines), the `WhisperSecurityConnector` custom connector, and 4 data collection rules. The 5 workbooks appear under **Microsoft Sentinel → Workbooks → My workbooks**.

**API connectivity.** Open (or create) an incident with an IP entity, choose **Actions → Run playbook**, and run `Whisper-ExplainIP`. Within a minute the incident gets an enrichment comment and a row lands in the threat intel table:

```kusto
WhisperThreatIntel_CL
| sort by TimeGenerated desc
| take 10
```

A `401` in the playbook run history means the Key Vault secret does not hold a valid Whisper API key.

**First-data timeline.** Empty tables right after install are normal:

| Data | Appears |
| --- | --- |
| `WhisperThreatIntel_CL`, `WhisperInfraContext_CL` | After the first playbook run / incident enrichment |
| `WhisperASNReputation_CL` | Within ~1 hour (hourly poller; defaults to ASNs `13335,15169` until you set your own) |
| `WhisperHistory_CL` | Within ~24 hours **after** you set the domain/IP watchlists — empty watchlists collect nothing |
| *Incident Enrichment Audit* workbook | ~15 minutes after the first Logic App run (Azure diagnostics ingestion latency) |

## Upgrading

When a new version ships, Content Hub shows an **Update** button on the Whisper Security solution — select it and re-run the wizard. Upgrades reconcile in place: tables, Key Vault, managed identities, and role assignments are preserved; Logic App definitions and workbook content update.