# Bulk mark EDR Grouped Alerts as True Positive or False Positive

Updates the ticket status of one or more hash-based grouped alerts in bulk. Allows external integrations and ticketing systems to mark EDR grouped alerts as True Positive or False Positive, and optionally trigger file restoration for ARW-licensed customers. Grouped alerts that are already resolved are skipped automatically. An event log entry is automatically created for every ticket status change.

## Endpoint

`POST /edr/api/ext/hash/ticket_status`

## Request URL

`https://{serverurl}/edr/api/ext/hash/ticket_status`

For the server URL, see [OAuth Authentication Endpoint Domain](https://www.manageengine.com/products/desktop-central/help/api/cloud/oauth-authentication-endpoint-domain.html).

## Scope

`DesktopCentralCloud.EDR.UPDATE`

## Header

`Authorization: Zoho-oauthtoken d92d4xxxxxxxxxxxxx15f52`

## Request Parameters

### Request Headers

- **Content-Type** (`string`, Mandatory): `application/json`

### Request Body

`application/json`

- `JSON Object`
  - **incidentIds** (`JSON Array`, Mandatory): List of incident IDs whose ticket status is to be updated. Fetch `incident_id` from [Get EDR Grouped Alerts](https://www.manageengine.com/products/desktop-central/help/api/cloud/edrview-alerts-get-grouped-alerts.html).
  - **ticketStatus** (`string`, Mandatory): Ticket status code string.
    - True Positive: `3`
    - False Positive: `2`
  - **action** (`JSON Object`, Mandatory): Optional remediation actions to trigger when marking the incident(s) as True Positive.
  - **notes** (`string`, Optional): Optional free-text notes describing the reason for the ticket status change, recorded for audit purposes.

## Sample Request

```curl
curl --request POST \
  --url https://appdomains/edr/api/ext/hash/ticket_status \
  --header 'Authorization: Zoho-oauthtoken  d92d4xxxxxxxxxxxxx15f52' \
  --header 'Content-Type: application/json' \
  --data '{"ticketStatus":"2","incidentIds":[4001,4002,4003]}'
```

## Sample Request Body

### Mark multiple incidents as False Positive

```json
{
  "notes": "Benign files",
  "ticketStatus": "2",
  "incidentIds": [
    4001,
    4002,
    4003
  ]
}
```

### Mark as True Positive, restore ARW-quarantined files, and record notes

```json
{
  "notes": "Confirmed ransomware - restoring encrypted files",
  "ticketStatus": "3",
  "action": {
    "restore": false,
    "cleanUp": false,
    "kill": true
  },
  "incidentIds": [
    "9502000000078291"
  ]
}
```

## Response Parameters

### HTTP Code 400

Response body: `application/json`

- `JSON Object`
  - **errorCode** (`string`): Error code.
    - `EDRCOMMON004` — `incidentIds`/`incidentId` is missing or empty, or all supplied incidents are already resolved.
    - `EDRCOMMON001` — Internal server error occurred while updating the incident ticket status.
  - **errorMessage** (`string`): Detailed message explaining the specific validation or internal failure.

### HTTP Code 401

Response body: `application/json`

- `JSON Object`
  - **errorCode** (`string`): `EDRSETTING003` — Restore action was requested but the customer does not have an eligible Anti-Ransomware (ARW) license.
  - **errorMessage** (`string`): Unauthorized access message indicating the ARW license requirement.

### HTTP Code 429

Response body: `application/json`

- `JSON Object`
  - **errorCode** (`string`): Rate limit error code.
    - `IAM0019` — Returned when the API call threshold is exceeded within the defined duration window.
  - **errorMessage** (`string`): Rate limit exceeded message with guidance on when to retry.

## Possible Response Codes

- `200` HTTP code
- `400` HTTP code
- `401` HTTP code
- `429` HTTP code

## Sample Response: HTTP 200

```text
200 OK
```

## Sample Response: HTTP 400

### incidentIds/incidentId not supplied

```json
{
  "errorMessage": "incidentIds is required",
  "errorCode": "EDRCOMMON004"
}
```

### All supplied incidents are already resolved

```json
{
  "errorMessage": "All selected incidents are already resolved",
  "errorCode": "EDRCOMMON004"
}
```

### Unexpected server-side error

```json
{
  "errorMessage": "Exception while updating incident ticket status",
  "errorCode": "EDRCOMMON001"
}
```

## Sample Response: HTTP 401

### Restore action requires ARW license

```json
{
  "errorMessage": "Unauthorized",
  "errorCode": "EDRSETTING003"
}
```

## Sample Response: HTTP 429

### API call threshold exceeded

```json
{
  "errorCode": "IAM0019",
  "url": "/edr/api/ext/hash/ticket_status",
  "errorMsg": "The URL /edr/api/ext/hash/ticket_status was called too many times. Please retry after a while."
}
```

## Rate Limits

![Help](https://www.zohowebstatic.com/sites/zweb/images/people/ico-help.png)

**Duration:** 1 minute | **Threshold:** 30 | **Lock period:** 5 minutes

Duration - Time window for the threshold.  
Threshold - Number of API calls allowed within the specified duration.  
Lock Period - Wait time before consecutive API requests.