Retrieve process hash details for a specific suspicious event
Retrieves JSON-formatted process hash details for a specific suspicious event, used to power the AI triage detail view. Customer ID and login ID are resolved automatically from the authenticated session.
Endpoints
get /edr/api/ai/triage/{alertId}/details
Copy full URL
Request URL
https://{serverurl}/edr/api/ai/triage/{alertId}/details
Scope
DesktopCentralCloud.EDR.READCopied!
Header
Authorization: Zoho-oauthtoken d92d4xxxxxxxxxxxxx15f52
Request Parameters
- Request Headers
AcceptstringMandatoryapplication/jsonapplication/jsonCopied!
- Path Parameters
alertIdlongMandatory
Unique identifier of the suspicious event whose process hash details are to be retrieved. Get alertId from Get Alerts details .
Sample Request
Curl
Java
Python
Deluge
PowerShell
Copied!
curl --request GET \
--url https://appdomains/edr/api/ai/triage/{alertId}/details \
--header 'Accept: application/json' \
--header 'Authorization: Zoho-oauthtoken d92d4xxxxxxxxxxxxx15f52'Response Parameters
- HTTP code 200
Response Body - application/json
JSON Object
Hide Sub-Attributes
statusstring
Outcome of the operation. 'success' or 'failed'.
dataJSON Object
On success, the process hash detail map for the suspicious event. Absent on failure.
Show Sub-Attributes
suspiciousProcessTreeJSON Object
Root node of the suspicious process tree, recursively describing the flagged process and every descendant process spawned as part of the alert chain.
Show Sub-Attributes
dataJSON Object
Process identity, execution context, and associated behaviour/alert entries for this node.
Show Sub-Attributes
processInfoJSON Array
Behaviour and alert entries (MITRE-mapped detections, file events, etc.) recorded against this process.
Show Sub-Attributes
JSON Object
Show Sub-Attributes
behaviourOperationstring
File/registry operation performed (e.g., 'Create File Map', 'Read'). Present only on event-based behaviour entries.
behaviourFilePathstring
File path involved in the behaviour/event. Present only on event-based behaviour entries.
mitreNamestring
MITRE ATT&CK technique name associated with this entry (e.g., 'Credentials_From_Password_Stores'). Absent when not mapped to a MITRE technique.
namestring
Display name of the behaviour or alert (e.g., 'Behavior : browser secret stealer', 'Alert : Generating first alert').
descriptionstring
Human-readable description of the detected behaviour or alert.
behaviourEventTypestring
Category of the underlying event (e.g., 'File Event'). Present only on event-based behaviour entries.
mitreIdstring
MITRE ATT&CK technique ID (e.g., 'T1555'). Absent when not mapped to a MITRE technique.
ruleVersionstring
Detection rule version string (e.g., 'Rule Version : 26080402'). Present only on entries with type 'alertAble'.
typestring
'normal' for informational behaviour entries, 'alertAble' for the entry that triggered the alert.
isSignedboolean
Whether the process image is digitally signed.
sha256string
SHA-256 hash of the process image.
processNamestring
Executable file name of the process (e.g., 'cmd.exe').
imagePathstring
Full file system path of the process executable.
eventCreatedTimestring
Timestamp when the process-start event was recorded (e.g., 'Aug 5, 2026 01:30 PM').
userSidstring
Windows Security Identifier (SID) of the user that started the process.
userDomainstring
Windows domain of the user that started the process.
typestring
Node classification, e.g. 'normal'.
commandLinestring
Full command-line string used to launch the process.
userNamestring
Username of the user that started the process.
process_event_idstring
Unique identifier of the process event represented by this node.
childrenJSON Array
Child process nodes spawned by this process. Absent on leaf nodes with no recorded child processes.
Show Sub-Attributes
JSON Object
Show Sub-Attributes
Refer to edrTriageProcessTreeNodeisMainProcessstring
'true' when this node is the primary process identified by the detection engine for the alert. Present only on that single node; absent on all other nodes.
processInfoListJSON Array
Flat list of file and execution details for every process that appears anywhere in 'suspiciousProcessTree'.
Show Sub-Attributes
JSON Object
Show Sub-Attributes
fileDetailsJSON Object
File metadata for this process's executable image.
Show Sub-Attributes
productstring
Product name from the file's version metadata (e.g., 'Microsoft® Windows® Operating System').
sha256string
SHA-256 hash of the file.
imagePathstring
Full file system path of the executable/image.
publisherstring
Publisher name from the file's digital signature.
orgFileNamestring
Original file name embedded in the file's version metadata.
processNamestring
Display name of the process file (e.g., 'Cmd.Exe').
executionDetailsJSON Object
Execution context for this process instance.
