{
  "Name": "Whisper",
  "Author": "Whisper Security - support@whisper.security",
  "Logo": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/Whisper.svg\" width=\"75px\" height=\"75px\">",
  "Description": "The **Whisper Security** solution for Microsoft Sentinel brings the Whisper internet-scale infrastructure knowledge graph (7+ billion nodes, 39+ billion edges, 40+ threat feeds) into Microsoft Sentinel's detection and response workflows. It provides real-time threat intelligence enrichment, infrastructure context, WHOIS/BGP history, and ASN reputation polling.\n\n**Underlying Microsoft technologies used:**\n- [Azure Logic Apps](https://azure.microsoft.com/services/logic-apps/) for enrichment playbooks\n- [Microsoft Sentinel custom tables](https://learn.microsoft.com/azure/azure-monitor/logs/create-custom-table) for storing enriched threat/infrastructure data\n- [Azure Key Vault](https://azure.microsoft.com/services/key-vault/) for Whisper API key storage",
  "WorkbookBladeDescription": "This Microsoft Sentinel solution installs the following workbooks. Workbooks provide a flexible canvas for monitoring and analyzing enriched Whisper threat and infrastructure data alongside your existing Microsoft Sentinel logs.",
  "AnalyticalRuleBladeDescription": "This solution installs scheduled analytic rule templates that correlate Whisper threat intelligence and infrastructure context with your Microsoft Sentinel data sources. After installation, enable the rules in the Manage solution view.",
  "HuntingQueryBladeDescription": "This solution installs the following hunting queries. Run them to pivot through your environment using Whisper's infrastructure graph context for proactive threat discovery.",
  "PlaybooksBladeDescription": "This solution installs the following Logic Apps playbooks for on-demand enrichment of IPs, domains, ASNs, and infrastructure relationships. Playbooks can be managed from the Manage solution view.",
  "Workbooks": [
    "Workbooks/ExternalAttackSurfaceOverview.json",
    "Workbooks/InfrastructureThreatLandscape.json",
    "Workbooks/AsnReputationMonitoring.json",
    "Workbooks/DomainRegistrationAnomaly.json",
    "Workbooks/IncidentEnrichmentAudit.json"
  ],
  "Analytic Rules": [
    "Analytic Rules/C2CommunicationDetection.yaml",
    "Analytic Rules/TorExitNodeCommunication.yaml",
    "Analytic Rules/NewlyRegisteredDomainThreatASN.yaml",
    "Analytic Rules/CoHostedMalwareCluster.yaml",
    "Analytic Rules/AsnReputationDegradation.yaml",
    "Analytic Rules/BgpRouteAnomalyTrafficSpike.yaml",
    "Analytic Rules/DomainRegistrarChangeAnomaly.yaml",
    "Analytic Rules/SpfRecordUnauthorizedInclude.yaml"
  ],
  "Hunting Queries": [
    "Hunting Queries/AttackSurfaceDiscovery.yaml",
    "Hunting Queries/NewlyRegisteredDomainHunt.yaml",
    "Hunting Queries/SharedInfrastructureClustering.yaml",
    "Hunting Queries/InfrastructurePivotAnalysis.yaml",
    "Hunting Queries/DomainToAsnMigration.yaml",
    "Hunting Queries/BgpAnomalyHunt.yaml"
  ],
  "Playbooks": [
    "Playbooks/Whisper-ExplainIP/azuredeploy.json",
    "Playbooks/Whisper-ExplainDomain/azuredeploy.json",
    "Playbooks/Whisper-ExplainASN/azuredeploy.json",
    "Playbooks/Whisper-ExplainNetwork/azuredeploy.json",
    "Playbooks/Whisper-BatchEnrich/azuredeploy.json",
    "Playbooks/Whisper-CheckAsnReputation/azuredeploy.json",
    "Playbooks/Whisper-DiscoverCoHosted/azuredeploy.json",
    "Playbooks/Whisper-GetBgpHistory/azuredeploy.json",
    "Playbooks/Whisper-GetInfraChain/azuredeploy.json",
    "Playbooks/Whisper-GetWhoisHistory/azuredeploy.json"
  ],
  "Data Connectors": [],
  "Version": "3.0.0",
  "Metadata": "SolutionMetadata.json",
  "TemplateSpec": true
}