Security connector
ThreatLocker + AI Autopilot
ThreatLocker is an application allowlisting and ringfencing platform, used to constrain what software may run on a managed endpoint.
93 tools · by domain
ThreatLocker- Security & Threat40
- Assets & CMDB27
- Automation, Patch & Remote10
- Clients & Contacts5
- Identity & Access4
Modeled connector coverage, not completed executions.
StackJack connector catalogue
The operating model lists StackJack connector coverage. Tenant access is scoped and authorised per MSP; a catalogue entry does not establish a working launch workflow.
Modeled connector coverage
93 catalogued tools for ThreatLocker
Detection and response, exposure and vulnerabilities, identity and MFA, and the vault — read freely, written only where the control model permits. 51 read · 40 write · 2 analytics.
- Security & Threat40 tools
- Assets & CMDB27 tools
- Automation, Patch & Remote10 tools
- Clients & Contacts5 tools
- Identity & Access4 tools
- Analytics & Intelligence3 tools
- Monitoring & Alerts2 tools
- Platform Admin & Integrations2 tools
Counts from The Agentic MSP Operating Model, version 4.361.0, transcribed from the connector's published catalogue on 2026-09-17. These describe the connector surface, not verified tenant permissions or completed workflows.
Operating-model roles
3 of the five service-desk agent roles map to this category
This is the model's category-level mapping. It does not establish that these agents have executed against your tenant.
- Stage 2AI Intake & Triage AgentThe model defines an intake stage that matches requests to ticket types and proposes priority against the client's SLA. The current launch is supervised and scoped with your team.
- Stage 4AI Autonomous Remediation AgentThe model defines a resolution plan, verification steps and closure notes for each ticket type. In the launch, Claudia runs the fix only after your technician approves it.
- Stage 5AI Service Desk WatchdogThe model defines a watchdog stage for SLA monitoring, client follow-up and breach-risk alerts. These responsibilities describe the broader model; pilot capabilities are agreed separately.
CrowdStrike Falcon
SentinelOne
ConnectSecure
DNSFilter
Cisco Umbrella
Teramind
Cisco Duo
Blackpoint CompassOne
Bitdefender GravityZone
ESET PROTECT
IRONSCALES
Datto EDR
Huntress
Avanan
DefensX
RoboShadow
intelliGRC
Cork
Telivy
Keeper
CyberQP
Petra Security
The whitepaper · 10 pages · PDF
Resolution readiness: a denominator for "our AI resolves X% of tickets"
Every vendor claims a resolution rate. This is what a denominator for one looks like.
Questions
Planning a ThreatLocker connection
Does this listing confirm a working integration?
No. It describes ThreatLocker's connector surface in the operating model. Tenant access, the selected task, result retrieval and any PSA linkage must be reviewed and demonstrated separately.
What access does AI Autopilot need to ThreatLocker?
That depends on the task and tenant. Before a pilot, review the available StackJack connection, execution identity, permissions, authorised targets and how access will be withdrawn. This page does not prescribe a permission set or confirm your current configuration. The initial launch is supervised.
Does onboarding guarantee this connector or workflow is ready?
No. The published onboarding session describes the service offered, not proof that a particular tenant connection or workflow has passed validation. Agree the stack, prerequisites and intended task with the team before treating it as ready.
Request an integration
Running something else as well?
Tell us the rest of your stack and the task you want to explore so we can review scope and access with you.
Discuss your ThreatLocker workflow
Claudia is invite-only for a limited supervised launch.