Skip to main content
Glama
Space-C0wboy

threatlocker-mcp

by Space-C0wboy

action_log_get_by_parameters_v2

Retrieve action logs from ThreatLocker by specifying source table, date range, and filters such as user, hostname, or policy. Returns paginated results with the ability to sort and group.

Instructions

Get Action Logs By Parameters. NOTE: this endpoint runs in two modes depending on the usenewsearch header. The MCP defaults to usenewsearch=true (the new search path the portal SPA uses), which is the only mode that returns data. Required: sourceTableId (1=ActionLog, 2=DenyActionLog, 3=BaselineActionLog, 4=EventLogActionLog), startDate, endDate, and paramsFieldsDto (the MCP defaults this to []; the server returns HTTP 500 when the field is absent under the new search path). Omitting sourceTableId returns HTTP 500; omitting both date forms returns 417 'Invalid Date Range'. Pass usenewsearch=null to opt out into the legacy path -- but note the legacy path returns an empty body even when data exists, so this is only useful for back-compat probing.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
bodyYesRequest body.
usenewsearchNoHeader: usenewsearchtrue
organization_idNoOverride the default organization (ManagedOrganizationId header).
override_organization_idNoOptional OverrideManagedOrganizationId header.
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It discloses the two-mode behavior, default values, error conditions, and that the legacy path returns empty. Missing info on rate limits, authentication, or side effects, but the coverage is still good.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with purpose and then details the two modes and errors. Every sentence adds value, though it is slightly verbose. It is well-structured and informative.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complexity (many parameters, nested objects, no output schema), the description covers critical operational details like mode selection, required fields, and error responses. Missing some details on pagination (pageNumber, pageSize) and authentication, but overall it is sufficiently complete for an MCP tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with descriptions for each parameter. The description adds meaningful context beyond the schema: explains the usenewsearch default, required fields, and that paramsFieldsDto defaults to []. It also highlights specific error scenarios, which aids correct tool invocation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it gets action logs by parameters, and explains the two modes (usenewsearch). However, it does not explicitly differentiate from sibling action_log_* tools like action_log_get_by_id_v2 or action_log_get_all_for_file_history_v2.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit guidance: recommends usenewsearch=true for data, lists required fields (sourceTableId, startDate, endDate, paramsFieldsDto), warns about HTTP 500 and 417 errors, and explains when to use the legacy path (only for back-compat probing).

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Install Server

Other Tools

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/Space-C0wboy/ThreatLocker-MCP'

If you have feedback or need assistance with the MCP directory API, please join our Discord server