ThreatLocker Device Configuration

TABLE OF CONTENTS

• Overview
• Prerequisites
• Generate ThreatLocker API Credentials
• Locate your ThreatLocker instance
• Configure ThreatLocker in ADR SIEM
• Verification (MSSP Only)

Overview

This document provides step-by-step instructions to integrate ThreatLocker with ADR SIEM (aiSIEM/aiXDR) using API credentials. Once configured, ThreatLocker logs and telemetry will be forwarded from the CCE (Collection and Control Engine) to the APE (Analytics and Policy Engine), enabling centralized visibility, policy enforcement monitoring, and proactive threat detection.

Prerequisites

Before beginning integration, ensure:

• Access to the ThreatLocker Console with permission to create API users.

• Administrative access to the ADR SIEM UI and CCE server.

• Firewall rules allowing outbound HTTPS (443) from CCE to ThreatLocker API.

Generate ThreatLocker API Credentials

1. Log in to the ThreatLocker Console.

2. Navigate to: Administrators → API Users.

3. Click Create New User.

4. Name the token appropriately (e.g., ADR-Integration).

5. Click Generate API Token → copy the token immediately.
   Note: The token will only be shown once. Store it securely.

6. Set token expiry (recommended: 365 days).

7. Assign a role to the API user. If needed, create a new role with at least the following permissions:

   • View Organization

   • View Computers

   • View Reports

   • View System Audit

   • View ThreatLocker Threats

   • View ThreatLocker Policies

   • View ThreatLocker Remediations

   • View Unified Audit

8. Select the Organizations the API user should have access to.

9. Click Create.

Locate your ThreatLocker instance

In your ThreatLocker portal, click the Help button at the top right. Your instance appears in parentheses next to the "ThreatLocker Access" text.

The instance is usually a single letter, such as B, C, G, or H. Note it down and enter it in the Config (JSON) field when configuring ThreatLocker in ADR SIEM, for example: {"instance":"H"}

Configure ThreatLocker in ADR SIEM

1. Log in to ADR SIEM UI with admin rights.

2. Navigate to: Administration → Add-on Store → ThreatLocker → Add.

3. Fill in details:

Example JSON:

{"instance":"H"}

Verification (MSSP Only)

On ADR SIEM UI

1. Navigate: System → Logs and Flows Collection Status.

2. Confirm ThreatLocker appears under Source Device IP.

3. Verify logs are being ingested and parsed correctly.

On ADR CCE (CLI)

Run:

otmdoc -s addondevices
crontab -l

Attachments (1)

threatlocker_instance.png
73.6 KB