Show Sub-Attributes
createdTimestring
Timestamp when the process started (e.g., 'Aug 5, 2026 01:30 PM').
userSidstring
Windows SID of the user that ran the process.
endTimestring
Timestamp when the process ended, or '--' if the process is still running or the end time is unavailable.
processuuidstring
Unique UUID assigned to this process instance.
userDomainstring
Windows domain of the user that ran the process.
commandLinestring
Full command-line string used to launch the process.
userNamestring
Username of the user that ran the process.
orgFileNamestring
Original file name embedded in the executable's version metadata.
messagestring
Present on failure only — error description string. Absent on success.
- HTTP code 429
Response Body - application/json
JSON Object
Hide Sub-Attributes
errorCodestring
Rate limit error code.
IAM0019 — Returned when the API call threshold is exceeded within the allowed duration window.
errorMessagestring
Rate limit exceeded message with guidance on when to retry.
Possible Response Codes
200HTTP code
429HTTP code
Sample Response: HTTP 200
Process hash details for the suspicious event returned successfully, including the full suspicious process tree and a flat process info list
Copied!
{
"data": {
"suspiciousProcessTree": {
"data": {
"processInfo": [
{
"behaviourOperation": "Create File Map",
"behaviourFilePath": "c:\\users\\sampleuser\\appdata\\local\\sampleapp\\user data\\default\\app profile.ico",
"name": "Behavior : Possible Chromium Edge Info Steal",
"description": "Possible Chromium Edge Info Steal",
"behaviourEventType": "File Event",
"type": "normal"
},
{
"behaviourOperation": "Read",
"behaviourFilePath": "c:\\users\\sampleuser\\appdata\\local\\sampleapp\\user data\\default\\app profile.ico",
"mitreName": "Credentials_From_Password_Stores",
"name": "Behavior : browser secret stealer",
"description": "browser secret stealer",
"behaviourEventType": "File Event",
"mitreId": "T1555",
"type": "normal"
}
],
"isSigned": true,
"sha256": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
"processName": "explorer.exe",
"imagePath": "C:\\Windows\\explorer.exe",
"eventCreatedTime": "Jan 01, 2026 09:00 AM",
"userSid": "S-1-5-21-1000000000-1000000000-1000000000-1001",
"userDomain": "SAMPLE-DOMAIN",
"type": "normal",
"commandLine": "C:\\WINDOWS\\Explorer.EXE",
"userName": "sampleuser"
},
"process_event_id": "1000000000000001",
"children": [
{
"data": {
"processInfo": [
{
"ruleVersion": "Rule Version : 00000000",
"mitreName": "Command_And_Scripting_Interpreter",
"name": "Alert : Generating first alert",
"description": "To Generate your first alert",
"mitreId": "T1059",
"type": "alertAble"
},
{
"mitreName": "Boot_or_logon_autostart_execution",
"name": "Behavior : Parent image name is Explorer but command line is Interpreter",
"description": "Parent image name is Explorer but command line is Interpreter",
"mitreId": "T1546",
"type": "normal"
},
{
"mitreName": "commandlineinterface",
"name": "Behavior : Command Prompt Execution",
"description": "Command Prompt Execution",
"mitreId": "T1059",
"type": "normal"
},
{
"mitreName": "Indirect Command Execution",
"name": "Behavior : Lolbin Chaining Detection",
"description": "Lolbin Chaining Detection",
"mitreId": "T1202",
"type": "normal"
},
{
"behaviourOperation": "Read",
"behaviourFilePath": "c:\\windows\\system32\\sampledll.dll",
"mitreName": "impair_defenses",
"name": "Behavior : Windows DLL Read",
"description": "Windows DLL Read",
"behaviourEventType": "File Event",
"mitreId": "t1562",
"type": "normal"
},
{
"mitreName": "Command_And_Scripting_Interpreter",
"name": "Behavior : Generating first alert",
"description": "Generating first alert",
"mitreId": "T1059",
"type": "normal"
}
],
"isSigned": true,
"sha256": "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB",
"processName": "cmd.exe",
"imagePath": "C:\\WINDOWS\\system32\\cmd.exe",
"eventCreatedTime": "Jan 01, 2026 10:00 AM",
"userSid": "S-1-5-21-1000000000-1000000000-1000000000-1001",
"userDomain": "SAMPLE-DOMAIN",
"commandLine": "\"C:\\WINDOWS\\system32\\cmd.exe\" ",
"userName": "sampleuser"
},
"process_event_id": "1000000000000002",
"children": [
{
"data": {
"processInfo": [
{
"mitreName": "Indirect Command Execution",
"name": "Behavior : Lolbin Chaining Detection",
"description": "Lolbin Chaining Detection",
"mitreId": "T1202",
"type": "normal"
},
{
"behaviourOperation": "Read",
