> For the complete documentation index, see [llms.txt](https://docs.threatdefence.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.threatdefence.com/siem-integrations/endpoint-protection/threatlocker.md). # ThreatLocker ThreatLocker is an endpoint protection platform providing application allowlisting, ringfencing, storage control, and network control to prevent untrusted software from executing. This guide provides instructions for integrating the ThreatLocker Portal API into the ThreatDefence SIEM platform, enabling ThreatLocker Unified Audit events to be ingested, normalized, and converted into SIEM events. ThreatLocker provides access to its action log (unified audit) data through a RESTful Portal API. The ThreatDefence SIEM platform uses this API to make authenticated HTTP requests that retrieve audit records, including file executions, network connections, policy decisions, and threat detections. *** ## Prerequisites * The integration assumes access to a ThreatLocker Portal account with API access enabled. *** ## Steps ### Step 1. Create API Token * In the ThreatLocker Portal, navigate to Administrators and select the API Users tab. * Click New API User, enter a descriptive API Token Name, then click Generate API Token and copy the token immediately (it is only shown once). * Choose an API Token Expiration period. * Under Roles/Permissions, select a Role that includes `View Unified Audit` and the target Organization, then click the + button. Repeat for each Organization to be monitored. * Click Create. For information on creating API users and roles, refer to the [ThreatLocker documentation](https://threatlocker.kb.help/api-users/) Permissions needed: `View Unified Audit` *** ### Step 2. Find the ThreatLocker domain The domain is region-specific. Use the regional Portal API domain that matches the instance hosting your ThreatLocker organization (for example, `portalapi.au1.threatlocker.com`). If you are unsure of your region, confirm it with ThreatLocker support or check the address bar when signed in to the ThreatLocker Portal. * if unsure, check the address bar when signed in to the ThreatLocker Portal, or confirm with ThreatLocker support. *** #### Onboarding the integration Please follow the [Managing Integrations](/platform-management/managing-integrations.md) instructions and onboard the integration. The above saved credentailas are required in this process. *** If encountered difficulties with onboarding, please email the following credentials to * ThreatLocker Domain * API Key --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.threatdefence.com/siem-integrations/endpoint-protection/threatlocker.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.