/portalAPI/DACAnalysisResult/*

This article will encompass all portalAPI calls that are related to /portalAPI/DACAnalysisResult/* endpoints

 

Be sure to input the instance your organization exists on for each call. This is indicated with the "INSTANCE" text in each endpoint. Linked here is a KB to find your instance:

Locating Your Organization's Instance | ThreatLocker Help Center

DACAnalysisResultsGetByParameters

https://portalapi.INSTANCE.threatlocker.com/portalapi/DACAnalysisResult/DACAnalysisResultsGetByParameters

• Method: POST
• Description: This API is used when navigating to the Health Center page of the ThreatLocker Portal and selecting the DAC tab in the top right corner. This API is responsible for retrieving all current DAC analysis results from your organization based on the supplied parameters. To view DAC results in a different organization than the currently logged in/managed organization, use the managedOrganizationId header as described below.
• Required Body/Parameters
  • Valid APIKey/Authorization Token in header
  • Fields

Note: These are the only fields that are required. However, this limits the results returned to only the organization level, excluding child organizations and returning all results sorted by criticality from the DAC check.

• • • pageNumber and pageSize: These fields determine the number of results that will be returned as if the response were in the ThreatLocker Portal. However, these fields do not follow the same conventions as the pageNumber and pageSize values used in the Portal (pageSize in the Portal is 25, 50, 100, or 500). Any valid integer can be entered, and it will return in the selected formatting. For instance, if there are 5 results to be returned, but “pageNumber”: 1 and “pageSize”: 2 are specified, 2 entries will be returned per page, and the first two results will be displayed.
      • Expects: An Integer value

• Optional Body/Parameters
  • In header: "managedOrganizationId": <GUID> in format "00000000-0000-0000-0000-000000000000"
  • Fields
    • appliesToId: This field determines where the DAC results will be returned from. This field corresponds to the "Applies To" section of the "DAC" page in the ThreatLocker Portal. Besides Global computerGroupIds, any valid organizationId, computerGroupId, or computerId can be entered. For instance, if looking to return the DAC results from a specific computer, enter the computerId into this field. When this field and the entityTypeId field are omitted, the results returned will be for the entire organization. To effectively use this field, also ensure that you use the entityTypeId field with the corresponding Integer value.
      • Expects a GUID in format: "00000000-0000-0000-0000-000000000000"
    • categoryId: This field specifies the category that the results will be sorted by when the sortBy field is used, and the category option is selected. When this field is omitted, the results will not be sorted based on any category. This field expects the Integer value corresponding to the category you wish to sort by to be entered.
      • Account and Authentication = 7
      • Advanced Audit Configuration = 8
      • Application Control = 3
      • Detect and Response = 13
      • Group Policy = 6
      • Local Security = 9
      • Network Policy = 1
      • Patch Management = 10
      • Registry Policy = 4
      • Remote Desktop and Access Control = 11
      • Storage Policy = 2
      • User Rights Assignment = 12
    • criticalityId: This field is used to narrow the criticality of the results that will be returned to a specific level. When this field is omitted, all results at any criticality level will be returned. This field expects the Integer value corresponding to the level of criticality you wish to view to be entered.
      • Low = 1
      • Moderate = 2
      • High = 3
      • Critical = 4
    • entityTypeId: This field specifies the type of ID (organizationId, computerGroupId, or computerId) selected when the appliesToId field is used. When this field is omitted, anything entered into the appliesToId field will not be processed, and the entire organization's results will be returned. This field expects the Integer value corresponding to the type of ID selected in the appliesToId field to be entered.
      • organization = 1
      • computer group = 2
      • computer = 3
    • includeChildOrgs: This field determines whether results from all child organizations will be returned or not. When set to true, all results from all child organizations, including grandchild organizations, will be returned. When set to false or omitted, only the results from the currently managed organization will be returned; Typically, this will be the parent organization.
      • Expects: true or false
    • searchText: This field allows you to search through the results by inputting any text/details you want to search for. When this field is omitted, all results will be shown based on the other search fields used. This field searches the results based on the name of the DAC check.
      • Expects: Any text input
    • sortBy: This field determines the order in which the results will be returned. When this field is omitted, the results will be returned in order of criticality. To effectively use the category option, also ensure that you use the categoryId field with a corresponding Integer value. This field expects the text from one of the following options to be entered exactly as they appear.
      • category
      • combined-impact
      • criticality

• Permissions Needed for User
  • View DAC Results