Integrating with ThreatLocker

Overview

You can use HTTP Ingestion to integrate Blumira with ThreatLocker and bypass the need for an on-premises Ubuntu sensor or traditional API-polling Cloud Connector. This method uses Blumira’s Cloud Ingest API, which provides a unique HTTPS endpoint where your organization can transfer structured logs.

Blumira parses ThreatLocker’s Unified Audit events into a dedicated ThreatLocker data type and maps fields such as action, user, device, file, process, and policy into their own columns instead of grouping them under generic additional fields.

Before you begin

To configure the ThreatLocker integration, you need administrator access to the ThreatLocker portal and to the Blumira app.

Most Blumira editions allow an unlimited number of HTTP integrations. Detect Lite, Respond Core, and SIEM Core editions allow one ingestion source. M365 Edition accounts do not include access to HTTP logging.

Reference: See additional available HTTP integrations in Blumira HTTP Ingestion.

Generating your Blumira HTTP ingestion credentials

To generate your Blumira credentials

1. In the Blumira app, navigate to Ingestion > HTTP Ingestion.
2. Click Add Ingestion Instance.
3. In the window that appears, do the following:
   1. In Vendor, select Universal Ingestion Source (JSON), . 
   2. In the Vendor Name for Universal Ingestion Source box, type threatlocker.
   3. (Optional) In Ingestion Instance Name, edit the pre-populated name.
   4. (Optional) In Description, type a description that gives context for this instance.
   5. Click Save.
4. In the Credentials window, copy and save the HTTP Endpoint URL and the authorization token. Keep the window open, or paste both values somewhere secure — you cannot view the token again after you close the window.

Creating a ThreatLocker Detect policy to forward logs

1. In the ThreatLocker portal, open the Modules dropdown and select ThreatLocker Detect. To forward Microsoft 365 events instead, select Microsoft 365 from the Modules dropdown, then open the Microsoft 365 Detect tab.
2. Click + New Policy.
3. In the Create Endpoint Detect Policy panel, enter a policy name, description, and the users or devices the policy applies to.
4. In Policy Conditions, set the conditions for the events you want Blumira to receive. Broader conditions send fuller Unified Audit visibility to Blumira; narrower conditions — for example, matching only Deny (Option to Request) actions — send only that event type.
5. In Policy Actions, select Call Rest API (Client). This sends data directly from the ThreatLocker Agent to Blumira's ingestion endpoint.
6. Configure the REST API action with the following values:
   1. Method: POST
   2. URL: paste the Blumira HTTP Ingestion endpoint URL.
   3. Content Type: leave at its default value.
   4. Headers: add Authorization: Blumira <token>, replacing <token> with the authorization token you copied from Blumira.
   5. Body: enter {"event": "", "sourcetype": ""}. Populate event with the audit data variables you want logged — ThreatLocker inserts these automatically during processing — and set sourcetype to a label of your choosing, such as threatlocker.
7. Review the Policy Expiration setting and update as appropriate.
8. Click Save.
9. Click Deploy Policies to push the new policy to your organization.

Verifying logs are arriving in Blumira

In the Blumira app, open the HTTP Ingestion instance you created for ThreatLocker and click View Logs to confirm events are populating. Newly forwarded events appear under the ThreatLocker data type, with fields broken into dedicated columns.

Once ThreatLocker events are flowing, the following fields populate their own columns instead of being grouped under additional fields:

• File path, file size, and SHA-256 hash
• Process path and command line
• Device hostname
• Organization or tenant
• Destination domain
• Policy information
• Network direction and protocol