Log baseline v0.5.1
GitHub
All tables
Threat intelligence / Threat indicator

WhisperThreatIntel_CL

Whisper Security threat-intelligence enrichment for IP addresses, domains, command-and-control, and malware associations

Recommendation

AnalyticsData lakePrimarySecondarySecondary ยท Analytics180 days retention

Context that analytics-tier detections or Sentinel features join against, or context tables the lake cannot hold.

How the matrix works

C9 Health, inventory, and reference context

Secondary: health, performance, metrics, diagnostics, inventory, posture snapshots, reference data, and aggregates derived from another collected table

ACSC

No section

CISA

No event type

MITRE data sources

None recorded

T2 Enrichment or join target

Low-volume enrichment or join target for analytics-tier detections or Sentinel features.

Lake supported in the Azure Monitor table feature matrix

Fields detections use

High-value fields

threatLevelthreatScoreTimeGeneratedfeedNamesisThreatasnNamesavgThreatScorecohostedCountDestinationIPDeviceActionDeviceProductDnsDomaindomainAgeipAddressesisMalwarelastSeenmaxThreatScoreSourceIPActivityASNclusterIndicatorsclusterKeyclusterTypeDestinationHostNameDeviceVendor

Most used in public rules

  1. threatLevel8
  2. threatScore8
  3. TimeGenerated8
  4. feedNames6
  5. isThreat4
  6. asnNames2
  7. avgThreatScore2
  8. cohostedCount2
  9. DestinationIP2
  10. DeviceAction2
  11. DeviceProduct2
  12. DnsDomain2

Sources for this recommendation

  • Azure-Sentinel public content corpus Table identity and usage evidence from public analytics rules, hunting queries, parsers, and solution content. Classification, tier, retention, and billing recommendations require human review.
  • Log Baseline volume model Judgment-based volume driver and relative volume class per table. Not measured tenant volume.
  • Log Baseline classification rules Value rules C1-C9 mapped to ASD and CISA guidance, and tier rules T1-T5 including plan support. Stored per table as valueRule and tierRule.