Retrieve a paginated list of individual EDR security alerts

Returns a paginated list of individual EDR security alerts. Each record includes the affected device, alert type, detection engine, severity, current ticket status, threat details, and timestamps. Supports filtering by detection source, last 24-hour alerts, alert name, and device name.

Endpoints

get /edr/api/view/alerts

Copy full URL

Request URL

https://{serverurl}/edr/api/view/alerts

Scope

DesktopCentralCloud.EDR.READCopied!

Header

Authorization: Zoho-oauthtoken d92d4xxxxxxxxxxxxx15f52

Request Parameters

- Request Headers

AcceptstringMandatory

application/jsonCopied!

- Query Parameters

alert_statusstringOptional

Filter grouped alerts by status.
0 - All,
1 - Unresolved,
3 - Resolved.

detection_sourcestringOptional

Filter alerts by detection engine source code.
0 - All,
1 - Ransomware,
2 - Behaviour,
3 - MC,
5 - Exfilter,
6 - Script.

filterLast24HrAlertsbooleanOptional

When true, returns only alerts raised in the last 24 hours.

alertNamestringOptional

Filter alerts by process or file name (partial match supported, e.g., 'example.exe').

deviceNamestringOptional

Filter alerts by the hostname of the affected device (partial match supported, e.g., 'example-hostname').

pagestringOptional

Page number for pagination. Defaults to 1.

pageLimitstringOptional

Number of records per page. Default is 25, maximum is 1000.

Sample Request

Curl

Java

Python

Deluge

PowerShell

Copied!

curl --request GET \
  --url https://appdomains/edr/api/view/alerts \
  --header 'Accept: application/json' \
  --header 'Authorization: Zoho-oauthtoken  d92d4xxxxxxxxxxxxx15f52'

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
import java.io.IOException;
import java.net.http.HttpTimeoutException;

public class Main {
  public static void main(String[] args) {

    HttpRequest request = HttpRequest.newBuilder()
        .uri(URI.create("https://appdomains/edr/api/view/alerts"))
        .header("Accept", "application/json")
        .header("Authorization", "Zoho-oauthtoken  d92d4xxxxxxxxxxxxx15f52")
        .method("GET", HttpRequest.BodyPublishers.noBody())
        .build();
    HttpResponse response = HttpClient.newHttpClient().send(request, HttpResponse.BodyHandlers.ofString());
    System.out.println(response.body());
  
  }
}

import http.client

conn = http.client.HTTPSConnection("appdomains")

headers = {
    'Accept': "application/json",
    'Authorization': "Zoho-oauthtoken  d92d4xxxxxxxxxxxxx15f52"
    }

conn.request("GET", "/edr/api/view/alerts", headers=headers)

res = conn.getresponse()
data = res.read()

print(data.decode("utf-8"))


    headersMap = Map();
    headersMap.put("Accept", "application/json");

    response = invokeUrl
    [
        url: "https://appDomains/edr/api/view/alerts"
        type: GET
        headers: headersMap
        connection: connection_name
    ]

    info response;

$headers=@{}
$headers.Add("Accept", "application/json")
$headers.Add("Authorization", "Zoho-oauthtoken  d92d4xxxxxxxxxxxxx15f52")
$response = Invoke-WebRequest -Uri 'https://appdomains/edr/api/view/alerts' -Method GET -Headers $headers

Response Parameters

- HTTP code 200

Response Body - application/json

JSON Object

Hide Sub-Attributes

statusstring

Response status. 'success' if the request completed successfully, 'failure' if an error occurred.

totalRecordsstring

Total number of records matching the applied filters.

totalPagesstring

Total number of pages available based on the current page limit.

metadataJSON Object

Pagination metadata containing the current page number and page limit.

Show Sub-Attributes

limitstring

Number of records returned per page.

pagestring

Current page number (1-based).

LinksJSON Object

Navigation links to the next and previous pages of results.

Show Sub-Attributes

nextstring

URL to the next page of results, in the form '{api_url}?page=&pageLimit='. null if the current page is the last page or there are no records to retrieve.

prevstring

URL to the previous page of results, in the form '{api_url}?page=&pageLimit='. null if the current page is the first page or there are no records to retrieve.

messageResponseJSON Object

Actual alert item response.

