threatlocker

Triage pending ThreatLocker approval requests with approve/deny recommendations

Build a timeline of ThreatLocker audit events around a security incident

Generate a ThreatLocker computer inventory report

Find ThreatLocker agents that have not checked in recently

Multi-tenant ThreatLocker overview across child organizations

Use this agent when reviewing the ThreatLocker pending approval queue, classifying application requests as high-confidence vs needs-review, recommending approve/deny decisions with documented reasoning, and escalating suspicious patterns. Trigger for: review approvals, pending approvals, ThreatLocker triage, approve application, deny application, ThreatLocker queue, application request review, allowlist request, permit application. Examples: "Review the ThreatLocker approval queue and tell me what's safe to approve", "How many pending approvals do we have across all clients?", "Triage today's ThreatLocker requests and flag anything suspicious", "What's blocking on hash 8a3f...? — should we approve it?"

Use this agent when producing ThreatLocker fleet inventory and hygiene reports — computer inventory by OS or group, offline-agent identification with check-in age tiering, computer-group hygiene analysis (orphans, oversized groups, OS-mismatched assignments), and multi-tenant pivots across child organizations. Trigger for: fleet report, offline agents, computer inventory, ThreatLocker hygiene, ThreatLocker coverage, agent count by org, stale endpoints, group audit, ThreatLocker fleet health. Examples: "Generate a ThreatLocker fleet health report", "Which agents haven't checked in for over 7 days?", "Show me the computer inventory broken down by OS and organization", "Audit our computer groups for orphans and oversized groups"

Use this agent when investigating a ThreatLocker security event — reconstructing a timeline around a host/user/file, tracing a file's history across the fleet, identifying repeated denials, and surfacing policy bypasses or audit-only matches that warrant new policy rules. Trigger for: investigate, what happened on, audit logs around, ThreatLocker timeline, ThreatLocker forensics, ThreatLocker incident, suspicious activity, repeated denials, file history, policy bypass, IOC search ThreatLocker. Examples: "Investigate what happened on WS-042 around 2pm yesterday", "Trace the history of this file hash across the fleet", "We're seeing repeated blocks from user j.doe — what's going on?", "Show me everywhere this binary appeared in the action log"

Use this skill when working with the ThreatLocker MCP tools — raw-key authentication (NO Bearer prefix), multi-tenant routing via organizationId header, POST-heavy "GetByParameters" endpoints, pagination shape, and child-organization fan-out patterns.

Use this skill when triaging ThreatLocker application approval requests — the heart of day-to-day ThreatLocker operations. Covers pulling the pending queue, grouping requests by application/hash, applying signed-publisher heuristics, and recommending approve/deny decisions with audit-friendly reasoning.

Use this skill when investigating events in the ThreatLocker Action Log (the API name is "audit") — building incident timelines, tracing a file's history across endpoints, identifying repeated denials, and correlating policy bypasses or audit-only matches with user/computer context.

Use this skill when working with ThreatLocker computer groups — the policy-scoping boundary that determines which allow/deny rules apply to which endpoints. Covers listing groups, mapping computer to group, and the difference between the dropdown and full list endpoints.

Use this skill when working with ThreatLocker-protected endpoints — fleet inventory, identifying offline agents, drilling into a single computer's check-in history, and correlating computers across organizations and groups.