WhisperThreatIntel_CL

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Tables Index

Attribute Value
Ingestion API Supported ✓ Yes

Contents

Schema (19 columns)

Source: KQL validation test schema

Column Name Type
explanation string
factors string
feedNames string
indicator string
indicatorType string
isAnonymizer bool
isBruteforce bool
isC2 bool
isMalware bool
isPhishing bool
isScanner bool
isSpam bool
isThreat bool
isTor bool
lastSeen datetime
threatLevel string
threatScore real
threatSources int
TimeGenerated datetime

Schema References

Official Microsoft Learn documentation for field/column information:

Solutions (1)

This table is used by the following solutions:

Content Items Using This Table (9)

Analytic Rules (3)

In solution Whisper:

Analytic Rule Selection Criteria
Whisper Security - C2 Communication Detection
Whisper Security - Co-Hosted Malware Cluster Detection
Whisper Security - Tor Exit Node Communication

Hunting Queries (5)

In solution Whisper:

Hunting Query Selection Criteria
Whisper - Attack Surface Discovery
Whisper - Domain to ASN Migration
Whisper - Infrastructure Pivot Analysis
Whisper - Newly Registered Domain Hunt
Whisper - Shared Infrastructure Clustering

Workbooks (1)

In solution Whisper:

Workbook Selection Criteria
InfrastructureThreatLandscape

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Tables Index