ThreatLocker

Overview

The ThreatLocker integration lets Bumblebee read from the ThreatLocker Zero Trust endpoint protection platform. It is built for client reporting: which devices are protected and checking in, what ThreatLocker permitted or blocked for a client, what approval requests are waiting, and the reports ThreatLocker's own portal can generate.

The integration is read-only. It never approves requests, changes policies, or disables protection.

Research preview. This integration was built from ThreatLocker's public API specification without a live tenant. If a tool returns unexpected data, please let us know.

Prerequisites & Setup

Before setting up the ThreatLocker integration, you need:

• A ThreatLocker Portal login with permission to manage API Users
• Your instance letter — the letter in your portal URL (portal.g.threatlocker.com → g)
• An API User token with view-only roles
• Your organization ID (a GUID)

Create an API User

1. In the ThreatLocker Portal, go to Manage → Users → API Users and select New API User
2. Name it (for example Bumblebee reporting)
3. Add view-only roles: View Computers, View Organizations, View Unified Audit, View Reports, View System Audit, View Approval Requests. Leave the organization field blank so the roles apply across all your client organizations
4. Choose an expiration, accept the EULA, and select Generate API Token
5. Copy the token now — it is only shown while the panel is open

Find your organization ID

1. Go to Manage → Organizations
2. Open the settings icon on your own (top-level) organization and copy its Organization ID

Configure in Bumblebee

1. Go to Integrations
2. Select ThreatLocker
3. Enter your Instance, API User Token, and Organization ID
4. Save the configuration
5. Run a test request (for example, list organizations) from the validation card

How organizations work

ThreatLocker scopes every request to one organization. Your clients are child organizations of your own. Bumblebee stores your organization ID as the default, lists your clients from the API, and reports on whichever client you name. One connection covers your whole client book.

If a client is missing, the API User's roles most likely do not cover that organization.

Available Tools

All tools are read-only. Every tool accepts an optional organization_id to scope it to one client.

Finding a client

• list_organizations — The organizations your token can reach. Call this first to resolve a client name to its organization ID.

Devices

• list_computers — Device inventory with group, protection mode, last check-in, agent version, install date, and the count of denies in the last three days. Can span all child organizations in one call.
• get_computer — One device's full record.
• list_online_devices — Devices currently online.
• list_computer_checkins — A device's check-in history.

Activity (Unified Audit)

• list_action_logs — What ThreatLocker permitted, denied, or ringfenced in a date range, filterable by action, action type (execute, network, elevate, ...), hostname, user, and path. Unified Audit is retained for 31 days by default, so keep date ranges inside that window.

Approval requests

• list_approval_requests — Requests from end users to run or install something, filterable by status.
• get_approval_request_count — Pending count, optionally across all clients.

Portal reports

• list_reports — The reports ThreatLocker can generate for an organization, with the inputs each one needs.
• get_report_data — Run one of those reports for a date range.

Admin activity

• list_system_audit_logs — Who did what in the portal (logins, policy edits, approvals). Retained indefinitely.

Example questions

• "Which clients do we have in ThreatLocker?"
• "List Acme's devices that haven't checked in for more than 7 days."
• "How many executions did ThreatLocker block for Acme in the last 30 days, and on which machines?"
• "What approval requests are pending across all our clients?"
• "Which ThreatLocker reports are available for Acme, and run the monthly summary for August."
• "Who logged in to the portal for Acme last month?"

Notes

• Research preview. This integration is read-only and was built from ThreatLocker's public API specification without a live tenant, so response shapes are not yet confirmed against a real portal. Tell us if a tool returns something unexpected.
• Read-only. The integration exposes none of the ThreatLocker API's write operations.
• Retention. Unified Audit keeps 31 days by default (extended retention is a paid ThreatLocker option); System Audit is kept indefinitely.
• Token expiry. If the API User was created with an inactivity expiry, a token that goes unused for that many days stops working and must be regenerated.