Retrieve a comprehensive EDR dashboard summary

Open in ChatGPT Open in ChatGPT to ask questions about this page
Open in Claude Open in Claude to ask questions about this page
Copy as MarkdownCopy this page as markdown to use with AI assistants
View as Markdown Open this page as markdown in a new tab

Returns a comprehensive dashboard summary of the EDR product's current state including device scan coverage, incident statistics, device status classifications, and agent version distribution. In MSP environments, omitting the CUSTOMERID header aggregates data across all tenant customers.

Request URL

https://{serverurl}/edr/api/ext/over_all_summary

Scope

DesktopCentralCloud.EDR.READCopied!

Header

Authorization: Zoho-oauthtoken d92d4xxxxxxxxxxxxx15f52

Request Parameters

- Request Headers

Content-TypestringMandatory
application/jsonapplication/jsonCopied!

Sample Request

Curl
Java
Python
Deluge
PowerShell
Copied!
curl --request GET \
  --url https://appdomains/edr/api/ext/over_all_summary \
  --header 'Authorization: Zoho-oauthtoken  d92d4xxxxxxxxxxxxx15f52' \
  --header 'Content-Type: application/json'

Response Parameters

- HTTP code 200

Response Body - application/json
JSON Object
Hide Sub-Attributes
scanned_deviceslong

Number of managed devices that have been scanned by the EDR agent.

not_scanned_deviceslong

Number of managed devices that have not yet been scanned.

unresolved_alerts_countstring

Total number of open (unresolved) security incidents.

mitigated_alerts_countstring

Total number of resolved or mitigated incidents (total minus unresolved).

devices_with_unresolved_alertsstring

Number of unique devices that have at least one unresolved security incident.

alerts_last_24hstring

Number of new security incidents raised in the last 24 hours.

managed_componentsstring

Total number of managed endpoints or components enrolled in EDR.

total_affected_devicesstring

Total number of devices that have been affected by any detected threat.

total_affected_usersstring

Total number of users whose devices have been affected by any detected threat.

device_status_summaryJSON Object

Breakdown of managed devices by their current EDR agent status.

Show Sub-Attributes
yet_to_enablelong

Number of devices where the EDR agent is installed but not yet activated.

activelong

Number of devices with an active and communicating EDR agent.

quarantinedlong

Number of devices currently quarantined by the EDR system.

inactivelong

Number of devices where the EDR agent is installed but not communicating.

device_version_summaryJSON Object

Breakdown of managed devices by their EDR agent version status.

Show Sub-Attributes
latest_versionlong

Number of devices running the latest available EDR agent version.

yet_to_contactlong

Number of devices that have not yet checked in with the EDR server.

outdated_versionlong

Number of devices running an older, outdated EDR agent version.

- HTTP code 400

Response Body - application/json
JSON Object
Hide Sub-Attributes
errorCodestring

EDRCOMMON001 — Internal server error occurred while retrieving the EDR overall summary.

errorMessagestring

General internal error message.

- HTTP code 429

Response Body - application/json
JSON Object
Hide Sub-Attributes
errorCodestring

Rate limit error code.
IAM0019 — Returned when the API call threshold is exceeded within the defined duration window.

errorMessagestring

Rate limit exceeded message with guidance on when to retry.

Possible Response Codes

200HTTP code
400HTTP code
429HTTP code

Sample Response: HTTP 200

Overall EDR summary for a single-tenant deployment

Copied!
  {
    "not_scanned_devices": 20,
    "managed_components": 500,
    "unresolved_alerts_count": 15,
    "device_version_summary": {
      "latest_version": 420,
      "yet_to_contact": 30,
      "outdated_version": 50
    },
    "devices_with_unresolved_alerts": 8,
    "alerts_last_24h": 5,
    "device_status_summary": {
      "yet_to_enable": 12,
      "inactive": 23,
      "active": 460,
      "quarantined": 5
    },
    "mitigated_alerts_count": 142,
    "total_affected_devices": 23,
    "scanned_devices": 480,
    "total_affected_users": 11
  }
                
Show full

Sample Response: HTTP 400

Unexpected server-side error

Copied!
  {
    "errorMessage": "Exception while getting dashboard summary through API Explorer",
    "errorCode": "EDRCOMMON001"
  }
                
Show full

Sample Response: HTTP 429

API call threshold exceeded

Copied!
  {
    "errorCode": "IAM0019",
    "url": "/edr/api/ext/over_all_summary",
    "errorMsg": "The URL /edr/api/ext/over_all_summary was called too many times. Please retry after a while."
  }
                
Show full

Duration: 1 minute | Threshold: 30 | Lock period: 5 minutes

Duration - Time window for the threshold.
Threshold - Number of API calls allowed within the specified duration.
Lock Period - Wait time before consecutive API requests.