> For the complete documentation index, see [llms.txt](https://docs.threatdefence.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.threatdefence.com/siem-integrations/endpoint-protection/threatlocker.md). # ThreatLocker ThreatLocker is an endpoint protection platform providing application allowlisting, ringfencing, storage control, and network control to prevent untrusted software from executing. This guide provides instructions for integrating the ThreatLocker Portal API into the ThreatDefence SIEM platform, enabling ThreatLocker Unified Audit events to be ingested, normalized, and converted into SIEM events. ThreatLocker provides access to its action log (unified audit) data through a RESTful Portal API. The ThreatDefence SIEM platform uses this API to make authenticated HTTP requests that retrieve audit records, including file executions, network connections, policy decisions, and threat detections. *** ## Prerequisites * The integration assumes access to a ThreatLocker Portal account with API access enabled. *** ## Steps ### Step 1. Create API Token * In the ThreatLocker Portal, navigate to Administrators and select the API Users tab. * Click New API User, enter a descriptive API Token Name, then click Generate API Token and copy the token immediately (it is only shown once). * Choose an API Token Expiration period. * Under Roles/Permissions, select a Role that includes `View Unified Audit` and the target Organization, then click the + button. Repeat for each Organization to be monitored. * Click Create. For information on creating API users and roles, refer to the [ThreatLocker documentation](https://threatlocker.kb.help/api-users/) Permissions needed: `View Unified Audit` *** ### Step 2. Find the ThreatLocker domain The domain is region-specific. Use the regional Portal API domain that matches the instance hosting your ThreatLocker organization (for example, `portalapi.au1.threatlocker.com`). If you are unsure of your region, confirm it with ThreatLocker support or check the address bar when signed in to the ThreatLocker Portal. * if unsure, check the address bar when signed in to the ThreatLocker Portal, or confirm with ThreatLocker support. *** #### Onboarding the integration Please follow the [Managing Integrations](/platform-management/managing-integrations.md) instructions and onboard the integration. The above saved credentailas are required in this process. *** If encountered difficulties with onboarding, please email the following credentials to * ThreatLocker Domain * API Key --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.threatdefence.com/siem-integrations/endpoint-protection/threatlocker.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.