ThreatLocker Policy Push review & push permit rules

API key: checking… Session: checking… Settings DRY RUN

Sign in

ThreatLocker Policy Push

Username Password

API Key (token auth)

A persistent API User token pulls audit data without a browser session — no more session-expiry. This is the preferred auth once confirmed working.

Portal → Administrators → API Users → create/copy a token.
Paste the raw key below (no Bearer prefix).
Save — pulls will prefer token auth; session stays as fallback.

API User token

Update Session Auth

Browser session tokens expire at each logout. Paste fresh values from DevTools below.

Log into portal.threatlocker.com in your browser.
Press F12 → Network tab.
Navigate to Unified Audit and let some data load.
Find a request to ActionLogGetByParametersV2 → click Headers.
Copy the Authorization and Cookie values below.

Authorization header Cookie header User-Agent (optional)

CSV: Org:

0groups to push 0rules selected 0 of 0reviewed 0auto-skipped

Pull audit from API

Pulls deny records directly from ThreatLocker using the same filters you'd set in the portal's Unified Audit. Writes a CSV in the project folder and auto-loads it.

Preset

Selecting a preset fills the fields below; you can still tweak before pulling.

Organization

Partial-match search by org name.

Start date End date

Action type Group by

The policy-push pipeline dedupes by file + cert + process client-side, so server-side grouping is usually unnecessary.

Remove white noise (onlyTrueDenies)

Policy name does NOT contain

Case-insensitive substring filter.

Full path does NOT contain

Case-insensitive substring filter.

Loading plans...

Background pulls

Drop your CSV here

Sign in

API Key (token auth)

Update Session Auth

Pull audit from API

Background pulls

Push progress