Description
The [blacklens.io](https://blacklens.io) data connector allows you to ingest Attack Surface Management alerts from blacklens.io into Microsoft Sentinel using a webhook-based Logic App and the Azure Monitor Logs Ingestion API.
- Declared status
- 1
- Declared author / publisher
- snapSEC GmbH
Declared sources
Metadata from the source file. No dependencies inferred from KQL.
Data types
Declared permissions
read and write permissions are required.
Workspace
Workspace
read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).
Keys
Workspace
Azure Subscription
Contributor or Owner permissions on the resource group are required to deploy the data ingestion infrastructure (Data Collection Endpoint, Data Collection Rule, custom table, and Logic App).
blacklens.io Account
A blacklens.io account with webhook integration capabilities is required.
Connector instructions
Content published in the repository. Refer to the original file for all parameters.
Step 1 - Deploy the data ingestion infrastructure
This step deploys the required Azure resources: a Data Collection Endpoint, Data Collection Rule, custom Log Analytics table (`blacklens_CL`), and a webhook-triggered Logic App.
1. Click the **Deploy to Azure** button below.
[](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FBlacklens%2FData%20Connectors%2Fdeployment%2Fazuredeploy_blacklens.json)
2. Select the **Subscription**, **Resource Group**, and **Location** where your Microsoft Sentinel workspace resides.
3. Enter the **Workspace Name** of your Log Analytics workspace.
4. Click **Review + create** and then **Create**.
Step 2 - Copy the webhook URL
1. After the deployment succeeds, click the **Outputs** tab on the deployment page.
2. Copy the **webhookUrl** value.
Alternatively, navigate to **Logic Apps** > `la-blacklens-alert-log-ingestion` > **Overview** and copy the **Workflow URL**.
Step 3 - Configure blacklens.io
1. Log in to the [blacklens.io portal](https://blacklens.io).
2. Navigate to the webhook integration settings.
3. Paste the webhook URL copied in Step 2.
4. Save the configuration.
5. Link the webhook integration to at least one **notification policy** so that alerts are sent to the webhook.
After a few minutes, a test incident should appear in Microsoft Sentinel.
Related content
Links established from declared identifiers and solution manifests.
Source provenance
GitHubDisplayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.
- Commit
9800e51↗- Source identifier
blacklens_io
GSTEP / CATALOG TRACKING
Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC