Update an existing EDR exclusion rule

Open in ChatGPT Open in ChatGPT to ask questions about this page
Open in Claude Open in Claude to ask questions about this page
Copy as MarkdownCopy this page as markdown to use with AI assistants
View as Markdown Open this page as markdown in a new tab

Updates an existing exclusion rule identified by the exclusionId path parameter. Validates pattern correctness and checks for duplicate entries, excluding the record being modified.

Request URL

https://{serverurl}/edr/api/ext/exclusion/{exclusion_id}

Scope

DesktopCentralCloud.EDR.UPDATECopied!

Header

Authorization: Zoho-oauthtoken d92d4xxxxxxxxxxxxx15f52

Request Parameters

- Request Headers

Content-TypestringMandatory
application/jsonapplication/jsonCopied!

- Path Parameters

exclusion_idstringMandatory

A unique identifier assigned to each exclusion that is added, get exclusion_id from Get Exclusion details .

- Request Body

application/json
JSON Object
Hide Sub-Attributes
dataJSON ObjectOptional

The exclusion rule definition object containing the type, detection source, and matching value.

Show Sub-Attributes
exclusion_typestringMandatory

Type of exclusion.
1 = Signer Certificate,
2 = SHA-256 Hash,
3 = Executable Path,
4 = Glob Pattern.

detection_sourcestringMandatory

The detection engine to exclude from.
0 - Select All.
1 - Ransomware Detection Engine
2 - Behavior Detection Engine
3 - DeepAV Engine
4 - Third Party AV Alert
5 - Exfiltration Detection Engine Other values apply to the NGAV/Behaviour engine.

signer_certificatestringOptional

Signer certificate thumbprint (40-char hex). Required when exclusion_type = 1.

sha_256stringOptional

SHA-256 hash of the file (64-char hex). Required when exclusion_type = 2.

executable_pathstringOptional

Absolute Windows executable path (e.g., C:\Program Files\App\app.exe). Required when exclusion_type = 3.

globstringOptional

Glob pattern for file path matching (e.g., C:\Logs*.log). Required when exclusion_type = 4.

exclusion_namestringOptional

A human-readable label for the exclusion rule.

pe_internal_namestringOptional

Internal PE (Portable Executable) name of the file.

behaviour_idJSON ArrayOptional

List of behaviour alert IDs to exclude. Fetch available IDs from Get Behavior Alerts .

Show Sub-Attributes
JSON Object
Show Sub-Attributes
behaviour_id_itemstringOptional

A single behaviour alert ID string (e.g., '101'). Fetch from Get Behavior Alerts .

allowed_pathJSON ArrayOptional

List of file paths permitted alongside this exclusion.

Show Sub-Attributes
JSON Object
Show Sub-Attributes
allowed_path_itemstringOptional

A single allowed file path string (e.g., 'C:\Logs\').

command_lineJSON ArrayOptional

Command-line argument values associated with the exclusion.

Show Sub-Attributes
JSON Object
Show Sub-Attributes
command_line_itemstringOptional

A single command-line argument string (e.g., '--safe-mode').

commandJSON ArrayOptional

PowerShell command values to be excluded.

Show Sub-Attributes
JSON Object
Show Sub-Attributes
command_itemstringOptional

A single PowerShell command string (e.g., 'Get-Process').

Sample Request

Curl
Java
Python
Deluge
PowerShell
Copied!
curl --request PUT \
  --url https://appdomains/edr/api/ext/exclusion/{exclusion_id} \
  --header 'Authorization: Zoho-oauthtoken  d92d4xxxxxxxxxxxxx15f52' \
  --header 'Content-Type: application/json' \
  --data '{}'

Sample Request Body

Update exclusion to use SHA-256 hash

Copied!
  {
    "data": {
      "exclusion_type": 2,
      "exclusion_name": "Updated Hash Exclusion",
      "sha_256": "abc123def456abc123def456abc123def456abc123def456abc123def456abc1",
      "detection_source": 1
    }
  }
                
Show full

Response Parameters

- HTTP code 400

Response Body - application/json
JSON Object
Hide Sub-Attributes
errorCodestring

Exclusion validation error code.
EDREX0002 or IAM0025 — exclusion value does not match the required regex pattern.
EDRCFG0001 — the selected detection_source is not supported for the user's product role.
EDRCOMMON001 — Internal server error occurred while do the operation.

errorMessagestring

Detailed message explaining the specific validation failure.

- HTTP code 409

Response Body - application/json
JSON Object
Hide Sub-Attributes
errorCodestring

EDREX0001 — Another exclusion with identical data already exists for this customer.

errorMessagestring

Message indicating the exclusion rule conflicts with an existing entry.

- HTTP code 429

Response Body - application/json
JSON Object
Hide Sub-Attributes
errorCodestring

Rate limit error code.
IAM0019 — Returned when the API call threshold is exceeded within the defined duration window.

errorMessagestring

Rate limit exceeded message with guidance on when to retry.

Possible Response Codes

200HTTP code
400HTTP code
409HTTP code
429HTTP code

Sample Response: HTTP 200

Copied!
200 OK
Show full

Sample Response: HTTP 400

Exclusion value fails regex validation

Copied!
  {
    "errorCode": "IAM0025",
    "url": "/edr/api/ext/exclusion/{exclusion_id}",
    "errorMsg": "{param_name} is an invalid parameter format."
  }
                
Show full

User role does not permit the selected detection source

Copied!
  {
    "errorMessage": "Unsupported Engine for this Product",
    "errorCode": "EDRCFG0001"
  }
                
Show full

Server-side error during exclusion processing

Copied!
  {
    "errorMessage": "Exception while Editing exclusion",
    "errorCode": "EDRCOMMON001"
  }
                
Show full

Sample Response: HTTP 409

Another exclusion with the same data already exists

Copied!
  {
    "errorMessage": "Rule already added",
    "errorCode": "EDREX0001"
  }
                
Show full

Sample Response: HTTP 429

API call threshold exceeded

Copied!
  {
    "errorCode": "IAM0019",
    "url": "/edr/api/ext/exclusion/{exclusion_id}",
    "errorMsg": "The URL /edr/api/ext/exclusion/{exclusion_id} was called too many times. Please retry after a while."
  }
                
Show full

Duration: 1 minute | Threshold: 30 | Lock period: 5 minutes

Duration - Time window for the threshold.
Threshold - Number of API calls allowed within the specified duration.
Lock Period - Wait time before consecutive API requests.