Playbooks
The ten incident-triggered enrichment playbooks, what each answers, typical latency, and recommended automation-rule pairings.
Playbooks Documentation
All ten playbooks use the Microsoft Sentinel incident trigger: they read entities from an incident, call the Whisper API, write results to the custom tables, and post a summary comment back on the incident.
Running a playbook manually
Open an incident → Actions → Run playbook → pick the Whisper playbook. Results appear as an incident comment, typically under a minute; BGP history takes up to ~90 seconds.
Playbook reference
| Playbook | Input entities | What it answers | Typical latency |
|---|---|---|---|
Whisper-ExplainIP | IP | Is this IP a threat? Score, flags, feeds | < 1 s |
Whisper-ExplainDomain | Domain | Is this domain a threat? | < 1 s |
Whisper-ExplainASN | ASN | Network-level reputation | < 1 s |
Whisper-ExplainNetwork | IP and/or domain | Threat + infrastructure combined | ~1 s |
Whisper-DiscoverCoHosted | IP | What else is hosted on this IP? | < 1 s |
Whisper-GetInfraChain | IP + domain | Full IP↔prefix↔ASN↔domain relationship chain | ~1 s |
Whisper-GetWhoisHistory | Domain | Registrar/registrant/nameserver changes over time | ~2 s |
Whisper-GetBgpHistory | IP | Routing origin and prefix changes over time | up to ~90 s (async: posts an acknowledgment, then results) |
Whisper-BatchEnrich | All IPs + domains on the incident | Bulk threat verdicts (capped at 50 indicators, 5 concurrent) | ~300 ms per indicator |
Whisper-CheckAsnReputation | ASN | Reputation score, threat density, prefix count | < 1 s |
All playbooks retry transient API failures with exponential backoff (3 attempts) and log errors without failing the incident workflow.
Recommended automation-rule pairings
A sensible starting point — one automation rule per analytic rule you enable:
| When the incident comes from… | Run… |
|---|---|
| C2 Communication Detection | Whisper-ExplainIP |
| Tor Exit Node Communication | Whisper-ExplainIP |
| Newly Registered Domain on Threat ASN | Whisper-ExplainDomain |
| Co-Hosted Malware Cluster Detection | Whisper-DiscoverCoHosted |
| ASN Reputation Degradation | Whisper-CheckAsnReputation |
| BGP Route Anomaly with Traffic Spike | Whisper-GetBgpHistory |
| Domain Registrar Change Anomaly | Whisper-GetWhoisHistory |
| SPF Record Unauthorized Include | Whisper-ExplainDomain |
| Any multi-entity incident | Whisper-BatchEnrich |
Each rule: trigger When incident is created → condition on the analytic rule → action Run playbook. This needs the one-time permission grant in Configuration.
Watching quota
Whisper-BatchEnrich is the heaviest consumer — one API call per indicator, up to 50 per run. If quota is tight, scope automation rules to high-severity incidents first. Consumption, latency, and error rates are all visible in the Incident Enrichment Audit workbook; see Data Reference for quota tiers and monitoring.