ThreatLocker Network Access Policies
network_access_policiesQuery and manage ThreatLocker network access control policies, defining firewall rules for endpoints to control application connections by IP, port, and domain.
Instructions
Query ThreatLocker network access control policies.
Network access policies define firewall rules for endpoints — controlling which applications can make or receive network connections, and to which destinations (IPs, ports, domains).
Common workflows:
List all network access policies: action=list
Search by name: action=list, searchText="RPC"
Filter by computer group: action=list, appliesToId="group-id"
Get policy details by ID: action=get, networkAccessPolicyId="..."
Pitfalls:
Network Control has no Global policy level (unlike application control).
Tag-based rules need the tag label + id resolved via the tags tool (dropdown); parent-org tags use the "ParentOrg\TagName" format.
direction: 1=Inbound, 2=Outbound; policyActionId: 1=Permit, 2=Deny.
Permissions: Edit Network Control Policies, View Network Control Policies. Pagination: list action is paginated (use fetchAllPages=true to auto-fetch all pages). Key response fields: networkAccessPolicyId, name, computerGroupName, isEnabled, applicationName.
Related tools: policies (application control policies), computer_groups (where policy applies), tags (network tags used in policies)
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| name | No | Policy name (required for create). | |
| ports | No | Port entries, e.g. ["20-25","3389"] (create). | |
| action | Yes | get=single policy by ID, list=search/list network access policies, create=create a network control policy (deploy afterwards) | |
| status | No | 1=Active, 3=Inactive (default: 1). | |
| allPorts | No | Match any port (create). | |
| pageSize | No | Results per page (default: 25, max: 500) | |
| protocol | No | 1=TCP, 2=UDP, 3=Both (default: 3). | |
| direction | No | 1=Inbound, 2=Outbound (required for create). | |
| allSources | No | Match any source (create). | |
| pageNumber | No | Page number (default: 1) | |
| searchText | No | Search text to filter policies | |
| appliesToId | No | Computer group GUID to filter by. Find via computer_groups first. | |
| fetchAllPages | No | Fetch all pages automatically (max 10 pages). Default: false (single page). | |
| policyActionId | No | 1=Permit, 2=Deny (required for create). | |
| allDestinations | No | Match any destination (create). | |
| computerGroupId | No | Org/group/computer GUID the policy applies to (required for create). No Global level in Network Control. | |
| response_format | No | Output format: markdown (default, human-readable) or json (structured) | markdown |
| sourceLocations | No | Source locations (create). | |
| destinationLocations | No | Destination locations (create). | |
| networkAccessPolicyId | No | Network access policy GUID (required for get). Find via list action first. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| data | No | Response data — shape varies by action | |
| error | No | ||
| success | Yes | ||
| pagination | No |