Integrating with ThreatLocker

Ishita Snehil
Ishita Snehil
  • Updated

Bring ThreatLocker client and device data into ScalePad to keep asset records current and support security-aware lifecycle planning.

ThreatLocker data flows into ScalePad in one direction: ThreatLocker to ScalePad. The integration is read-only.

Who can use this feature?

  • A ScalePad account with permission to manage integrations or Manage Sync permissions.

What you'll need:

  • ThreatLocker administrator or API-user access.

What the integration does

The ThreatLocker integration brings endpoint information into ScalePad. Partners can use the data to keep asset records current and show clients how well their computers are covered by ThreatLocker.

The integration supports client and hardware data and includes a ThreatLocker section for ScalePad CS Deliverables. The ThreatLocker Endpoint Coverage section reports endpoint coverage and device activity for ThreatLocker-protected computers. Policy activity and threat detections are not included.

Generate a ThreatLocker Auth Key

ThreatLocker API documentation

  1. Sign in to the ThreatLocker portal with an account that can manage API users and organizations.
     
  2. Open the API or API user settings.
     
  3. Create or select an API user for ScalePad.
     
  4. Set the authentication type to Basic Authentication (API Token).
     
  5. Assign the API user a role that includes the View Computers and Install Computers permissions, and set the role's organization access to All Organizations.
     
  6. Generate an Auth Key.
     
  7. Copy the Auth Key and store it securely.
Important: Use the raw Auth Key only. Do not add Bearer, quotation marks, or extra spaces.

Connect ThreatLocker to ScalePad

  1. Log into the ScalePad Hub and click Integrations
     
  2. Click + Add Integration
     
  3. Search and Select ThreatLocker.
     
  4. In Authorization Token, paste the Auth Key.
     
  5. In Instance, enter your ThreatLocker instance. 
    To find it, sign in to the ThreatLocker portal and click Help. Your instance is the value in parentheses next to ThreatLocker Access. 
    For example, if you see ThreatLocker Access (G), enter G. This is the same value that appears in your ThreatLocker API URL, portalapi.<instance>.threatlocker.com.
     
  6. Select Save and sync now.
     
  7. Confirm that the integration status changes to Connected or Syncing.

If the connection fails, confirm that the instance matches the value next to ThreatLocker Access in the ThreatLocker portal. Check the raw Auth Key and the API user's role and organization access. If these settings are correct and the connection still fails, review the ITAR and location restrictions below or contact ScalePad Support.

Fields we are syncing data for

ThreatLocker data is synced into ScalePad as client and device records.

ThreatLocker field ScalePad field
organizationId Client identifier
Display name Client name
computerId Asset identifier
Hostname or computer name Asset name
organizationId Client association
threatLockerVersion Agent version
lastCheckin Last check-in
dateAdded Date added or first seen
isTamperProtectionDisabled Tamper protection status
isIsolated or isIsolationMode Isolation status

How syncing works

ScalePad retrieves accessible ThreatLocker organizations and their computers.

Troubleshooting

Symptom Likely cause Resolution
The integration rejects the credentials The instance is incorrect, or the Auth Key is invalid, expired, or formatted incorrectly Check that the instance matches the one next to ThreatLocker Access in the ThreatLocker portal. If it does, generate a new Auth Key and enter the raw value without Bearer or extra spaces
The connection fails and Support identifies HTTP 902 ThreatLocker may be restricting access to the organization from the request's location Review the ITAR and location restrictions below. Ask Support to identify the organization and access policy that rejected the request.
The connection succeeds but no devices appear The API user cannot access your organizations Confirm that the API user's role has its organization access set to All Organizations
Some organizations are missing Child-organization access or routing is incomplete Confirm that the API user can read the required child organizations
The integration remains queued or syncing The initial vendor sync is still running or the vendor request failed Wait for the sync to complete, then review the integration status and retry
ThreatLocker blocks the ScalePad agent A ThreatLocker policy is blocking the ScalePad service Allow the required ScalePad agent activity in ThreatLocker

ITAR and location restrictions

ThreatLocker can restrict organization access even when the instance, Auth Key, and role permissions are correct. Regenerating the key does not change these access policies.

Integration requests originate from ScalePad's servers. ThreatLocker evaluates the request's source IP address and location, which can differ from your workstation.

  1. Inspect the ITAR setting. In ThreatLocker, open Organizations, select the organization's gear icon, then open General > Settings > ITAR Compliant. Check the organization associated with the API user and relevant child organizations. Ask ThreatLocker Support which organization's policy applies to the failed request. See ThreatLocker's ITAR guide.
  2. Review country and IP restrictions. Open Users > Additional Options > Login Settings in ThreatLocker. Review Country Restrictions and IP Address Restrictions. ThreatLocker documents that IP restrictions also apply to API users. Ask Support to confirm the source IP and country used for the integration request. See ThreatLocker's Login Settings guide.
  3. Escalate with the failed request details. Send ScalePad Support the attempt's date and time with its time zone, your instance, affected organization, and displayed error. Do not include your Auth Key. Support can correlate the request with ThreatLocker and confirm the appropriate access configuration while retaining required controls.

Error codes: Support may identify HTTP 440 for a token authentication rejection, which ScalePad displays as a credential error. HTTP 902 is associated with ThreatLocker's location/ITAR restriction handling. A 902 response does not establish that all token or permission settings are valid; the blocking policy still needs confirmation.

Hardware sync preferences

In the integration’s Preferences > Hardware settings, choose Sync assets without serial numbers to include devices whose source does not provide a serial number. Some information may be unavailable for these assets. Leave the option cleared to exclude devices with a blank serial number, then save your settings and sync.

If an expected device is missing, check this preference and the device’s serial number in the source before reconnecting the integration.

Any questions? Reach out to our ScalePad support team by submitting a support ticket.
:sparkles: NEW :sparkles: Join our MSP Power-Ups - Free 15-minute micro-workshops + live Q&A with our Lifecycle Manager experts. Sign up here to reserve your spot.

Related to

Was this article helpful?

Yes! No