# Bulk mark EDR suspicious event alerts as True Positive or False Positive

Updates the ticket status of one or more suspicious event alerts in bulk. Allows external integrations and ticketing systems to mark EDR alerts as True Positive or False Positive, and optionally trigger file restoration for ARW-licensed customers. Alerts that already carry the requested ticket status are rejected to prevent redundant True Positive → True Positive or False Positive → False Positive transitions. Processing is asynchronous — the update is queued, and DB updates, agent commands, event log entries, and timeline entries are generated per alert.

## Endpoint

[POST /edr/api/ext/alert/ticket_status](https://www.manageengine.com/products/desktop-central/help/api/cloud/edrincident-set-suspicious-event-ticket-status.html)

## Request URL

`https://{serverurl}/edr/api/ext/alert/ticket_status`

`{serverurl}`: [OAuth Authentication Endpoint Domain](https://www.manageengine.com/products/desktop-central/help/api/cloud/oauth-authentication-endpoint-domain.html)

## Scope

`DesktopCentralCloud.EDR.UPDATE`

## Header

`Authorization: Zoho-oauthtoken d92d4xxxxxxxxxxxxx15f52`

## Request Parameters

### Request Headers

- **Content-Type** (string, Mandatory): `application/json`

### Request Body

`application/json`

- JSON Object
  - **alertIds** (JSON Array, Mandatory): List of suspicious event alert IDs whose ticket status is to be updated. Fetch `alert_id` from [Get EDR Alerts](https://www.manageengine.com/products/desktop-central/help/api/cloud/edrview-alerts-get-alerts.html).
  - **ticketStatus** (string, Mandatory): Ticket status code string. `'2'` = False Positive, `'3'` = True Positive.
  - **action** (JSON Object, Optional): Optional remediation actions to trigger when marking the alert(s) as True Positive.
  - **notes** (string, Optional): Optional free-text notes describing the reason for the ticket status change, recorded for audit purposes.

## Sample Request

```curl
curl --request POST \
  --url https://appdomains/edr/api/ext/alert/ticket_status \
  --header 'Authorization: Zoho-oauthtoken  d92d4xxxxxxxxxxxxx15f52' \
  --header 'Content-Type: application/json' \
  --data '{"alertIds":[7001,7002],"ticketStatus":"2"}'
```

## Sample Request Body

### Mark multiple alerts as False Positive

```json
{
  "notes": "Benign files",
  "alertIds": [
    7001,
    7002
  ],
  "ticketStatus": "2"
}
```

### Mark as True Positive, restore ARW-quarantined files, and record notes

```json
{
  "notes": "Confirmed malicious script - restoring quarantined files",
  "alertIds": [
    9502000000078064
  ],
  "ticketStatus": "3",
  "action": {
    "restore": false,
    "cleanUp": false,
    "kill": true
  }
}
```

## Response Parameters

### HTTP Code 400

Response Body — `application/json`

- JSON Object
  - **errorCode** (string): Error code.
    - `EDRCOMMON004` — `alertIds` is missing or empty, or one or more alerts already carry the requested ticket status (True Positive → True Positive or False Positive → False Positive transitions are rejected).
    - `EDRCOMMON001` — Internal server error occurred while updating the alert ticket status.
  - **errorMessage** (string): Detailed message explaining the specific validation or internal failure.

### HTTP Code 401

Response Body — `application/json`

- JSON Object
  - **errorCode** (string): `EDRSETTING003` — Restore action was requested but the customer does not have an eligible Anti-Ransomware (ARW) license.
  - **errorMessage** (string): Unauthorized access message indicating the ARW license requirement.

### HTTP Code 429

Response Body — `application/json`

- JSON Object
  - **errorCode** (string): Rate limit error code.
    - `IAM0019` — Returned when the API call threshold is exceeded within the defined duration window.
  - **errorMessage** (string): Rate limit exceeded message with guidance on when to retry.

## Possible Response Codes

- `200` HTTP code
- `400` HTTP code
- `401` HTTP code
- `429` HTTP code

## Sample Response: HTTP 200

```text
200 OK
```

## Sample Response: HTTP 400

### alertIds not supplied

```json
{
  "errorMessage": "alertIds is required",
  "errorCode": "EDRCOMMON004"
}
```

### Alert already marked with the requested ticket status

```json
{
  "errorMessage": "Alert 7001 is already marked as False Positive",
  "errorCode": "EDRCOMMON004"
}
```

### Unexpected server-side error

```json
{
  "errorMessage": "Exception while updating alert ticket status",
  "errorCode": "EDRCOMMON001"
}
```

## Sample Response: HTTP 401

### Restore action requires ARW license

```json
{
  "errorMessage": "Unauthorized",
  "errorCode": "EDRSETTING003"
}
```

## Sample Response: HTTP 429

### API call threshold exceeded

```json
{
  "errorCode": "IAM0019",
  "url": "/edr/api/ext/alert/ticket_status",
  "errorMsg": "The URL /edr/api/ext/alert/ticket_status was called too many times. Please retry after a while."
}
```

## Rate Limits

![ ](https://www.zohowebstatic.com/sites/zweb/images/people/ico-help.png)

**Duration:** 1 minute | **Threshold:** 30 | **Lock period:** 5 minutes

Duration - Time window for the threshold.  
Threshold - Number of API calls allowed within the specified duration.  
Lock Period - Wait time before consecutive API requests.