All integrations
Security
ThreatLocker integration
Counts how many client computers are fully protected (Secured) and how many are still learning. View-only.
Setup steps are for connected customers — sign in to read them.
What we find in ThreatLocker
Application-allowlisting coverage by mode (Secured vs. Learning/Installation) — surfaces endpoints stuck onboarding past 90 days.
Every finding lands on your Client Upsell board as a named client with a number beside it — not a report you have to read.
What the ThreatLocker connection does
Read — powers Client Upsell
Read your clients' stack
Who is actually protected: endpoints still onboarding, seats never deployed, sites with no filtering policy.
Read-only
We only ever read — we never change anything in ThreatLocker
You make a view-only key using our setup steps. Our connection has no code that can write to ThreatLocker, and your key is encrypted and only used to read.
ThreatLocker integration — common questions
- What does the ThreatLocker integration read?
- Counts how many client computers are fully protected (Secured) and how many are still learning. View-only.
- What does MSProspector find in ThreatLocker?
- Application-allowlisting coverage by mode (Secured vs. Learning/Installation) — surfaces endpoints stuck onboarding past 90 days.
- Is the ThreatLocker connection read-only?
- Yes. We only ever read from ThreatLocker — our ThreatLocker connection has no code that can change anything, and an automated check on every change to our code blocks any that could. Please create a view-only key using the setup steps, so the key itself can't make changes either.