Retrieves the list of all available behavior alert definitions that can be used when creating exclusion rules. Each entry provides the behavior alert ID, a human-readable label, and a description. Use the returned IDs to populate the behaviour_id field in exclusion requests.
get /edr/api/ext/exclusioncfg/behavior_alerts
https://{serverurl}/edr/api/ext/exclusioncfg/behavior_alerts
Authorization: Zoho-oauthtoken d92d4xxxxxxxxxxxxx15f52
curl --request GET \
--url https://appdomains/edr/api/ext/exclusioncfg/behavior_alerts \
--header 'Authorization: Zoho-oauthtoken d92d4xxxxxxxxxxxxx15f52' \
--header 'Content-Type: application/json'Unique identifier string for the behavior alert (e.g., '101').
Short human-readable display name of the behavior alert (e.g., 'Suspicious Script Execution').
Detailed description explaining what the behavior alert detects and why it is significant.
EDRCOMMON001 — Internal server error occurred while retrieving the behavior alert list.
General internal error message.
Rate limit error code.
IAM0019 — Returned when the API call threshold is exceeded within the defined duration window.
Rate limit exceeded message with guidance on when to retry.
List of available behavior alert definitions
[
{
"description": "Detects execution of scripts from unusual locations or with encoded payloads",
"id": "101",
"label": "Suspicious Script Execution"
},
{
"description": "Detects attempts to dump credentials from memory or the registry",
"id": "102",
"label": "Credential Dumping"
}
]
Unexpected server-side error
{
"errorMessage": "Exception while getting behaviorAlerts values",
"errorCode": "EDRCOMMON001"
}
API call threshold exceeded
{
"errorCode": "IAM0019",
"url": "/edr/api/ext/exclusioncfg/behavior_alerts",
"errorMsg": "The URL /edr/api/ext/exclusioncfg/behavior_alerts was called too many times. Please retry after a while."
}
![]()
Duration: 1 minute | Threshold: 30 | Lock period: 5 minutes
Duration - Time window for the threshold.
Threshold - Number of API calls allowed within the specified duration.
Lock Period - Wait time before consecutive API requests.
© 2026, Zoho Corporation Pvt. Ltd. All Rights Reserved.