Cache or update the AI triage analysis result for a suspicious event

Caches or updates the AI triage analysis result for a specific suspicious event. The full triage result payload (as produced by the AI triage pipeline) is accepted as raw JSON and stored against the alertId for later retrieval

Endpoints

put /edr/api/ai/triage/{alertId}

Copy full URL

Request URL

https://{serverurl}/edr/api/ai/triage/{alertId}

Scope

DesktopCentralCloud.EDR.CREATECopied!

Header

Authorization: Zoho-oauthtoken d92d4xxxxxxxxxxxxx15f52

Request Parameters

- Request Headers

Content-TypestringMandatory

application/jsonCopied!

- Path Parameters

alertIdlongMandatory

Unique identifier of the suspicious event whose triage result is being updated. Get alertId from Get Alerts details .

- Request Body

application/json

JSON Object

Hide Sub-Attributes

uiJSON ObjectOptional

UI-facing metadata surfaced alongside the triage result.

Show Sub-Attributes

suspicious_hashstringOptional

SHA-256 hash of the process file associated with the suspicious event under triage.

messageJSON ObjectOptional

Core AI-generated triage analysis result for the suspicious event.

Show Sub-Attributes

triage_scorestringOptional

AI-assigned confidence/risk score for the triage verdict, on a 0-100 scale; higher values indicate greater confidence that the alert is malicious.

verdictstringOptional

AI triage verdict for the alert (e.g., 'TRUE_POSITIVE', 'FALSE_POSITIVE').

alert_summarystringOptional

Human-readable, AI-generated summary of the suspicious activity that triggered the alert (e.g., 'Suspicious PowerShell execution detected').

Sample Request

Curl

Java

Python

Deluge

PowerShell

Copied!

curl --request PUT \
  --url https://appdomains/edr/api/ai/triage/{alertId} \
  --header 'Authorization: Zoho-oauthtoken  d92d4xxxxxxxxxxxxx15f52' \
  --header 'Content-Type: application/json' \
  --data '{}'

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
import java.io.IOException;
import java.net.http.HttpTimeoutException;

public class Main {
  public static void main(String[] args) {

    HttpRequest request = HttpRequest.newBuilder()
        .uri(URI.create("https://appdomains/edr/api/ai/triage/{alertId}"))
        .header("Content-Type", "application/json")
        .header("Authorization", "Zoho-oauthtoken  d92d4xxxxxxxxxxxxx15f52")
        .method("PUT", HttpRequest.BodyPublishers.ofString("{}"))
        .build();
    HttpResponse response = HttpClient.newHttpClient().send(request, HttpResponse.BodyHandlers.ofString());
    System.out.println(response.body());
  
  }
}

import http.client

conn = http.client.HTTPSConnection("appdomains")

payload = "{}"

headers = {
    'Content-Type': "application/json",
    'Authorization': "Zoho-oauthtoken  d92d4xxxxxxxxxxxxx15f52"
    }

conn.request("PUT", "/edr/api/ai/triage/{alertId}", payload, headers)

res = conn.getresponse()
data = res.read()

print(data.decode("utf-8"))


    headersMap = Map();
    headersMap.put("Content-Type", "application/json");
    headersMap.put("Accept", "application/json");

    data=Map();

    response = invokeUrl
    [
        url: "https://appDomains/edr/api/ai/triage/{alertId}"
        type: PUT
        headers: headersMap
        body: data
        connection: connection_name
    ]

    info response;

$headers=@{}
$headers.Add("Content-Type", "application/json")
$headers.Add("Authorization", "Zoho-oauthtoken  d92d4xxxxxxxxxxxxx15f52")
$response = Invoke-WebRequest -Uri 'https://appdomains/edr/api/ai/triage/{alertId}' -Method PUT -Headers $headers -ContentType 'application/json' -Body '{}'

Sample Request Body

Update triage result for a suspicious event

Copied!

  {
    "ui": {
      "suspicious_hash": "A1B2C3D4E5F6A1B2C3D4E5F6A1B2C3D4E5F6A1B2C3D4E5F6A1B2C3D4E5F6A1B2"
    },
    "message": {
      "triage_score": 71,
      "verdict": "TRUE_POSITIVE",
      "alert_summary": "Suspicious PowerShell execution detected"
    }
  }

▼ Show full

Response Parameters

- HTTP code 200

Response Body - application/json

JSON Object

Hide Sub-Attributes

statusstring

Outcome of the operation. 'success' if the request completed successfully, 'failed' if an error occurred. All AI Tools APIs always return HTTP 200; inspect this field to determine success or failure.

messagestring

On success, a confirmation string or the requested data object. On failure, an error description string such as 'Request body is required' or 'Something went wrong'.

- HTTP code 429

Response Body - application/json

JSON Object

Hide Sub-Attributes

errorCodestring

Rate limit error code.
IAM0019 — Returned when the API call threshold is exceeded within the allowed duration window.

errorMessagestring

Rate limit exceeded message with guidance on when to retry.

Possible Response Codes

200HTTP code

429HTTP code

Sample Response: HTTP 200

Triage result stored successfully

Copied!

  {
    "message": "Triage updated successfully",
    "status": "success"
  }

▼ Show full

Request body was missing or an internal error occurred

Copied!

  {
    "message": "Request body is required",
    "status": "failed"
  }

▼ Show full

Sample Response: HTTP 429

API call threshold exceeded

Copied!

  {
    "errorCode": "IAM0019",
    "url": "/edr/api/ai/triage/{alertId}",
    "errorMsg": "The URL /edr/api/ai/triage/{alertId} was called too many times. Please retry after a while."
  }

▼ Show full

Duration: 1 minute | Threshold: 10 | Lock period: 5 minutes

Duration - Time window for the threshold.
Threshold - Number of API calls allowed within the specified duration.
Lock Period - Wait time before consecutive API requests.