Show Sub-Attributes

incident_idstring

Unique identifier of the parent security incident this alert belongs to.

alert_id_transformstring

Human-readable display version of the alert_id field.

alert_name_transformstring

Human-readable display version of the alert_name field.

alert_image_path_transformstring

Human-readable display version of the alert_image_path field.

sha256_transformstring

Human-readable display version of the sha256 field.

process_idstring

Internal process identifier associated with this alert.

alert_process_idstring

Process ID of the process that triggered the alert.

reason_transformstring

Human-readable display version of the reason field (e.g., 'DeepAV Engine').

severity_transformstring

Human-readable display version of the severity field.
1 = Critical,
2 = High,
3 = Medium,
4 = Low.

ticket_status_transformstring

Human-readable display version of the ticket_status field.
1 = Open (not set),
2 = False Positive,
3 = True Positive.

component_idstring

EDR component ID of the device where the alert was raised.

managededrcomponent_component_idstring

Duplicate reference field for the EDR component identifier.

component_statusstring

Current EDR agent status code on the affected device.

edrincidentalertmapping_alert_idstring

Alert ID as mapped in the incident-alert relation table.

detection_time_transformstring

Human-readable display version of the detection_time field (e.g., 'Jan 15, 2025 10:30 AM').

error_statusstring

Error status if any. null if no error occurred.

resource_idstring

Unique resource identifier of the affected device.

resource_resource_idstring

Duplicate reference field for the resource identifier.

resource_name_transformstring

Human-readable display version of the resource_name field.

customer_idstring

Customer or tenant identifier.

customer_namestring

Display name of the customer or tenant.

- HTTP code 400

Response Body - application/json

JSON Object

Hide Sub-Attributes

errorCodestring

EDRCOMMON001 — Internal server error occurred while retrieving the EDR alert list.

errorMessagestring

General internal error message.

- HTTP code 429

Response Body - application/json

JSON Object

Hide Sub-Attributes

errorCodestring

Rate limit error code.
IAM0019 — Returned when the API call threshold is exceeded within the allowed duration window.

errorMessagestring

Rate limit exceeded message with guidance on when to retry.

Possible Response Codes

200HTTP code

400HTTP code

429HTTP code

Sample Response: HTTP 200

Paginated list of individual EDR security alerts

Copied!

  "{                                  \"metadata\": {                                      \"limit\": 25,                                               \"page\": 3                                  },                                          \"totalRecords\": \"51\",                                 \"totalPages\": 3,                                  \"status\": \"success\",                                  \"Links\": {                                      \"next\": \"null\",                                      \"prev\": \"/edr/api/view/alerts?page=2&pageLimit=25\"                                  },                                  \"messageResponse\": [                                      {                                          \"incident_id\": \"6000000000000001\",                                          \"alert_id_transform\": \"7000000000000001\",                                          \"alert_name_transform\": \"sample_process.exe\",                                          \"alert_image_path_transform\": \"C:\\Program Files\\Microsoft\\Edge\\Application\\sample_process.exe\",                                          \"sha256_transform\": \"A1B2C3D4E5F6A1B2C3D4E5F6A1B2C3D4E5F6A1B2C3D4E5F6A1B2C3D4E5F6A1B2\",                                          \"process_id\": \"4000000000000001\",                                          \"alert_process_id\": \"4000000000000001\",                                          \"reason_transform\": \"DeepAV Engine\",                                          \"severity_transform\": \"2\",                                          \"ticket_status_transform\": \"1\",                                          \"component_id\": \"3000000000000001\",                                          \"managededrcomponent_component_id\": \"3000000000000001\",                                          \"component_status\": \"1\",                                          \"edrincidentalertmapping_alert_id\": \"7000000000000001\",                                          \"detection_time_transform\": \"Jan 15, 2025 10:30 AM\",                                          \"error_status\": null,                                          \"resource_id\": \"2000000000000001\",                                          \"resource_resource_id\": \"2000000000000001\",                                          \"resource_name_transform\": \"DESKTOP-EXAMPLE\",                                          \"customer_id\": \"1000000000000001\",                                          \"customer_name\": \"John Doe\"                                      }                                  ]                                  }"

▼ Show full

Sample Response: HTTP 400

Unexpected server-side error

Copied!

  {
    "errorMessage": "Exception while retrieving EDR alert list",
    "errorCode": "EDRCOMMON001"
  }

▼ Show full

Sample Response: HTTP 429

API call threshold exceeded

Copied!

  {
    "errorCode": "IAM0019",
    "url": "/edr/api/view/alerts",
    "errorMsg": "The URL /edr/api/view/alerts was called too many times. Please retry after a while."
  }

▼ Show full

Duration: 1 minute | Threshold: 30 | Lock period: 5 minutes

Duration - Time window for the threshold.
Threshold - Number of API calls allowed within the specified duration.
Lock Period - Wait time before consecutive API requests.