blacklens.io

The blacklens.io integration allows you to monitor alerts. blacklens.io is a comprehensive Attack Surface Management platform that helps businesses understand and secure their external attack surface. By combining automated security analysis, continuous monitoring, and penetration testing, it identifies and addresses vulnerabilities early. With features like Darknet Monitoring, Vulnerability Scanning, and XDR Response, blacklens.io provides a proactive defense strategy to protect companies from cyber threats while offering a clear view of their security posture at all times.

Use the blacklens.io integration to fetch all related alerts about your Attack Surface. Then visualize that data in Kibana and create further alerts or enrich the data with other security solutions.

Elastic Managed integrations are only supported on Elastic Cloud Serverless and Elastic Cloud Hosted deployments. An Elastic Managed integration lets you ingest data from a cloud source while avoiding the orchestration, management, and maintenance associated with standard ingest infrastructure. Elastic runs the collector for you, so you can focus on your data instead of the infrastructure that collects it.

For more information, refer to Elastic Managed integrations and the Elastic Managed integrations FAQ.

The blacklens.io integration collects one type of data streams: logs

Alerts returns a list of blacklens.io alerts (The API Docs are referenced within the portal)

You need Elasticsearch for storing and searching your data and Kibana for visualizing and managing it. You can use our hosted Elasticsearch Service on Elastic Cloud, which is recommended, or self-manage the Elastic Stack on your own hardware. You will require the alerts:read permission in order to fetch the Alerts via the API.

You need an active blacklens.io subscription and a user with the alerts:read permission to retrieve alerts via the API.

1. Login to your blacklens.io Portal (This URL will be used for the Instance URL: 'https://portal-(ID).blacklens.io')
2. Go to Profile → Generate API Key and copy it.
3. Go to Settings → Company.
4. Copy ws_id and tenant_id.

1. In Kibana go to Management > Integrations.
2. In "Search for integrations" search bar, type blacklens.io.
3. Click on the "blacklens.io" integration from the search results.
4. Click on the "Add blacklens.io" button to add the integration.
5. Configure all required integration parameters.
   • Alert data requires following parameters:
     • URL
     • Tenant ID (tenant_id)
     • Workspace ID (ws_id)
     • API Key
6. Save the integration.

For detailed setup instructions, please refer to the blacklens.io Knowledge Base (The link is referenced within the portal).

This is the alerts dataset

{
    "@timestamp": "2026-02-03T06:17:57.260Z",
    "agent": {
        "ephemeral_id": "23a29ca3-cffa-4f55-9ef4-536308f22c95",
        "id": "6bcec12d-6281-4434-99e0-eb2f7c014fbf",
        "name": "elastic-agent-84667",
        "type": "filebeat",
        "version": "8.19.10"
    },
    "blacklens": {
        "alert": {
            "activities": [
                {
                    "category": "threat",
                    "created_date": "2026-02-03T06:17:57.260Z",
                    "description": "A Critical severity external vulnerability 'Blind SQL Injection via HTTP Header' has been detected on asset 'demo.example.com'",
                    "id": "3fa85f64-5717-4562-b3fc-2c963f66afa5",
                    "trace_id": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
                    "type": "ExternalVulnerabilityCreated",
                    "updated_date": "2026-02-03T06:17:57.260Z"
                }
            ],
            "analysis": "ongoing",
            "category": "vulnerability",
            "id": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
            "name": "External Vulnerability",
            "severity": "medium",
            "status": "new",
            "updated_date": "2026-02-03T06:17:57.260Z"
        }
    },
    "data_stream": {
        "dataset": "blacklens.alerts",
        "namespace": "43517",
        "type": "logs"
    },
    "ecs": {
        "version": "8.11.0"
    },
    "elastic_agent": {
        "id": "6bcec12d-6281-4434-99e0-eb2f7c014fbf",
        "snapshot": false,
        "version": "8.19.10"
    },
    "event": {
        "agent_id_status": "verified",
        "category": [
            "threat"
        ],
        "created": "2026-03-31T08:58:43.557Z",
        "dataset": "blacklens.alerts",
        "id": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
        "ingested": "2026-03-31T08:58:46Z",
        "kind": "alert",
        "type": [
            "indicator"
        ]
    },
    "input": {
        "type": "httpjson"
    },
    "tags": [
        "forwarded",
        "blacklens-alert"
    ]
}

This integration includes one or more Kibana dashboards that visualizes the data collected by the integration. The screenshots below illustrate how the ingested data is displayed.