Data Source
Whisper Security maps internet infrastructure 7+ billion nodes, 39+ billion edges and aggregates 40+ threat intelligence feeds to produce scored threat indicators with infrastructure context. This solution ingests enriched data across four custom tables:
- WhisperThreatIntel_CL: threat-scored IPs, domains, URLs
- WhisperInfraContext_CL: infrastructure relationships and co-hosting chains
- WhisperHistory_CL: WHOIS and BGP history for registered domains and prefixes
- WhisperASNReputation_CL: ASN-level reputation scores over time
Ingestion Mechanism
Five scheduled Playbooks (Logic Apps) act as ingestion pipelines polling the Whisper Graph API using an X-API-Key header, with the key stored in the customers Azure Key Vault (retrieved via Managed Identity). DCR/DCE resources are provisioned per table.
Detection Surface Unlocked
Analytic Rules (8 added)
| Rule | Primary Signal |
|---|---|
| C2CommunicationDetection | Outbound connections to Whisper-scored C2 infrastructure (T1071, T1090) |
| TorExitNodeCommunication | Traffic to/from known Tor exit nodes |
| NewlyRegisteredDomainThreatASN | Domains registered <30 days on ASNs with high threat scores (T1583) |
| CoHostedMalwareCluster | IPs co-hosting indicators from known malware clusters (T1584) |
| AsnReputationDegradation | ASN reputation score drops triggering alert on hosted assets |
| BgpRouteAnomalyTrafficSpike | BGP route changes correlated with traffic volume anomalies |
| DomainRegistrarChangeAnomaly | Sudden registrar changes on monitored domains (T1583.001) |
| SpfRecordUnauthorizedInclude | Unauthorized third-party includes in SPF records (T1566.001) |
Primary data sources: WhisperThreatIntel_CL, WhisperInfraContext_CL, WhisperASNReputation_CL, WhisperHistory_CL
Hunting Queries (6 added)
- AttackSurfaceDiscovery: enumerate exposed infrastructure by threat score
- NewlyRegisteredDomainHunt: pivot on recently registered domains across Whisper data
- SharedInfrastructureClustering: cluster IPs sharing malicious co-hosted indicators
- InfrastructurePivotAnalysis: track attacker infrastructure pivots
- DomainToAsnMigration: detect domains migrating to threat-scored ASNs
- BgpAnomalyHunt: hunt BGP prefix hijack and route leak patterns
Workbooks (5 added)
- External Attack Surface Overview
- Infrastructure Threat Landscape
- ASN Reputation Monitoring
- Domain Registration Anomaly
- Incident Enrichment Audit (auto-populated via diagnosticSettings on all 15 Playbooks)
Enrichment Playbooks (10 added)
On-demand enrichment: ExplainIP, ExplainDomain, ExplainASN, ExplainNetwork, BatchEnrich, CheckAsnReputation, DiscoverCoHosted, GetInfraChain, GetBgpHistory, GetWhoisHistory.
MITRE Coverage
T1046 (Network Service Discovery), T1071 (Application Layer Protocol), T1090 / T1090.003 (Proxy / Multi-hop), T1557 (Adversary-in-the-Middle), T1566 / T1566.001 (Phishing / Spearphishing), T1583 / T1583.001 thru T1583.003 (Acquire Infrastructure), T1584 / T1584.001 (Compromise Infrastructure)
Affected Files
.script/tests/KqlvalidationsTests/CustomTables/WhisperASNReputation_CL.json
.script/tests/KqlvalidationsTests/CustomTables/WhisperHistory_CL.json
.script/tests/KqlvalidationsTests/CustomTables/WhisperInfraContext_CL.json
.script/tests/KqlvalidationsTests/CustomTables/WhisperThreatIntel_CL.json
.script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json
Logos/Whisper.svg
Solutions/Whisper/Analytic Rules/AsnReputationDegradation.yaml
Solutions/Whisper/Analytic Rules/BgpRouteAnomalyTrafficSpike.yaml
Solutions/Whisper/Analytic Rules/C2CommunicationDetection.yaml
Solutions/Whisper/Analytic Rules/CoHostedMalwareCluster.yaml
Solutions/Whisper/Analytic Rules/DomainRegistrarChangeAnomaly.yaml
Solutions/Whisper/Analytic Rules/NewlyRegisteredDomainThreatASN.yaml
