ThreatLocker Tags
tagsQuery and manage reusable network labels used to simplify policy creation. List labels, retrieve details by ID, or replace label membership for Network Control, Ringfencing, and Storage Control.
Instructions
Query ThreatLocker tags for network and policy management.
Tags are reusable labels for IP addresses, domains, ports, or other network identifiers. They simplify policy management by letting you reference "CRM Servers" instead of listing individual IPs.
Common workflows:
List all available tags: action=dropdown
Include ThreatLocker built-in tags: action=dropdown, includeBuiltIns=true
Get tag details by ID: action=get, tagId="..."
Update tag membership: action=update, tagId="...", organizationId="..." (full-object replace — get first, resend ALL item arrays you want to keep; there is no insert/delete endpoint)
Tags are used in:
Network Control policies (allow/deny traffic to tagged destinations)
Ringfencing (restrict app network access to tagged resources)
Storage Control (restrict file access to tagged paths)
Parent organization tags appear as "parentOrgName\tagName" format.
Pitfalls:
Use dropdown to get the label+value (tagId) needed when building network/ringfence policy payloads.
Parent-organization tags use the "ParentOrg\TagName" format.
Permissions: Edit Network Control Policies, Manage Tags, Edit Application Control Policies. Key response fields: tagId, name, tagType, values (IP/domain/port entries).
Related tools: policies (use tags in policy rules), applications (ringfence with tags)
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| name | No | Tag name (update). | |
| tagId | No | Tag GUID (required for get, update). Find via dropdown action first. | |
| action | Yes | get=single tag details, dropdown=list all available tags for selection, update=replace a tag's membership (full-object replace — get first, resend all items) | |
| active | No | Whether the tag is active (update; default true). | |
| tagType | No | Tag type filter: 1=Network tags (default) | |
| allTagItems | No | update: optional flattened tag-item view (round-trip from get). | |
| tagItemsIPv4 | No | update: IPv4 entries {label,value}. Full replace. | |
| tagItemsIPv6 | No | update: IPv6 entries {label,value}. Full replace. | |
| tagItemsText | No | update: text/domain entries {label,value}. Full replace. | |
| fetchAllPages | No | Fetch all pages automatically (max 10 pages). Default: false (single page). | |
| organizationId | No | Organization GUID that owns the tag (required for update). | |
| includeBuiltIns | No | Include ThreatLocker built-in tags (default: false) | |
| response_format | No | Output format: markdown (default, human-readable) or json (structured) | markdown |
| tagItemsReadablePath | No | update: readable-path entries {label,value}. Use \\ in path values. Full replace. | |
| tagItemsWritablePath | No | update: writable-path entries {label,value}. Use \\ in path values. Full replace. | |
| includeNetworkTagInMaster | No | Include network tags in master (default: true) |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| data | No | Response data — shape varies by action | |
| error | No | ||
| success | Yes | ||
| pagination | No |