# Retrieve process hash details for a specific suspicious event Retrieves JSON-formatted process hash details for a specific suspicious event, used to power the AI triage detail view. Customer ID and login ID are resolved automatically from the authenticated session. ## Endpoints `GET /edr/api/ai/triage/{alertId}/details` ## Request URL `https://{serverurl}/edr/api/ai/triage/{alertId}/details` `{serverurl}`: [OAuth Authentication Endpoint Domain](https://www.manageengine.com/products/desktop-central/help/api/cloud/oauth-authentication-endpoint-domain.html) ## Scope `DesktopCentralCloud.EDR.READ` ## Header `Authorization: Zoho-oauthtoken d92d4xxxxxxxxxxxxx15f52` ## Request Parameters ### Request Headers - **Accept** `string` — Mandatory - `application/json` ### Path Parameters - **alertId** `long` — Mandatory Unique identifier of the suspicious event whose process hash details are to be retrieved. Get alertId from [Get Alerts details](https://www.manageengine.com/products/desktop-central/help/api/cloud/edrview-alerts-get-alerts.html). ## Sample Request ```curl curl --request GET \ --url https://appdomains/edr/api/ai/triage/{alertId}/details \ --header 'Accept: application/json' \ --header 'Authorization: Zoho-oauthtoken d92d4xxxxxxxxxxxxx15f52' ``` ## Response Parameters ### HTTP code 200 #### Response Body — application/json - `JSON Object` - **status** `string` Outcome of the operation. `'success'` or `'failed'`. - **data** `JSON Object` On success, the process hash detail map for the suspicious event. Absent on failure. - **message** `string` Present on failure only — error description string. Absent on success. ### HTTP code 429 #### Response Body — application/json - `JSON Object` - **errorCode** `string` Rate limit error code. `IAM0019` — Returned when the API call threshold is exceeded within the allowed duration window. - **errorMessage** `string` Rate limit exceeded message with guidance on when to retry. ## Possible Response Codes - **200** `HTTP code` - **429** `HTTP code` ## Sample Response: HTTP 200 Process hash details for the suspicious event returned successfully, including the full suspicious process tree and a flat process info list. ```json { "data": { "suspiciousProcessTree": { "data": { "processInfo": [ { "behaviourOperation": "Create File Map", "behaviourFilePath": "c:\\users\\sampleuser\\appdata\\local\\sampleapp\\user data\\default\\app profile.ico", "name": "Behavior : Possible Chromium Edge Info Steal", "description": "Possible Chromium Edge Info Steal", "behaviourEventType": "File Event", "type": "normal" }, { "behaviourOperation": "Read", "behaviourFilePath": "c:\\users\\sampleuser\\appdata\\local\\sampleapp\\user data\\default\\app profile.ico", "mitreName": "Credentials_From_Password_Stores", "name": "Behavior : browser secret stealer", "description": "browser secret stealer", "behaviourEventType": "File Event", "mitreId": "T1555", "type": "normal" } ], "isSigned": true, "sha256": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", "processName": "explorer.exe", "imagePath": "C:\\Windows\\explorer.exe", "eventCreatedTime": "Jan 01, 2026 09:00 AM", "userSid": "S-1-5-21-1000000000-1000000000-1000000000-1001", "userDomain": "SAMPLE-DOMAIN", "type": "normal", "commandLine": "C:\\WINDOWS\\Explorer.EXE", "userName": "sampleuser" }, "process_event_id": "1000000000000001", "children": [ { "data": { "processInfo": [ { "ruleVersion": "Rule Version : 00000000", "mitreName": "Command_And_Scripting_Interpreter", "name": "Alert : Generating first alert", "description": "To Generate your first alert", "mitreId": "T1059", "type": "alertAble" }, { "mitreName": "Boot_or_logon_autostart_execution", "name": "Behavior : Parent image name is Explorer but command line is Interpreter", "description": "Parent image name is Explorer but command line is Interpreter", "mitreId": "T1546", "type": "normal" }, { "mitreName": "commandlineinterface", "name": "Behavior : Command Prompt Execution", "description": "Command Prompt Execution", "mitreId": "T1059", "type": "normal" }, { "mitreName": "Indirect Command Execution", "name": "Behavior : Lolbin Chaining Detection", "description": "Lolbin Chaining Detection", "mitreId": "T1202", "type": "normal" }, { "behaviourOperation": "Read", "behaviourFilePath": "c:\\windows\\system32\\sampledll.dll", "mitreName": "impair_defenses", "name": "Behavior : Windows DLL Read", "description": "Windows DLL Read", "behaviourEventType": "File Event", "mitreId": "t1562", "type": "normal" }, { "mitreName": "Command_And_Scripting_Interpreter", "name": "Behavior : Generating first alert", "description": "Generating first alert", "mitreId": "T1059", "type": "normal" } ], "isSigned": true, "sha256": "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB", "processName": "cmd.exe", "imagePath": "C:\\WINDOWS\\system32\\cmd.exe", "eventCreatedTime": "Jan 01, 2026 10:00 