ThreatLocker

ThreatLocker is an endpoint protection platform providing application allowlisting, ringfencing, storage control, and network control to prevent untrusted software from executing. This guide provides instructions for integrating the ThreatLocker Portal API into the ThreatDefence SIEM platform, enabling ThreatLocker Unified Audit events to be ingested, normalized, and converted into SIEM events.

ThreatLocker provides access to its action log (unified audit) data through a RESTful Portal API. The ThreatDefence SIEM platform uses this API to make authenticated HTTP requests that retrieve audit records, including file executions, network connections, policy decisions, and threat detections.

---

Prerequisites

• The integration assumes access to a ThreatLocker Portal account with API access enabled.

---

Steps

Step 1. Create API Token

• In the ThreatLocker Portal, navigate to Administrators and select the API Users tab.

• Click New API User, enter a descriptive API Token Name, then click Generate API Token and copy the token immediately (it is only shown once).

• Choose an API Token Expiration period.

• Under Roles/Permissions, select a Role that includes View Unified Audit and the target Organization, then click the + button. Repeat for each Organization to be monitored.

• Click Create.

For information on creating API users and roles, refer to the ThreatLocker documentation

Permissions needed: View Unified Audit

---

Step 2. Find the ThreatLocker domain

The domain is region-specific. Use the regional Portal API domain that matches the instance hosting your ThreatLocker organization (for example, portalapi.au1.threatlocker.com). If you are unsure of your region, confirm it with ThreatLocker support or check the address bar when signed in to the ThreatLocker Portal.

• if unsure, check the address bar when signed in to the ThreatLocker Portal, or confirm with ThreatLocker support.

---

Onboarding the integration

Please follow the Managing Integrations instructions and onboard the integration. The above saved credentailas are required in this process.

---

If encountered difficulties with onboarding, please email the following credentials to [e-mail]

• ThreatLocker Domain

• API Key