Connect ThreatLocker
Connect ThreatLocker read-only, map organizations to customers, and see each computer's ThreatLocker mode in Revo.
Updated
On this page
Revo's ThreatLocker integration is read-only. It reads your ThreatLocker organizations, computers, pending approval requests and Detect threats. It never changes ThreatLocker policy, approves requests or touches protection.
What you get
- ThreatLocker Detect and Cyber Hero MDR threats as alerts, checked every five minutes, with the detections behind them (see Detect and MDR alerts).
- Each device's ThreatLocker mode on its page and in the device list, confirmed from ThreatLocker itself, not just from installed software.
- Alerts for computers left in Learning mode for more than 14 days, and for approval requests waiting more than 24 hours (see Alerts).
- A summary per customer: computers by mode, offline computers (no check-in for 7 days), the approval backlog and coverage: devices with RevoAgent but no ThreatLocker computer of the same name.
- Blocked agent updates: pending approval requests that match a published RevoAgent release (see Allowlist RevoAgent).
- The Application control column in the Home health grid.
1. Create a view-only API user
- In ThreatLocker, create a dedicated API user for Revo, for example "Revo (read-only)".
- Give it a role that can only view organizations, computers, approval requests and Endpoint and Cloud Detect threats.
- Don't grant permission to approve requests, change policies, change maintenance mode, isolate or lock down computers, or disable protection.
A view-only user means that even a leaked key can't change your ThreatLocker configuration.
2. Connect
- Open Settings → ThreatLocker (also linked from Settings → Integrations). Owners and admins only.
- Enter the API key, your API instance URL (for example
https://portalapi.b.threatlocker.com) and your parent organization ID. - Save. Revo tests the connection before saving.
Only https://portalapi.<instance>.threatlocker.com addresses are accepted. The key is encrypted at rest and never
shown again.
3. Map organizations to customers
Map each ThreatLocker child organization to its Revo customer. Names that match are suggested. Each ThreatLocker organization can be mapped to only one customer. Then choose Sync now. Computers sync every hour after that.
Modes
| Mode | Shown as | Meaning |
|---|---|---|
| Secured | Green | Application control is enforcing |
| Learning | Amber | Everything that runs is allowed and learned; the computer isn't protected |
| Installation | Amber | Temporarily allowing installs |
| Monitor | Amber | Logging only, nothing blocked |
A computer in Learning mode for more than 14 days raises an alert. If ThreatLocker doesn't report when the mode started, Revo counts from when it first synced the computer in that mode.
ThreatLocker and endpoint protection
By default, default-deny application allowlisting such as ThreatLocker counts as endpoint protection on Windows devices. This is a workspace switch in Settings → Endpoint policy, and a customer's ideal state can override it. Defender running alongside ThreatLocker is reported as protected with both products listed.
Limits
- Up to 20,000 computers per organization.
- Agent-update matching reads the newest 500 pending approval requests.
- Blocked-execution counts from ThreatLocker's action log aren't read yet.
Disconnect
Disconnecting in Settings → ThreatLocker removes the key and mappings. Configuration, mapping, sync and disconnect actions are recorded in the audit log.