threatlocker

Plugin threatlocker from marketplace msp-claude-plugins in WYRE-AI/msp-claude-plugins. Commands read from the repo's manifest — yesterday.

Skills (6)

• ThreatLocker API Patterns

  ThreatLocker Portal API fundamentals: raw-key authentication (no Bearer prefix), multi-tenant routing via the organizationId header, POST-based "GetByParameters" list endpoints, pagination shape, and child-organization fan-out patterns. When working with ThreatLocker auth headers, multi-tenant reque

• ThreatLocker Approval Requests

  ThreatLocker application approval request triage: pulling the pending queue, grouping requests by application and hash, signed-publisher and path heuristics, and approve/deny recommendations with audit-friendly reasoning. When triaging pending application approvals, evaluating signer/path heuristics

• ThreatLocker Audit Log

  The ThreatLocker Action Log (the API name is "audit"): incident timelines, tracing a file's history across endpoints, repeated-denial detection, and correlating policy bypasses or audit-only matches with user and computer context. When investigating a security event timeline, tracing a file path or

• ThreatLocker Computer Groups

  ThreatLocker computer groups — the policy-scoping boundary that determines which allow/deny rules apply to which endpoints. Covers listing groups, mapping a computer to its group, and the difference between the dropdown and full list endpoints. When scoping policies, mapping computers to groups, cho

• ThreatLocker Computers

  ThreatLocker-protected endpoints: fleet inventory, identifying offline agents, a single computer's check-in history, and correlating computers across organizations and groups. When listing, inspecting, or auditing ThreatLocker computers across one or many organizations, including offline-agent triag

• ThreatLocker Organizations

  The ThreatLocker MSP multi-tenant model: enumerating child organizations, retrieving per-org auth keys, and identifying valid move targets when relocating computers between tenants. When fanning out reports across child orgs, retrieving an org's auth key, or moving computers between organizations. U

Slash commands (5)

• /threatlocker:approval-triage

  Triage pending ThreatLocker approval requests with approve/deny recommendations

• /threatlocker:audit-investigation

  Build a timeline of ThreatLocker audit events around a security incident

• /threatlocker:computer-inventory

  Generate a ThreatLocker computer inventory report

• /threatlocker:offline-agents

  Find ThreatLocker agents that have not checked in recently

• /threatlocker:tenant-overview

  Multi-tenant ThreatLocker overview across child organizations

Subagents (3)

• approval-triage-analyst

  Use this agent when reviewing the ThreatLocker pending approval queue, classifying application requests as high-confidence vs needs-review, recommending approve/deny decisions with documented reasoning, and escalating suspicious patterns. Trigger for: review approvals, pending approvals, ThreatLocke

• fleet-health-auditor

  Use this agent when producing ThreatLocker fleet inventory and hygiene reports — computer inventory by OS or group, offline-agent identification with check-in age tiering, computer-group hygiene analysis (orphans, oversized groups, OS-mismatched assignments), and multi-tenant pivots across child org

• threat-investigator

  Use this agent when investigating a ThreatLocker security event — reconstructing a timeline around a host/user/file, tracing a file's history across the fleet, identifying repeated denials, and surfacing policy bypasses or audit-only matches that warrant new policy rules. Trigger for: investigate, w

MCP servers (1)

• threatlocker

  connects to: https://conduit.wyre.ai/v1/threatlocker/mcp

Similar plugins