{
    "id": "blacklens_io",
    "title": "blacklens.io",
    "publisher": "snapSEC GmbH",
    "descriptionMarkdown": "The [blacklens.io](https://blacklens.io) data connector allows you to ingest Attack Surface Management alerts from blacklens.io into Microsoft Sentinel using a webhook-based Logic App and the Azure Monitor Logs Ingestion API.",
    "graphQueries": [
        {
            "metricName": "Total alerts received",
            "legend": "blacklens_CL",
            "baseQuery": "blacklens_CL"
        }
    ],
    "sampleQueries": [
        {
            "description": "All blacklens.io alerts",
            "query": "blacklens_CL\n| sort by TimeGenerated desc\n| take 10"
        },
        {
            "description": "High severity alerts",
            "query": "blacklens_CL\n| where tolower(severity) == \"high\"\n| sort by TimeGenerated desc"
        }
    ],
    "dataTypes": [
        {
            "name": "blacklens_CL",
            "lastDataReceivedQuery": "blacklens_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
        }
    ],
    "connectivityCriterias": [
        {
            "type": "IsConnectedQuery",
            "value": [
                "blacklens_CL\n| summarize LastLogReceived = max(TimeGenerated)\n| project IsConnected = LastLogReceived > ago(7d)"
            ]
        }
    ],
    "availability": {
        "status": 1,
        "isPreview": false
    },
    "permissions": {
        "resourceProvider": [
            {
                "provider": "Microsoft.OperationalInsights/workspaces",
                "permissionsDisplayText": "read and write permissions are required.",
                "providerDisplayName": "Workspace",
                "scope": "Workspace",
                "requiredPermissions": {
                    "write": true,
                    "read": true,
                    "delete": true
                }
            },
            {
                "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys",
                "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).",
                "providerDisplayName": "Keys",
                "scope": "Workspace",
                "requiredPermissions": {
                    "action": true
                }
            }
        ],
        "customs": [
            {
                "name": "Azure Subscription",
                "description": "Contributor or Owner permissions on the resource group are required to deploy the data ingestion infrastructure (Data Collection Endpoint, Data Collection Rule, custom table, and Logic App)."
            },
            {
                "name": "blacklens.io Account",
                "description": "A blacklens.io account with webhook integration capabilities is required."
            }
        ]
    },
    "instructionSteps": [
        {
            "title": "Step 1 - Deploy the data ingestion infrastructure",
            "description": "This step deploys the required Azure resources: a Data Collection Endpoint, Data Collection Rule, custom Log Analytics table (`blacklens_CL`), and a webhook-triggered Logic App.\n\n1. Click the **Deploy to Azure** button below.\n\n\t[![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FBlacklens%2FData%20Connectors%2Fdeployment%2Fazuredeploy_blacklens.json)\n\n2. Select the **Subscription**, **Resource Group**, and **Location** where your Microsoft Sentinel workspace resides.\n3. Enter the **Workspace Name** of your Log Analytics workspace.\n4. Click **Review + create** and then **Create**."
        },
        {
            "title": "Step 2 - Copy the webhook URL",
            "description": "1. After the deployment succeeds, click the **Outputs** tab on the deployment page.\n2. Copy the **webhookUrl** value.\n\nAlternatively, navigate to **Logic Apps** > `la-blacklens-alert-log-ingestion` > **Overview** and copy the **Workflow URL**."
        },
        {
            "title": "Step 3 - Configure blacklens.io",
            "description": "1. Log in to the [blacklens.io portal](https://blacklens.io).\n2. Navigate to the webhook integration settings.\n3. Paste the webhook URL copied in Step 2.\n4. Save the configuration.\n5. Link the webhook integration to at least one **notification policy** so that alerts are sent to the webhook.\n\nAfter a few minutes, a test incident should appear in Microsoft Sentinel."
        }
    ]
}