ThreatLocker Action Log
action_logQuery ThreatLocker unified audit logs to investigate endpoint events such as denies, network blocks, and PowerShell executions. Filter by date, hostname, or action type to pinpoint root causes.
Instructions
Query ThreatLocker unified audit logs.
The action log records all application control events: permits, denies, network access, file operations, PowerShell execution, elevation requests, and more. This is your primary tool for investigating what happened on endpoints.
Common workflows:
Find all denies in last 24 hours: action=search, startDate="...", endDate="...", actionId=99
Find denies on a specific computer: action=search, ..., hostname="COMPUTER-NAME"
Find network blocks: action=search, ..., actionType=network, actionId=2
Find PowerShell executions: action=search, ..., actionType=powershell
Get details of a specific event: action=get, actionLogId="..."
Track a file's history across all computers: action=file_history, fullPath="C:\path\to\file.exe"
Aggregate by user to find who's triggering denies: action=search, ..., groupBys=[1]
Get file download details: action=get_file_download, actionLogId="..."
Get policy conditions for permit: action=get_policy_conditions, actionLogId="..."
Get testing environment details: action=get_testing_details, actionLogId="..."
Pitfalls:
onlyTrueDenies/simulateDeny only filter when used alone or together; they force actionId=99 internally. "True" deny = enforced block; "simulated" = would-have-blocked on a Monitor/Learning computer.
When calling get/get_file_download, pass the sourceTableId matching the row the eActionLogId came from (default 2=DenyActionLog will miss permit/baseline/eventlog events).
groupBys takes at most 2 fields; prefer it over fetching raw rows for aggregation.
username/deviceType are NOT supported search filters here (the V2 endpoint ignores them); pivot on hostname/fullPath/policyId or use groupBys=[1] to break down by user.
Permissions: View Unified Audit. Pagination: search action is paginated (use fetchAllPages=true to auto-fetch all pages). Performance: always use date filters — queries without startDate/endDate can be very slow on large organizations. Use groupBys to aggregate instead of fetching all raw rows. Key response fields: actionLogId, fullPath, processPath, hostname, username, actionType, policyName, applicationName.
Related tools: computers (find computer IDs), applications (identify apps), approval_requests (handle denied software)
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| action | Yes | search=query logs with filters, get=single event details, file_history=all events for a file path, get_file_download=file download info, get_policy_conditions=policy conditions for permit, get_testing_details=testing environment details, build_search_string=produce the opaque saveParameters string for saved_searches.insert (same filters as search) | |
| endDate | No | End date for search (ISO 8601 UTC) | |
| actionId | No | Filter by action: 1=Permit, 2=Deny, 3=Deny (Option to Request), 6=Ringfenced, 99=Any Deny | |
| fullPath | No | File path for search filter or file_history (wildcards supported) | |
| groupBys | No | Aggregate results by up to 2 fields. Common: 1=Username, 2=Process Path, 5=Policy Id, 6=Policy Name, 7=App Id, 8=App Name, 9=Action Type, 11=Hash, 17=Asset Name, 65=Computer Id, 70=Risk Score, 71=Risk State. See threatlocker://enums and the unified-audit KB for the full ~55-code list. | |
| hostname | No | Filter by hostname for search or file_history (wildcards supported) | |
| pageSize | No | Results per page (default: 25, max: 500) | |
| policyId | No | Filter search by the GUID of the policy that handled the event. Find via policies first. | |
| startDate | No | Start date for search (ISO 8601 UTC) | |
| actionType | No | Filter by a single action type | |
| computerId | No | Computer GUID to scope file_history. Find via computers list first. | |
| pageNumber | No | Page number (default: 1) | |
| actionLogId | No | Action log GUID (required for get, get_file_download, get_policy_conditions, get_testing_details). Find via search action first. | |
| actionTypes | No | Filter by multiple action types in one query | |
| simulateDeny | No | Include what-if denies from Monitor Only mode computers (default: false) | |
| fetchAllPages | No | Fetch all pages automatically (max 10 pages). Default: false (single page). | |
| getAllParents | No | On get: include the full parent-process chain for the event (default: false) | |
| sourceTableId | No | Source table for get/get_file_download: 1=ActionLog, 2=DenyActionLog (default), 3=BaselineActionLog, 4=EventLogActionLog. Must match the source table of the row the eActionLogId came from. | |
| onlyTrueDenies | No | Show only real enforced blocks, excluding simulated denies from Monitor Only mode (default: false) | |
| response_format | No | Output format: markdown (default, human-readable) or json (structured) | markdown |
| showKnownThreatsOnly | No | Restrict search to events flagged as known threats (default: false) | |
| showChildOrganizations | No | Include child organization logs (default: false) |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| data | No | Response data — shape varies by action | |
| error | No | ||
| success | Yes | ||
| pagination | No |