Retrieve the list of devices affected by a specific grouped threat

Open in ChatGPT Open in ChatGPT to ask questions about this page
Open in Claude Open in Claude to ask questions about this page
Copy as MarkdownCopy this page as markdown to use with AI assistants
View as Markdown Open this page as markdown in a new tab

Returns the list of devices affected by a specific grouped alerts. This is the drill-down API for Get EDR Grouped Alerts — it returns all individual devices impacted by a threat cluster, along with the alert count and latest detection time per device. Supports filtering by device name and domain name.

Request URL

https://{serverurl}/edr/api/view/grouped_alert_devices

Scope

DesktopCentralCloud.EDR.READCopied!

Header

Authorization: Zoho-oauthtoken d92d4xxxxxxxxxxxxx15f52

Request Parameters

- Request Headers

AcceptstringMandatory
application/jsonapplication/jsonCopied!

- Query Parameters

deviceNamestringOptional

Filter devices within the group by hostname (partial match supported, e.g., 'example-hostname'). Fetch device hostnames from Get EDR Devices.

domainNamestringOptional

Filter devices within the group by domain name (partial match supported, e.g., 'example.com').

pagestringOptional

Page number for pagination. Defaults to 1.

pageLimitstringOptional

Number of records per page. Default is 25, maximum is 1000.

Sample Request

Curl
Java
Python
Deluge
PowerShell
Copied!
curl --request GET \
  --url https://appdomains/edr/api/view/grouped_alert_devices \
  --header 'Accept: application/json' \
  --header 'Authorization: Zoho-oauthtoken  d92d4xxxxxxxxxxxxx15f52'

Response Parameters

- HTTP code 200

Response Body - application/json
JSON Object
Hide Sub-Attributes
statusstring

Response status. 'success' if the request completed successfully, 'failure' if an error occurred.

totalRecordsstring

Total number of records matching the applied filters.

totalPagesstring

Total number of pages available based on the current page limit.

metadataJSON Object

Pagination metadata containing the current page number and page limit.

Show Sub-Attributes
limitstring

Number of records returned per page.

pagestring

Current page number (1-based).

LinksJSON Object

Navigation links to the next and previous pages of results.

Show Sub-Attributes
nextstring

URL to the next page of results, in the form '{api_url}?page=&pageLimit='. null if the current page is the last page or there are no records to retrieve.

prevstring

URL to the previous page of results, in the form '{api_url}?page=&pageLimit='. null if the current page is the first page or there are no records to retrieve.

messageResponseJSON Object

Actual grouped alert device item response.

Show Sub-Attributes
resource_name_transformstring

Human-readable display version of the resource_name field.

resource_idstring

Unique resource identifier of the device.

resource_resource_idstring

Duplicate reference field for the resource identifier.

component_idstring

EDR component ID of the affected device.

component_status_transformstring

Human-readable display version of the component_status field.
0 = Not enabled,
1 = Active,
8 = Inactive,
11 = Quarantined.

managedcomputer_resource_idstring

Resource ID as referenced in the managed computer record.

managededrcomponenttoerrcode_component_idstring

Component ID linked to the error code mapping table. null if no error.

domain_netbios_name_transformstring

Human-readable display version of the domain_netbios_name field.

alert_count_transformstring

Human-readable display version of the alert_count field.

alert_raised_time_transformstring

Human-readable display version of the alert_raised_time field (e.g., 'Jan 15, 2025 10:30 AM').

process_started_time_transformstring

Human-readable display version of the process_started_time field (e.g., 'Jan 15, 2025 10:29 AM').

status_update_timestring

Unix timestamp (ms) of the last status change on this device.

statusstring

Device or alert resolution status code.

managed_statusstring

Managed status code of the device.

is_suspendedstring

Whether the device is suspended. 'true' or 'false'.

isolation_statusstring

Current network isolation status of the device. null if not isolated.

nearest_recoverystring

Recovery proximity indicator for the device.

recovery_statusstring

Recovery status code of the device.

error_codestring

Error code on the device. null if no error.

last_sync_timestring

Unix timestamp (ms) of the last sync with the EDR server. null if not synced.

agent_versionstring

Version of the endpoint management agent on this device.

agent_uninstalled_onstring

Timestamp of agent uninstall. '-1' if the agent is still installed.

namestring

Display name of the device, if set. null if not configured.

customer_idstring

Customer or tenant identifier.

- HTTP code 400

Response Body - application/json
JSON Object
Hide Sub-Attributes
errorCodestring

EDRCOMMON001 — Internal server error occurred while retrieving devices for the specified alert group.

errorMessagestring

General internal error message.

- HTTP code 429

Response Body - application/json
JSON Object
Hide Sub-Attributes
errorCodestring

Rate limit error code.
IAM0019 — Returned when the API call threshold is exceeded within the allowed duration window.

errorMessagestring

Rate limit exceeded message with guidance on when to retry.

Possible Response Codes

200HTTP code
400HTTP code
429HTTP code

Sample Response: HTTP 200

Paginated list of devices affected by a specific threat group

Copied!
  {
    "metadata": {
      "limit": 25,
      "page": 3
    },
    "totalRecords": "51",
    "messageResponse": [
      {
        "resource_name_transform": "DESKTOP-EXAMPLE",
        "component_id": "3000000000000001",
        "managed_status": "61",
        "managedcomputer_resource_id": "2000000000000001",
        "component_status_transform": "1",
        "nearest_recovery": "0",
        "last_sync_time": null,
        "resource_resource_id": "2000000000000001",
        "is_suspended": "false",
        "managededrcomponenttoerrcode_component_id": null,
        "recovery_status": "0",
        "agent_uninstalled_on": "-1",
        "agent_version": "11.x.xxxx.xx.W",
        "process_started_time_transform": "Jan 15, 2025 10:29 AM",
        "isolation_status": null,
        "name": null,
        "resource_id": "2000000000000001",
        "alert_count_transform": "10",
        "error_code": null,
        "customer_id": "1000000000000001",
        "domain_netbios_name_transform": "CORP",
        "alert_raised_time_transform": "Jan 15, 2025 10:30 AM",
        "status_update_time": "1700012700000",
        "status": "2"
      }
    ],
    "totalPages": 3,
    "Links": {
      "next": "null",
      "prev": "/edr/api/view/grouped_alert_devices?page=2&pageLimit=25"
    },
    "status": "success"
  }
                
Show full

Sample Response: HTTP 400

Unexpected server-side error

Copied!
  {
    "errorMessage": "Exception while retrieving devices for the specified alert group",
    "errorCode": "EDRCOMMON001"
  }
                
Show full

Sample Response: HTTP 429

API call threshold exceeded

Copied!
  {
    "errorCode": "IAM0019",
    "url": "/edr/api/view/grouped_alert_devices",
    "errorMsg": "The URL /edr/api/view/grouped_alert_devices was called too many times. Please retry after a while."
  }
                
Show full

Duration: 1 minute | Threshold: 30 | Lock period: 5 minutes

Duration - Time window for the threshold.
Threshold - Number of API calls allowed within the specified duration.
Lock Period - Wait time before consecutive API requests.