# Retrieve the list of available behavior alert definitions

Retrieves the list of all available behavior alert definitions that can be used when creating exclusion rules. Each entry provides the behavior alert ID, a human-readable label, and a description. Use the returned IDs to populate the behaviour_id field in exclusion requests.

## Endpoints

**GET** `/edr/api/ext/exclusioncfg/behavior_alerts`

## Request

### Request URL

https://[{serverurl}](https://www.manageengine.com/products/desktop-central/help/api/cloud/oauth-authentication-endpoint-domain.html)/edr/api/ext/exclusioncfg/behavior_alerts

### Scope

`DesktopCentralCloud.EDR.READ`

### Header

`Authorization: Zoho-oauthtoken d92d4xxxxxxxxxxxxx15f52`

### Request Parameters

#### Request Headers

- **Content-Type** `string` **Mandatory**: `application/json`

### Sample Request

```curl
curl --request GET \
  --url https://appdomains/edr/api/ext/exclusioncfg/behavior_alerts \
  --header 'Authorization: Zoho-oauthtoken  d92d4xxxxxxxxxxxxx15f52' \
  --header 'Content-Type: application/json'
```

## Response Parameters

### HTTP Code 200

#### Response Body: `application/json`

`JSON Object`

- **id** `string`: Unique identifier string for the behavior alert (e.g., '101').
- **label** `string`: Short human-readable display name of the behavior alert (e.g., 'Suspicious Script Execution').
- **description** `string`: Detailed description explaining what the behavior alert detects and why it is significant.

### HTTP Code 400

#### Response Body: `application/json`

`JSON Object`

- **errorCode** `string`: EDRCOMMON001 — Internal server error occurred while retrieving the behavior alert list.
- **errorMessage** `string`: General internal error message.

### HTTP Code 429

#### Response Body: `application/json`

`JSON Object`

- **errorCode** `string`: Rate limit error code.  
  IAM0019 — Returned when the API call threshold is exceeded within the defined duration window.
- **errorMessage** `string`: Rate limit exceeded message with guidance on when to retry.

### Possible Response Codes

- **200**: HTTP code
- **400**: HTTP code
- **429**: HTTP code

### Sample Response: HTTP 200

List of available behavior alert definitions

```json
[
  {
    "description": "Detects execution of scripts from unusual locations or with encoded payloads",
    "id": "101",
    "label": "Suspicious Script Execution"
  },
  {
    "description": "Detects attempts to dump credentials from memory or the registry",
    "id": "102",
    "label": "Credential Dumping"
  }
]
```

### Sample Response: HTTP 400

Unexpected server-side error

```json
{
  "errorMessage": "Exception while getting behaviorAlerts values",
  "errorCode": "EDRCOMMON001"
}
```

### Sample Response: HTTP 429

API call threshold exceeded

```json
{
  "errorCode": "IAM0019",
  "url": "/edr/api/ext/exclusioncfg/behavior_alerts",
  "errorMsg": "The URL /edr/api/ext/exclusioncfg/behavior_alerts was called too many times. Please retry after a while."
}
```

## Rate Limits

![](https://www.zohowebstatic.com/sites/zweb/images/people/ico-help.png)

**Duration:** 1 minute | **Threshold:** 30 | **Lock period:** 5 minutes

Duration - Time window for the threshold.  
Threshold - Number of API calls allowed within the specified duration.  
Lock Period - Wait time before consecutive API requests.