Integrations for cloud, ticketing, SIEM and chat

Frequently asked questions

How does the SIEM integration with Microsoft Sentinel work?

blacklens.io is available as a solution in the Microsoft Sentinel Content Hub. The solution contains a data connector, an analytics rule and an ARM template for deployment. After installation, alerts and findings are written to your Log Analytics workspace and the analytics rule turns them into Sentinel incidents. Your SOC correlates them with other data sources and handles them in its usual process.

Which cloud providers are supported?

AWS, Microsoft Azure, Microsoft 365, Google Cloud, Cloudflare and Hetzner Cloud. The connectors inventory resources, audit configurations (every seven days by default, on demand whenever you want), flag publicly reachable resources and suggest new domains and IP addresses for the external scan. AWS connects through a read-only role, Microsoft 365 supplies identities without MFA, guest accounts and privileged roles, and Cloudflare supplies zones, DNS records and DNSSEC status.

Can I control which alerts go where?

Yes. Notification policies filter by severity and alert type and assign recipients and integrations. Critical threats can go to Microsoft Sentinel and as push notifications to the SOC, medium vulnerabilities as a Jira ticket to the platform team, and dark web hits by email to the helpdesk.

How do the ticketing and chat integrations work?

Ticketing and chat integrations are triggered by alerts through your notification policies. Jira creates tickets with severity, asset, description and a link back to the platform, ServiceNow creates incidents or tasks, and GitHub and GitLab create issues with remediation guidance. Microsoft Teams and Slack receive messages with severity, affected asset and a link to the finding. The iOS and Android app is paired via QR code and receives push notifications for all alert types.

How secure is the REST API?

The API uses API keys that are generated per workspace and can be revoked at any time, combined with a tenant identifier. Permissions follow the platform's role model with 50 permissions and 8 default roles. Documentation is available as Swagger UI. The 250+ endpoints cover assets, findings, alerts, scope, reports and administration, so you can embed blacklens.io in your own portals, dashboards or automations.

Does blacklens.io support single sign-on?

Yes. You can sign in to blacklens.io with single sign-on via Microsoft Entra ID or your company's Google accounts (OIDC), combined with MFA. Roles and permissions are managed in blacklens.io with 8 default roles plus custom roles. Entra ID also supplies identity data for the IAM inventory, and the Sentry agent analyses your on-premises Active Directory over SMB with a least-privilege account.

What happens when an integration fails?

The platform monitors the online status of every integration. If a connection fails, it appears on the workspace health card and raises a health alert. That way you notice an expired token or a changed permission before alerts are lost. Before activation, a connection check tests credentials and permissions, and paused integrations keep their configuration.

Is there an integration missing?

The generic webhook sends selected alerts as JSON to practically any system, for example a SOAR platform, your own scripts or a NAC solution that isolates compromised devices automatically. The REST API gives you access to the platform's data. If you need a native integration, talk to us; the list keeps growing.