ThreatLocker Reports
reportsList available queries and fetch aggregated security data from ThreatLocker. Run pre-built or custom views to support compliance, audits, and external analysis.
Instructions
Query and run ThreatLocker reports.
Access pre-built and custom reports configured in the ThreatLocker portal. Reports provide aggregated views of security data across your organization.
Common workflows:
List all available reports: action=list
Run a specific report: action=get_data, reportId="..." (get IDs from list action first)
Review security posture: list reports, then run relevant compliance or audit reports
Export data for external analysis: run a report and process the returned data
Permissions: View Reports. Key response fields: reportId, name, description, reportData (dynamic columns per report type).
Related tools: action_log (raw audit events), system_audit (portal audit trail), computers (device inventory)
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| action | Yes | list=show available reports, get_data=run report and get results | |
| endDate | No | End of the report window (ISO 8601 UTC). | |
| reportId | No | Report GUID (required for get_data action). Find via list action first. | |
| startDate | No | Start of the report window (ISO 8601 UTC). Omit to use the report default window. | |
| fetchAllPages | No | Fetch all pages automatically (max 10 pages). Default: false (single page). | |
| offsetInMinutes | No | Timezone offset in minutes for date bucketing (e.g. -300 for UTC-5). Default: 0 (UTC). | |
| response_format | No | Output format: markdown (default, human-readable) or json (structured) | markdown |
| includeChildOrganizations | No | Include child organizations in the report (default: false) |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| data | No | Response data — shape varies by action | |
| error | No | ||
| success | Yes | ||
| pagination | No |