Solutions/Whisper/Analytic Rules/SpfRecordUnauthorizedInclude.yaml
Solutions/Whisper/Analytic Rules/TorExitNodeCommunication.yaml
Solutions/Whisper/Data Connectors/WhisperASNReputation_CL.json
Solutions/Whisper/Data Connectors/WhisperAsnReputationPoller.json
Solutions/Whisper/Data Connectors/WhisperBgpHistoryPipeline.json
Solutions/Whisper/Data Connectors/WhisperEnrichmentPipeline.json
Solutions/Whisper/Data Connectors/WhisperHistory_CL.json
Solutions/Whisper/Data Connectors/WhisperInfraChainPipeline.json
Solutions/Whisper/Data Connectors/WhisperInfraContext_CL.json
Solutions/Whisper/Data Connectors/WhisperThreatIntel_CL.json
Solutions/Whisper/Data Connectors/WhisperWhoisHistoryPipeline.json
Solutions/Whisper/Hunting Queries/AttackSurfaceDiscovery.yaml
Solutions/Whisper/Hunting Queries/BgpAnomalyHunt.yaml
Solutions/Whisper/Hunting Queries/DomainToAsnMigration.yaml
Solutions/Whisper/Hunting Queries/InfrastructurePivotAnalysis.yaml
Solutions/Whisper/Hunting Queries/NewlyRegisteredDomainHunt.yaml
Solutions/Whisper/Hunting Queries/SharedInfrastructureClustering.yaml
Solutions/Whisper/Package/testParameters.json
Solutions/Whisper/Playbooks/Whisper-BatchEnrich/azuredeploy.json
Solutions/Whisper/Playbooks/Whisper-CheckAsnReputation/azuredeploy.json
Solutions/Whisper/Playbooks/Whisper-DiscoverCoHosted/azuredeploy.json
Solutions/Whisper/Playbooks/Whisper-ExplainASN/azuredeploy.json
Solutions/Whisper/Playbooks/Whisper-ExplainDomain/azuredeploy.json
Solutions/Whisper/Playbooks/Whisper-ExplainIP/azuredeploy.json
Solutions/Whisper/Playbooks/Whisper-ExplainNetwork/azuredeploy.json
Solutions/Whisper/Playbooks/Whisper-GetBgpHistory/azuredeploy.json
Solutions/Whisper/Playbooks/Whisper-GetInfraChain/azuredeploy.json
Solutions/Whisper/Playbooks/Whisper-GetWhoisHistory/azuredeploy.json
Solutions/Whisper/Playbooks/WhisperSecurityConnector/azuredeploy.json
Solutions/Whisper/Workbooks/AsnReputationMonitoring.json
Solutions/Whisper/Workbooks/DomainRegistrationAnomaly.json
Solutions/Whisper/Workbooks/ExternalAttackSurfaceOverview.json
Solutions/Whisper/Workbooks/Images/Preview/WhisperAsnReputation1Black.png
Solutions/Whisper/Workbooks/Images/Preview/WhisperAsnReputation1White.png
Solutions/Whisper/Workbooks/Images/Preview/WhisperDomainRegistration1Black.png
Solutions/Whisper/Workbooks/Images/Preview/WhisperDomainRegistration1White.png
Solutions/Whisper/Workbooks/Images/Preview/WhisperExternalAttackSurface1Black.png
Solutions/Whisper/Workbooks/Images/Preview/WhisperExternalAttackSurface1White.png
Solutions/Whisper/Workbooks/Images/Preview/WhisperIncidentEnrichment1Black.png
Solutions/Whisper/Workbooks/Images/Preview/WhisperIncidentEnrichment1White.png
Solutions/Whisper/Workbooks/Images/Preview/WhisperInfrastructureThreat1Black.png
Solutions/Whisper/Workbooks/Images/Preview/WhisperInfrastructureThreat1White.png
Solutions/Whisper/Workbooks/IncidentEnrichmentAudit.json
Solutions/Whisper/Workbooks/InfrastructureThreatLandscape.json
Solutions/Whisper/Workbooks/WorkbooksMetadata.json
Workbooks/Images/Logos/Whisper.svg
Workbooks/Images/Preview/WhisperAsnReputation1Black.png
Workbooks/Images/Preview/WhisperAsnReputation1White.png
Workbooks/Images/Preview/WhisperDomainRegistration1Black.png
Workbooks/Images/Preview/WhisperDomainRegistration1White.png
Workbooks/Images/Preview/WhisperExternalAttackSurface1Black.png
Workbooks/Images/Preview/WhisperExternalAttackSurface1White.png
Workbooks/Images/Preview/WhisperIncidentEnrichment1Black.png
Workbooks/Images/Preview/WhisperIncidentEnrichment1White.png
Workbooks/Images/Preview/WhisperInfrastructureThreat1Black.png
Workbooks/Images/Preview/WhisperInfrastructureThreat1White.png
Workbooks/WorkbooksMetadata.json
(packaging artefacts: 3.0.0.zip, ReleaseNotes.md, SolutionMetadata.json, Solution_Whisper.json, createUiDefinition.json, mainTemplate.json)