Detect and MDR alerts
See ThreatLocker Detect threats, the ones Cyber Hero MDR triages, as alerts in RevoSecure, with the detections behind them.
Updated
On this page
When ThreatLocker Detect flags a computer or a Microsoft 365 account, it lands on the Threats tab of ThreatLocker's Response Center. That's the list Cyber Hero MDR works from, and the source of MDR's emails ("This email is in regard to a Response Center alert…"). Revo reads that list every five minutes, so the same threats show up in Alerts next to everything else you monitor for the customer.
What you see
Each threatened computer or account is one alert:
| Alert | What it covers | Severity |
|---|---|---|
| ThreatLocker Detect threat | A computer: malware Defender detected, someone trying to stop ThreatLocker, a renamed command prompt, remote desktop from the internet… | ThreatLocker's: Severe shows as high, Warning as medium, Information as low |
| ThreatLocker Cloud Detect threat | A Microsoft 365 account: a changed sign-in method, blocked or failed sign-ins, malware in OneDrive… | The same |
Open one to see the ThreatLocker alerts behind it, newest first:
- the Detect policy (for example TL.EV.108 - Detection of Malware (Defender)), when it fired and how often;
- for computers, the Windows event behind it, such as Defender's full detection message with the threat name, file path and process;
- for Microsoft 365 accounts, the activity (what happened, the result, the IP address);
- the MITRE ATT&CK techniques, linked to MITRE's site;
- MDR monitored when Cyber Hero MDR watches that policy.
If the computer has RevoAgent, the alert links to the device. That needs exactly one of the customer's devices to have the computer's name.
When a threat is cleared
ThreatLocker only shares active threats. When MDR or your team clears one in ThreatLocker, the RevoSecure alert resolves on its own, with the reason Cleared in ThreatLocker. It stays in the list (filter by Resolved) so you can still find it later. A new alert on the same computer or account reopens it.
Set up
Nothing extra to switch on: it works once ThreatLocker is connected and its organizations are mapped to customers. The Revo API user needs permission to view Endpoint and Cloud Detect threats. Settings → ThreatLocker shows when threats were last checked, how many are active, and any error, such as a missing permission.
- Threats in ThreatLocker organizations that aren't mapped to a customer are counted on that page but not imported.
- The first check after connecting imports existing threats without sending notifications, since some may be months old. After that, new high-severity threats notify like any other alert, if you've turned notifications on.
Revo only reads. Isolating or locking down a computer, clearing alerts and adding exclusions stay in ThreatLocker. Use Open ThreatLocker on the alert and go to Response Center → Threats.