ThreatLocker Applications
applicationsManage ThreatLocker software allow/deny rules by searching, creating, updating, and deleting app definitions via hash, path, certificate, or research.
Instructions
Search, inspect, create, update, and delete ThreatLocker applications.
Applications are collections of file rules (hashes, paths, certificates) that define what software is allowed or denied. ThreatLocker comes with built-in applications for common software, and you can create custom ones.
Common workflows:
Find an application by name: action=search, searchText="Chrome"
Find apps by file hash: action=search, searchBy=hash, searchText="abc123..."
Find apps by certificate: action=search, searchBy=cert, searchText="Microsoft"
Get ThreatLocker research on an app: action=research, applicationId="..."
List files in an application: action=files, applicationId="..."
Find apps actively permitted: action=search, permittedApplications=true
Find recently created custom apps: action=search, category=1, orderBy=date-created
Find matching apps by file properties: action=match, hash="...", path="...", cert="..."
Get apps for maintenance mode: action=get_for_maintenance
Get app for network policy: action=get_for_network_policy, applicationId="..."
Create custom application: action=create, name="My App", osType=1
Update application metadata: action=update, applicationId="...", name="...", osType=1
Manage a child org's app: add managedOrganizationId="child-org-guid" to create/update
Add file rules to application: action=add_file, applicationId="...", osType=1, fileRules=[{hash:"..."}, {fullPath:"...", cert:"..."}]
Remove file rules from application: action=remove_file, applicationId="...", applicationFileIds=[7111524894, 7111524907] (get IDs via action=files)
Delete application (no policies): action=delete, applications=[{applicationId:"...", name:"...", organizationId:"...", osType:1}]
Force delete (with policies): action=delete_confirm, applications=[...]
Pitfalls:
Hash-only file rules must contain only the hash (no path/cert); file paths need double-escaped backslashes in JSON.
create makes metadata only — add file rules in a follow-up add_file call; then build a policy and deploy it.
remove_file needs applicationFileId values from action=files first.
Built-in applications take policy precedence over custom apps.
Permissions: Edit Application Control Applications. Pagination: search and files actions are paginated (use fetchAllPages=true to auto-fetch all pages). Key response fields: applicationId, name, osType, computerCount, policyCount. Research fields: concernRating, reviewRating, categories, countriesWhereCodeCompiled.
Related tools: policies (see policies using this app), action_log (see app activity), approval_requests (pending approvals for this app)
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| cert | No | Certificate subject for match action | |
| hash | No | SHA256 hash for match action | |
| name | No | Application name (required for create, update) | |
| path | No | Full file path for match action | |
| action | Yes | search=find applications, get=details by ID, research=ThreatLocker security analysis, files=list file rules in app, match=find apps by file hash/cert/path, get_for_maintenance=apps for maintenance mode, get_for_network_policy=app for network policy, options=application dropdown/lookup for an org, create=create custom application (metadata only), update=update app name/description, add_file=add file rules to application, remove_file=remove file rules by ID, delete=delete applications (no policies), delete_confirm=force delete (with policies) | |
| osType | No | OS type: 0=All, 1=Windows, 2=macOS, 3=Linux, 5=Windows XP | |
| certSha | No | Certificate SHA for match action | |
| orderBy | No | Field to sort by (default: name) | |
| category | No | Category: 0=All, 1=My Applications (Custom), 2=Built-In | |
| hostName | No | options: filter by hostname context. | |
| isHidden | No | Include hidden/temporary applications (default: false) | |
| pageSize | No | Results per page (default: 25, max: 500) | |
| searchBy | No | Field to search by (default: app) | |
| countries | No | ISO country codes to filter by (use with searchBy=countries) | |
| createdBy | No | Created by path for match action | |
| fileRules | No | File rules for add_file action. Each defines a matching condition (hash, path, cert, etc.). Processed via two-step prepare+insert API. | |
| validCert | No | Whether the cert supplied for match is valid/trusted (default: true) | |
| pageNumber | No | Page number (default: 1) | |
| searchText | No | Search text for search and files actions | |
| appliesToId | No | options: scope to a computer/group/org GUID. | |
| description | No | Application description | |
| isAscending | No | Sort ascending (default: true) | |
| processPath | No | Process path for match action | |
| applications | No | Applications to delete (required for delete/delete_confirm). Get details via get action first. | |
| applicationId | No | Application GUID (required for get, research, files, get_for_network_policy). Find via search action first. | |
| fetchAllPages | No | Fetch all pages automatically (max 10 pages). Default: false (single page). | |
| onlyPermitted | No | options: only return applications with active permit policies (default false). | |
| includeBuiltIn | No | options: include ThreatLocker built-in applications (default false). | |
| organizationId | No | options: organization GUID to list application options for (required). | |
| response_format | No | Output format: markdown (default, human-readable) or json (structured) | markdown |
| applicationFileIds | No | File rule IDs to remove (required for remove_file). Get IDs via action=files first. | |
| managedOrganizationId | No | Parent-org GUID to manage a child organization's applications (sets the ManagedOrganizationId/OverrideManagedOrganizationId headers for create/update). Find via organizations. | |
| permittedApplications | No | Only show apps with active permit policies (default: false) | |
| includeChildOrganizations | No | Include child organization applications (default: false) |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| data | No | Response data — shape varies by action | |
| error | No | ||
| success | Yes | ||
| pagination | No |