ThreatLocker Saved Searches
saved_searchesList, save, and delete saved Unified Audit/investigation searches for a ThreatLocker page. Reproduce search parameters with valid JSON and human-readable labels to organize audit workflows.
Instructions
Manage saved Unified Audit / investigation searches.
A saved search has two parts: searchData (the reproducible parameters, as JSON) and saveParameters (a human-readable label). saveSearchPageId selects which page the search belongs to (valid values 1-10; e.g. the Unified Audit page).
Common workflows:
List saved searches for a page: action=list, saveSearchPageId=
Save a search: action_log build_search_string (→ saveParameters label) → action=insert, saveSearchId=, saveSearchPageId=, organizationId="...", searchName="...", saveParameters="Any Deny", searchData={the search params object}
Delete a saved search: action=delete, saveSearchId="..."
Pitfalls:
searchData is REQUIRED and must be valid JSON (object or JSON string) — the API deserializes it and returns an opaque 500 if it is missing or malformed. (Verified live 2026-07-06.)
saveParameters is the display label from action_log build_search_string (e.g. "Any Deny").
saveSearchPageId must be a valid page type (1-10); 0/other values return "Page type wasn't found".
insert requires you to supply a fresh saveSearchId GUID.
Permissions: View Unified Audit.
Related tools: action_log (build_search_string produces saveParameters)
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| action | Yes | list=saved searches for a page, insert=save a new search, delete=delete a saved search | |
| datetime | No | Optional created timestamp (UTC). | |
| username | No | Optional owner username. | |
| searchData | No | REQUIRED for insert: the search parameters that make the search reproducible, as a JSON object or JSON string. The API deserializes this server-side, so it MUST be valid JSON (missing/non-JSON => opaque 500). | |
| searchName | No | Display name of the saved search (required for insert). | |
| searchCount | No | Optional usage counter. | |
| saveSearchId | No | Saved-search GUID. For insert, supply a NEW GUID; for delete, the existing one. | |
| fetchAllPages | No | Fetch all pages automatically (max 10 pages). Default: false (single page). | |
| organizationId | No | Organization GUID (required for insert). | |
| saveParameters | No | Human-readable search label from action_log build_search_string, e.g. "Any Deny" (required for insert). Round-trip verbatim. | |
| response_format | No | Output format: markdown (default, human-readable) or json (structured) | markdown |
| saveSearchPageId | No | The page/feature the saved searches belong to (required for list and insert; e.g. the Unified Audit page id). |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| data | No | Response data — shape varies by action | |
| error | No | ||
| success | Yes | ||
| pagination | No |