"behaviourFilePath": "c:\\windows\\system32\\sampledll2.dll",
"mitreName": "impair_defenses",
"name": "Behavior : Windows DLL Read",
"description": "Windows DLL Read",
"behaviourEventType": "File Event",
"mitreId": "t1562",
"type": "normal"
}
],
"isSigned": true,
"sha256": "CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC",
"processName": "Conhost.exe",
"imagePath": "\\SystemRoot\\System32\\Conhost.exe",
"eventCreatedTime": "Jan 01, 2026 10:00 AM",
"userSid": "S-1-5-21-1000000000-1000000000-1000000000-1001",
"userDomain": "SAMPLE-DOMAIN",
"type": "normal",
"commandLine": "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1",
"userName": "sampleuser"
},
"process_event_id": "1000000000000003"
},
{
"data": {
"processInfo": [],
"isSigned": true,
"sha256": "DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD",
"processName": "choice.exe",
"imagePath": "C:\\Windows\\System32\\choice.exe",
"eventCreatedTime": "Jan 01, 2026 10:00 AM",
"userSid": "S-1-5-21-1000000000-1000000000-1000000000-1001",
"userDomain": "SAMPLE-DOMAIN",
"type": "normal",
"commandLine": "choice.exe /m sample_detection",
"userName": "sampleuser"
},
"process_event_id": "1000000000000004"
}
],
"isMainProcess": "true"
}
]
},
"processInfoList": [
{
"fileDetails": {
"product": "Microsoft® Windows® Operating System",
"sha256": "CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC",
"imagePath": "\\SystemRoot\\System32\\Conhost.exe",
"publisher": "Microsoft Windows",
"orgFileName": "CONHOST.EXE"
},
"processName": "CONHOST.EXE",
"executionDetails": {
"createdTime": "Jan 01, 2026 10:00 AM",
"userSid": "S-1-5-21-1000000000-1000000000-1000000000-1001",
"endTime": "--",
"processuuid": "00000001-0000-1000-8000-000000000001",
"userDomain": "SAMPLE-DOMAIN",
"commandLine": "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1",
"userName": "sampleuser",
"orgFileName": "CONHOST.EXE"
}
},
{
"fileDetails": {
"product": "Microsoft® Windows® Operating System",
"sha256": "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB",
"imagePath": "C:\\WINDOWS\\system32\\cmd.exe",
"publisher": "Microsoft Windows",
"orgFileName": "Cmd.Exe"
},
"processName": "Cmd.Exe",
"executionDetails": {
"createdTime": "Jan 01, 2026 10:00 AM",
"userSid": "S-1-5-21-1000000000-1000000000-1000000000-1001",
"endTime": "--",
"processuuid": "00000001-0000-1000-8000-000000000002",
"userDomain": "SAMPLE-DOMAIN",
"commandLine": "\"C:\\WINDOWS\\system32\\cmd.exe\" ",
"userName": "sampleuser",
"orgFileName": "Cmd.Exe"
}
},
{
"fileDetails": {
"product": "Microsoft® Windows® Operating System",
"sha256": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
"imagePath": "C:\\Windows\\explorer.exe",
"publisher": "Microsoft Windows",
"orgFileName": "EXPLORER.EXE"
},
"processName": "EXPLORER.EXE",
"executionDetails": {
"createdTime": "Jan 01, 2026 09:00 AM",
"userSid": "S-1-5-21-1000000000-1000000000-1000000000-1001",
"endTime": "--",
"processuuid": "00000001-0000-1000-8000-000000000003",
"userDomain": "SAMPLE-DOMAIN",
"commandLine": "C:\\WINDOWS\\Explorer.EXE",
"userName": "sampleuser",
"orgFileName": "EXPLORER.EXE"
}
},
{
"fileDetails": {
"product": "Microsoft® Windows® Operating System",
"sha256": "DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD",
"imagePath": "C:\\Windows\\System32\\choice.exe",
"publisher": "Microsoft Windows",
"orgFileName": "choice.exe"
},
"processName": "choice.exe",
"executionDetails": {
"createdTime": "Jan 01, 2026 10:00 AM",
"userSid": "S-1-5-21-1000000000-1000000000-1000000000-1001",
"endTime": "Jan 01, 2026 10:00 AM",
"processuuid": "00000001-0000-1000-8000-000000000004",
"userDomain": "SAMPLE-DOMAIN",
"commandLine": "choice.exe /m sample_detection",
"userName": "sampleuser",
"orgFileName": "choice.exe"
}
}
]
},
"status": "success"
}
▼ Show full
Event not found or internal error
Copied!
{
"message": "Something went wrong",
"status": "failed"
}
▼ Show full
Sample Response: HTTP 429
API call threshold exceeded
Copied!
{
"errorCode": "IAM0019",
"url": "/edr/api/ai/triage/{alertId}/details",
"errorMsg": "The URL /edr/api/ai/triage/{alertId}/details was called too many times. Please retry after a while."
}
▼ Show full
Duration: 1 minute | Threshold: 30 | Lock period: 5 minutes
Duration - Time window for the threshold.
Threshold - Number of API calls allowed within the specified duration.
Lock Period - Wait time before consecutive API requests.
© 2026, Zoho Corporation Pvt. Ltd. All Rights Reserved.