AM", "userSid": "S-1-5-21-1000000000-1000000000-1000000000-1001", "userDomain": "SAMPLE-DOMAIN", "commandLine": "\"C:\\WINDOWS\\system32\\cmd.exe\" ", "userName": "sampleuser" }, "process_event_id": "1000000000000002", "children": [ { "data": { "processInfo": [ { "mitreName": "Indirect Command Execution", "name": "Behavior : Lolbin Chaining Detection", "description": "Lolbin Chaining Detection", "mitreId": "T1202", "type": "normal" }, { "behaviourOperation": "Read", "behaviourFilePath": "c:\\windows\\system32\\sampledll2.dll", "mitreName": "impair_defenses", "name": "Behavior : Windows DLL Read", "description": "Windows DLL Read", "behaviourEventType": "File Event", "mitreId": "t1562", "type": "normal" } ], "isSigned": true, "sha256": "CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC", "processName": "Conhost.exe", "imagePath": "\\SystemRoot\\System32\\Conhost.exe", "eventCreatedTime": "Jan 01, 2026 10:00 AM", "userSid": "S-1-5-21-1000000000-1000000000-1000000000-1001", "userDomain": "SAMPLE-DOMAIN", "type": "normal", "commandLine": "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1", "userName": "sampleuser" }, "process_event_id": "1000000000000003" }, { "data": { "processInfo": [], "isSigned": true, "sha256": "DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD", "processName": "choice.exe", "imagePath": "C:\\Windows\\System32\\choice.exe", "eventCreatedTime": "Jan 01, 2026 10:00 AM", "userSid": "S-1-5-21-1000000000-1000000000-1000000000-1001", "userDomain": "SAMPLE-DOMAIN", "type": "normal", "commandLine": "choice.exe /m sample_detection", "userName": "sampleuser" }, "process_event_id": "1000000000000004" } ], "isMainProcess": "true" } ] }, "processInfoList": [ { "fileDetails": { "product": "Microsoft® Windows® Operating System", "sha256": "CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC", "imagePath": "\\SystemRoot\\System32\\Conhost.exe", "publisher": "Microsoft Windows", "orgFileName": "CONHOST.EXE" }, "processName": "CONHOST.EXE", "executionDetails": { "createdTime": "Jan 01, 2026 10:00 AM", "userSid": "S-1-5-21-1000000000-1000000000-1000000000-1001", "endTime": "--", "processuuid": "00000001-0000-1000-8000-000000000001", "userDomain": "SAMPLE-DOMAIN", "commandLine": "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1", "userName": "sampleuser", "orgFileName": "CONHOST.EXE" } }, { "fileDetails": { "product": "Microsoft® Windows® Operating System", "sha256": "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB", "imagePath": "C:\\WINDOWS\\system32\\cmd.exe", "publisher": "Microsoft Windows", "orgFileName": "Cmd.Exe" }, "processName": "Cmd.Exe", "executionDetails": { "createdTime": "Jan 01, 2026 10:00 AM", "userSid": "S-1-5-21-1000000000-1000000000-1000000000-1001", "endTime": "--", "processuuid": "00000001-0000-1000-8000-000000000002", "userDomain": "SAMPLE-DOMAIN", "commandLine": "\"C:\\WINDOWS\\system32\\cmd.exe\" ", "userName": "sampleuser", "orgFileName": "Cmd.Exe" } }, { "fileDetails": { "product": "Microsoft® Windows® Operating System", "sha256": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", "imagePath": "C:\\Windows\\explorer.exe", "publisher": "Microsoft Windows", "orgFileName": "EXPLORER.EXE" }, "processName": "EXPLORER.EXE", "executionDetails": { "createdTime": "Jan 01, 2026 09:00 AM", "userSid": "S-1-5-21-1000000000-1000000000-1000000000-1001", "endTime": "--", "processuuid": "00000001-0000-1000-8000-000000000003", "userDomain": "SAMPLE-DOMAIN", "commandLine": "C:\\WINDOWS\\Explorer.EXE", "userName": "sampleuser", "orgFileName": "EXPLORER.EXE" } }, { "fileDetails": { "product": "Microsoft® Windows® Operating System", "sha256": "DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD", "imagePath": "C:\\Windows\\System32\\choice.exe", "publisher": "Microsoft Windows", "orgFileName": "choice.exe" }, "processName": "choice.exe", "executionDetails": { "createdTime": "Jan 01, 2026 10:00 AM", "userSid": "S-1-5-21-1000000000-1000000000-1000000000-1001", "endTime": "Jan 01, 2026 10:00 AM", "processuuid": "00000001-0000-1000-8000-000000000004", "userDomain": "SAMPLE-DOMAIN", "commandLine": "choice.exe /m sample_detection", "userName": "sampleuser", "orgFileName": "choice.exe" } } ] }, "status": "success" } ``` Event not found or internal error. ```json { "message": "Something went wrong", "status": "failed" } ``` ## Sample Response: HTTP 429 API call threshold exceeded. ```json { "errorCode": "IAM0019", "url": "/edr/api/ai/triage/{alertId}/details", "errorMsg": "The URL /edr/api/ai/triage/{alertId}/details was called too many times. Please retry after a while." } ``` ![](https://www.zohowebstatic.com/sites/zweb/images/people/ico-help.png) **Duration:** 1 minute | **Threshold:** 30 | **Lock period:** 5 minutes Duration - Time window for the threshold. Threshold - Number of API calls allowed within the specified duration. Lock Period - Wait time before consecutive API requests.