Update analyst notes for a specific suspicious event or alert

Open in ChatGPT Open in ChatGPT to ask questions about this page
Open in Claude Open in Claude to ask questions about this page
Copy as MarkdownCopy this page as markdown to use with AI assistants
View as Markdown Open this page as markdown in a new tab

Updates the analyst notes associated with a specific suspicious event or alert. Unlike other AI Tools APIs.

Request URL

https://{serverurl}/edr/api/ai/alert/{alertId}/notes

Scope

DesktopCentralCloud.EDR.CREATECopied!

Header

Authorization: Zoho-oauthtoken d92d4xxxxxxxxxxxxx15f52

Request Parameters

- Request Headers

Content-TypestringMandatory
application/jsonapplication/jsonCopied!

- Path Parameters

alertIdlongMandatory

Unique identifier of the suspicious event or alert whose notes are being updated. Fetch alert_id from Get EDR Alerts.

- Request Body

application/json
JSON Object
Hide Sub-Attributes
notesstringMandatory

Analyst notes to associate with the alert. Send an empty string to clear existing notes.

Sample Request

Curl
Java
Python
Deluge
PowerShell
Copied!
curl --request PUT \
  --url https://appdomains/edr/api/ai/alert/{alertId}/notes \
  --header 'Authorization: Zoho-oauthtoken  d92d4xxxxxxxxxxxxx15f52' \
  --header 'Content-Type: application/json' \
  --data '{"notes":"Confirmed benign — approved test script from IT team"}'

Sample Request Body

Update analyst notes for an alert

Copied!
  {
    "notes": "Confirmed benign — approved test script from IT team"
  }
                
Show full

Clear existing notes

Copied!
  {
    "notes": ""
  }
                
Show full

Response Parameters

- HTTP code 400

Response Body - application/json
JSON Object
Hide Sub-Attributes
errorCodestring

EDRCOMMON001 — Internal server error occurred while updating the alert notes.

errorMessagestring

General internal error message.

- HTTP code 429

Response Body - application/json
JSON Object
Hide Sub-Attributes
errorCodestring

Rate limit error code.
IAM0019 — Returned when the API call threshold is exceeded within the allowed duration window.

errorMessagestring

Rate limit exceeded message with guidance on when to retry.

Possible Response Codes

204HTTP code
400HTTP code
429HTTP code

Sample Response: HTTP 204

Copied!
204 No Content
Show full

Sample Response: HTTP 400

Unexpected server-side error while updating notes

Copied!
  {
    "errorMessage": "Exception while updating alert notes",
    "errorCode": "EDRCOMMON001"
  }
                
Show full

Sample Response: HTTP 429

API call threshold exceeded

Copied!
  {
    "errorCode": "IAM0019",
    "url": "/edr/api/ai/alert/{alertId}/notes",
    "errorMsg": "The URL /edr/api/ai/alert/{alertId}/notes was called too many times. Please retry after a while."
  }
                
Show full

Duration: 1 minute | Threshold: 30 | Lock period: 5 minutes

Duration - Time window for the threshold.
Threshold - Number of API calls allowed within the specified duration.
Lock Period - Wait time before consecutive API requests.