action_log_get_by_parameters_v2
Retrieve action logs from ThreatLocker by specifying source table, date range, and filters such as user, hostname, or policy. Returns paginated results with the ability to sort and group.
Instructions
Get Action Logs By Parameters. NOTE: this endpoint runs in two modes depending on the usenewsearch header. The MCP defaults to usenewsearch=true (the new search path the portal SPA uses), which is the only mode that returns data. Required: sourceTableId (1=ActionLog, 2=DenyActionLog, 3=BaselineActionLog, 4=EventLogActionLog), startDate, endDate, and paramsFieldsDto (the MCP defaults this to []; the server returns HTTP 500 when the field is absent under the new search path). Omitting sourceTableId returns HTTP 500; omitting both date forms returns 417 'Invalid Date Range'. Pass usenewsearch=null to opt out into the legacy path -- but note the legacy path returns an empty body even when data exists, so this is only useful for back-compat probing.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| body | Yes | Request body. | |
| usenewsearch | No | Header: usenewsearch | true |
| organization_id | No | Override the default organization (ManagedOrganizationId header). | |
| override_organization_id | No | Optional OverrideManagedOrganizationId header. |