Retrieve the list of available behavior alert definitions

Open in ChatGPT Open in ChatGPT to ask questions about this page
Open in Claude Open in Claude to ask questions about this page
Copy as MarkdownCopy this page as markdown to use with AI assistants
View as Markdown Open this page as markdown in a new tab

Retrieves the list of all available behavior alert definitions that can be used when creating exclusion rules. Each entry provides the behavior alert ID, a human-readable label, and a description. Use the returned IDs to populate the behaviour_id field in exclusion requests.

Request URL

https://{serverurl}/edr/api/ext/exclusioncfg/behavior_alerts

Scope

DesktopCentralCloud.EDR.READCopied!

Header

Authorization: Zoho-oauthtoken d92d4xxxxxxxxxxxxx15f52

Request Parameters

- Request Headers

Content-TypestringMandatory
application/jsonapplication/jsonCopied!

Sample Request

Curl
Java
Python
Deluge
PowerShell
Copied!
curl --request GET \
  --url https://appdomains/edr/api/ext/exclusioncfg/behavior_alerts \
  --header 'Authorization: Zoho-oauthtoken  d92d4xxxxxxxxxxxxx15f52' \
  --header 'Content-Type: application/json'

Response Parameters

- HTTP code 200

Response Body - application/json
JSON Object
Hide Sub-Attributes
idstring

Unique identifier string for the behavior alert (e.g., '101').

labelstring

Short human-readable display name of the behavior alert (e.g., 'Suspicious Script Execution').

descriptionstring

Detailed description explaining what the behavior alert detects and why it is significant.

- HTTP code 400

Response Body - application/json
JSON Object
Hide Sub-Attributes
errorCodestring

EDRCOMMON001 — Internal server error occurred while retrieving the behavior alert list.

errorMessagestring

General internal error message.

- HTTP code 429

Response Body - application/json
JSON Object
Hide Sub-Attributes
errorCodestring

Rate limit error code.
IAM0019 — Returned when the API call threshold is exceeded within the defined duration window.

errorMessagestring

Rate limit exceeded message with guidance on when to retry.

Possible Response Codes

200HTTP code
400HTTP code
429HTTP code

Sample Response: HTTP 200

List of available behavior alert definitions

Copied!
  [
    {
      "description": "Detects execution of scripts from unusual locations or with encoded payloads",
      "id": "101",
      "label": "Suspicious Script Execution"
    },
    {
      "description": "Detects attempts to dump credentials from memory or the registry",
      "id": "102",
      "label": "Credential Dumping"
    }
  ]
                
Show full

Sample Response: HTTP 400

Unexpected server-side error

Copied!
  {
    "errorMessage": "Exception while getting behaviorAlerts values",
    "errorCode": "EDRCOMMON001"
  }
                
Show full

Sample Response: HTTP 429

API call threshold exceeded

Copied!
  {
    "errorCode": "IAM0019",
    "url": "/edr/api/ext/exclusioncfg/behavior_alerts",
    "errorMsg": "The URL /edr/api/ext/exclusioncfg/behavior_alerts was called too many times. Please retry after a while."
  }
                
Show full

Duration: 1 minute | Threshold: 30 | Lock period: 5 minutes

Duration - Time window for the threshold.
Threshold - Number of API calls allowed within the specified duration.
Lock Period - Wait time before consecutive API requests.