Workbooks & Detections
Five workbooks, eight analytics rule templates with MITRE ATT&CK mappings, and six hunting queries — and what each one reads from.
Workbooks & Detections Documentation
Everything on this page reads from the four Whisper custom tables, so panels and detections sharpen as enrichment data accumulates. See Data Reference for what each table holds.
Workbooks
Microsoft Sentinel → Workbooks → My workbooks, filter on Whisper:
| Workbook | Use it to |
|---|---|
| External Attack Surface Overview | Map your externally visible footprint: domains, hosting IPs, prefixes, ASNs, shared-infrastructure clusters |
| Infrastructure Threat Landscape | See threat scores by ASN, prefix, and country; C2/malware/phishing prevalence; pivot from one indicator to related infrastructure |
| ASN Reputation Monitoring | Track reputation drift across ASNs you care about; spot degradations and the prefixes driving them |
| Domain Registration Anomaly | Catch registrar changes, registrant swaps, moves to threat-linked ASNs, short-lived domains |
| Incident Enrichment Audit | Operate the integration: playbook invocation counts, latency, error rates, API quota consumption |
The Incident Enrichment Audit workbook reads Logic App run telemetry from AzureDiagnostics. Panels stay empty until ~15 minutes after the first playbook or pipeline run.
Analytics rules
Eight scheduled rule templates — enable them per Configuration:
| Rule | Detects | MITRE |
|---|---|---|
| C2 Communication Detection | Traffic to indicators flagged C2 with score > 60 | T1071 |
| Tor Exit Node Communication | Traffic to known Tor exit nodes | T1090.003 |
| Newly Registered Domain on Threat ASN | Domains < 7 days old on high-threat networks | T1583.001 |
| Co-Hosted Malware Cluster Detection | IPs hosting 3+ malware-flagged domains | T1584.001 |
| ASN Reputation Degradation | ASN reputation worsening > 20 points in 24 h | T1583.002 |
| BGP Route Anomaly with Traffic Spike | Origin-AS changes correlated with traffic spikes | T1557 |
| Domain Registrar Change Anomaly | Registrar changes within 30 days | T1584 |
| SPF Record Unauthorized Include | New, unseen SPF include directives | T1566.001 |
Rules joining network traffic (CommonSecurityLog) — C2, Tor, BGP anomaly — require a firewall/CEF data source; the rest run entirely on Whisper tables.
Hunting queries
Microsoft Sentinel → Hunting, filter on Whisper:
| Query | Hunt for |
|---|---|
| Attack Surface Discovery | Prioritized inventory of external IPs/domains/ASNs by threat score |
| Newly Registered Domain Hunt | Domains younger than 14 days touching your environment |
| Shared Infrastructure Clustering | Threat-actor clusters sharing ASN, prefix, registrar, or nameserver |
| Infrastructure Pivot Analysis | Related infrastructure reachable from a known-bad indicator |
| Domain to ASN Migration | Domains that moved hosting networks (infrastructure migration) |
| ASN Reputation Score Hunt | ASNs that got significantly riskier in the last 24 h |
A quick sanity check that data is flowing before you lean on any of these:
union withsource=WhisperTable Whisper*_CL
| summarize Rows = count(), Latest = max(TimeGenerated) by WhisperTable