Bulk mark EDR suspicious event alerts as True Positive or False Positive

Open in ChatGPT Open in ChatGPT to ask questions about this page
Open in Claude Open in Claude to ask questions about this page
Copy as MarkdownCopy this page as markdown to use with AI assistants
View as Markdown Open this page as markdown in a new tab

Updates the ticket status of one or more suspicious event alerts in bulk. Allows external integrations and ticketing systems to mark EDR alerts as True Positive or False Positive, and optionally trigger file restoration for ARW-licensed customers. Alerts that already carry the requested ticket status are rejected to prevent redundant True Positive → True Positive or False Positive → False Positive transitions. Processing is asynchronous — the update is queued, and DB updates, agent commands, event log entries, and timeline entries are generated per alert.

Request URL

https://{serverurl}/edr/api/ext/alert/ticket_status

Scope

DesktopCentralCloud.EDR.UPDATECopied!

Header

Authorization: Zoho-oauthtoken d92d4xxxxxxxxxxxxx15f52

Request Parameters

- Request Headers

Content-TypestringMandatory
application/jsonapplication/jsonCopied!

- Request Body

application/json
JSON Object
Hide Sub-Attributes
alertIdsJSON ArrayMandatory

List of suspicious event alert IDs whose ticket status is to be updated. Fetch alert_id from Get EDR Alerts .

Show Sub-Attributes
JSON Object
Show Sub-Attributes
alertIdlongMandatory

Unique identifier of a suspicious event alert. Fetch from Get EDR Alerts .

ticketStatusstringMandatory

Ticket status code string. '2' = False Positive, '3' = True Positive.

actionJSON ObjectOptional

Optional remediation actions to trigger when marking the alert(s) as True Positive.

Show Sub-Attributes
killbooleanOptional

When true, terminates the process associated with the incident or alert on the affected device(s).

cleanUpbooleanOptional

When true, removes the malicious file(s) associated with the incident or alert from the affected device(s).

restorebooleanOptional

When true, restores files quarantined by Anti-Ransomware (ARW). Requires ARW license on the customer account.

notesstringOptional

Optional free-text notes describing the reason for the ticket status change, recorded for audit purposes.

Sample Request

Curl
Java
Python
Deluge
PowerShell
Copied!
curl --request POST \
  --url https://appdomains/edr/api/ext/alert/ticket_status \
  --header 'Authorization: Zoho-oauthtoken  d92d4xxxxxxxxxxxxx15f52' \
  --header 'Content-Type: application/json' \
  --data '{"alertIds":[7001,7002],"ticketStatus":"2"}'

Sample Request Body

Mark multiple alerts as False Positive

Copied!
  {
    "notes": "Benign files",
    "alertIds": [
      7001,
      7002
    ],
    "ticketStatus": "2"
  }
                
Show full

Mark as True Positive, restore ARW-quarantined files, and record notes

Copied!
  {
    "notes": "Confirmed malicious script - restoring quarantined files",
    "alertIds": [
      9502000000078064
    ],
    "ticketStatus": "3",
    "action": {
      "restore": false,
      "cleanUp": false,
      "kill": true
    }
  }
                
Show full

Response Parameters

- HTTP code 400

Response Body - application/json
JSON Object
Hide Sub-Attributes
errorCodestring

Error code.
EDRCOMMON004 — alertIds is missing or empty, or one or more alerts already carry the requested ticket status (True Positive → True Positive or False Positive → False Positive transitions are rejected).
EDRCOMMON001 — Internal server error occurred while updating the alert ticket status.

errorMessagestring

Detailed message explaining the specific validation or internal failure.

- HTTP code 401

Response Body - application/json
JSON Object
Hide Sub-Attributes
errorCodestring

EDRSETTING003 — Restore action was requested but the customer does not have an eligible Anti-Ransomware (ARW) license.

errorMessagestring

Unauthorized access message indicating the ARW license requirement.

- HTTP code 429

Response Body - application/json
JSON Object
Hide Sub-Attributes
errorCodestring

Rate limit error code.
IAM0019 — Returned when the API call threshold is exceeded within the defined duration window.

errorMessagestring

Rate limit exceeded message with guidance on when to retry.

Possible Response Codes

200HTTP code
400HTTP code
401HTTP code
429HTTP code

Sample Response: HTTP 200

Copied!
200 OK
Show full

Sample Response: HTTP 400

alertIds not supplied

Copied!
  {
    "errorMessage": "alertIds is required",
    "errorCode": "EDRCOMMON004"
  }
                
Show full

Alert already marked with the requested ticket status

Copied!
  {
    "errorMessage": "Alert 7001 is already marked as False Positive",
    "errorCode": "EDRCOMMON004"
  }
                
Show full

Unexpected server-side error

Copied!
  {
    "errorMessage": "Exception while updating alert ticket status",
    "errorCode": "EDRCOMMON001"
  }
                
Show full

Sample Response: HTTP 401

Restore action requires ARW license

Copied!
  {
    "errorMessage": "Unauthorized",
    "errorCode": "EDRSETTING003"
  }
                
Show full

Sample Response: HTTP 429

API call threshold exceeded

Copied!
  {
    "errorCode": "IAM0019",
    "url": "/edr/api/ext/alert/ticket_status",
    "errorMsg": "The URL /edr/api/ext/alert/ticket_status was called too many times. Please retry after a while."
  }
                
Show full

Duration: 1 minute | Threshold: 30 | Lock period: 5 minutes

Duration - Time window for the threshold.
Threshold - Number of API calls allowed within the specified duration.
Lock Period - Wait time before consecutive API requests.