Stats
Actions
Tags
'%20stop-opacity%3D'0.16'%2F%3E%3Cstop%20offset%3D'1'%20stop-color%3D'rgb(200%2C90%2C60)'%20stop-opacity%3D'0.03'%2F%3E%3C%2FlinearGradient%3E%3C%2Fdefs%3E%3Crect%20width%3D'320'%20height%3D'200'%20fill%3D'url(%23g)'%2F%3E%3Ccircle%20cx%3D'250'%20cy%3D'56'%20r%3D'92'%20fill%3D'rgb(200%2C90%2C60)'%20fill-opacity%3D'0.06'%2F%3E%3Ccircle%20cx%3D'64'%20cy%3D'172'%20r%3D'58'%20fill%3D'rgb(200%2C90%2C60)'%20fill-opacity%3D'0.05'%2F%3E%3C%2Fsvg%3E)
From threatlocker
Finds ThreatLocker agents that have not checked in recently, buckets them by severity (warn, stale, dead), and suggests remediation steps like restarting the service or reinstalling.
How this command is triggered — by the user, by Claude, or both
Slash command
/threatlocker:offline-agents [organization_id] [limit]The summary Claude sees in its command listing — used to decide when to auto-load this command
# ThreatLocker Offline Agents Find ThreatLocker agents that have stopped checking in. Bucketed by severity so an MSP analyst can route remediation: a 26-hour outage probably needs a reboot, a 35-day outage likely needs reinstall or offboarding. ## Prerequisites - ThreatLocker MCP server connected with a valid `THREATLOCKER_API_KEY` - Tools available: `threatlocker_computers_list`, `threatlocker_computers_get_checkins` ## Steps 1. **List all computers** Call `threatlocker_computers_list` (paginating up to `limit`), scoped by `organization_id` if provided. 2. **Inspect check-in hist...
Find ThreatLocker agents that have stopped checking in. Bucketed by severity so an MSP analyst can route remediation: a 26-hour outage probably needs a reboot, a 35-day outage likely needs reinstall or offboarding.
THREATLOCKER_API_KEYthreatlocker_computers_list, threatlocker_computers_get_checkinsList all computers
Call threatlocker_computers_list (paginating up to limit), scoped by organization_id if provided.
Inspect check-in history per host
For each computer, call threatlocker_computers_get_checkins to retrieve the latest check-in timestamp. Skip the call if the list response already exposes a last_checkin field accurately - prefer the explicit endpoint when in doubt.
Bucket the results
Compute time since last check-in and bucket:
Render the report
Three tables (one per bucket) with: hostname, OS, group, last check-in, days offline. Sort each table descending by days offline.
Provide remediation suggestions per tier
ThreatLockerService Windows service or threatlocker macOS daemon| Parameter | Type | Required | Default | Description |
|---|---|---|---|---|
| organization_id | string | No | primary org | Scope to a child organization |
| limit | integer | No | 500 | Max computers to inspect |
/offline-agents
/offline-agents --organization_id "org-abc-123"
/computer-inventory - Full fleet report/audit-investigation - Was the host doing anything suspicious right before it went silent?npx claudepluginhub wyre-technology/msp-claude-plugins --plugin threatlocker/agent-inventoryLists and filters Huntress agents across organizations, providing counts, platform distribution, health status, and version info.
/agent-inventoryLists all devices and agents with status and health info, optionally filtered by OS or status. Supports --os and --status flags.
/account-summaryRetrieves a RocketCyber customer security posture summary: agent status, active incidents by severity/verdict, 30-day trend, and optional app inventory.
/search-agentsSearches Atera RMM agents by customer name, machine name, or ID, with optional online status filtering. Returns agent details including system info, network, and status.
/asset-inventoryGenerates an asset inventory summary for SentinelOne-managed environments, grouped by surface type (endpoints, cloud, identities, network discovery) with counts, health status, and coverage metrics.