Retrieve a paginated list of EDR alerts grouped by threat name

Returns a paginated list of EDR alerts grouped by SHA256 value. Each record represents a unique threat type with aggregated device count and alert counts per severity and detection engine. Suitable for dashboards and executive summaries. Use Get EDR Grouped Alert Devices to drill down into devices affected by a specific threat group.

Endpoints

get /edr/api/view/grouped_alerts

Copy full URL

Request URL

https://{serverurl}/edr/api/view/grouped_alerts

Scope

DesktopCentralCloud.EDR.READCopied!

Header

Authorization: Zoho-oauthtoken d92d4xxxxxxxxxxxxx15f52

Request Parameters

- Request Headers

AcceptstringMandatory

application/jsonCopied!

- Query Parameters

alert_statusstringOptional

Filter grouped alerts by status.
0 - All,
1 - Unresolved,
3 - Resolved.

sha256stringOptional

Filter grouped alerts by the SHA-256 hash of the incident's primary file. Get SHA-256 from Get Alerts details .

incidentNamestringOptional

Filter grouped alerts by incident or threat cluster name (partial match supported, e.g., 'example-incident').

pagestringOptional

Page number for pagination. Defaults to 1.

pageLimitstringOptional

Number of records per page. Default is 25, maximum is 1000.

Sample Request

Curl

Java

Python

Deluge

PowerShell

Copied!

curl --request GET \
  --url https://appdomains/edr/api/view/grouped_alerts \
  --header 'Accept: application/json' \
  --header 'Authorization: Zoho-oauthtoken  d92d4xxxxxxxxxxxxx15f52'

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
import java.io.IOException;
import java.net.http.HttpTimeoutException;

public class Main {
  public static void main(String[] args) {

    HttpRequest request = HttpRequest.newBuilder()
        .uri(URI.create("https://appdomains/edr/api/view/grouped_alerts"))
        .header("Accept", "application/json")
        .header("Authorization", "Zoho-oauthtoken  d92d4xxxxxxxxxxxxx15f52")
        .method("GET", HttpRequest.BodyPublishers.noBody())
        .build();
    HttpResponse response = HttpClient.newHttpClient().send(request, HttpResponse.BodyHandlers.ofString());
    System.out.println(response.body());
  
  }
}

import http.client

conn = http.client.HTTPSConnection("appdomains")

headers = {
    'Accept': "application/json",
    'Authorization': "Zoho-oauthtoken  d92d4xxxxxxxxxxxxx15f52"
    }

conn.request("GET", "/edr/api/view/grouped_alerts", headers=headers)

res = conn.getresponse()
data = res.read()

print(data.decode("utf-8"))


    headersMap = Map();
    headersMap.put("Accept", "application/json");

    response = invokeUrl
    [
        url: "https://appDomains/edr/api/view/grouped_alerts"
        type: GET
        headers: headersMap
        connection: connection_name
    ]

    info response;

$headers=@{}
$headers.Add("Accept", "application/json")
$headers.Add("Authorization", "Zoho-oauthtoken  d92d4xxxxxxxxxxxxx15f52")
$response = Invoke-WebRequest -Uri 'https://appdomains/edr/api/view/grouped_alerts' -Method GET -Headers $headers

Response Parameters

- HTTP code 200

Response Body - application/json

JSON Object

Hide Sub-Attributes

statusstring

Response status. 'success' if the request completed successfully, 'failure' if an error occurred.

totalRecordsstring

Total number of records matching the applied filters.

totalPagesstring

Total number of pages available based on the current page limit.

metadataJSON Object

Pagination metadata containing the current page number and page limit.

Show Sub-Attributes

limitstring

Number of records returned per page.

pagestring

Current page number (1-based).

LinksJSON Object

Navigation links to the next and previous pages of results.

Show Sub-Attributes

nextstring

URL to the next page of results, in the form '{api_url}?page=&pageLimit='. null if the current page is the last page or there are no records to retrieve.

prevstring

URL to the previous page of results, in the form '{api_url}?page=&pageLimit='. null if the current page is the first page or there are no records to retrieve.

messageResponseJSON Object

Actual grouped alert item response.

Show Sub-Attributes

incident_idstring

Unique identifier of the grouped incident (threat cluster).

incident_id_transformstring

Human-readable display version of the incident_id field.

incident_name_transformstring

Human-readable display version of the incident_name field.

sha256_transformstring

Human-readable display version of the sha256 field.

detectedtime_transformstring

Human-readable display version of the detectedtime field (e.g., 'Jan 15, 2025 10:30 AM').

devicecount_transformstring

Human-readable display version of the devicecount field.

high_alert_countstring

Number of high-severity alerts in this group.

medium_alert_countstring

Number of medium-severity alerts in this group.

low_alert_countstring

Number of low-severity alerts in this group.

critical_alert_count_transformstring

Human-readable display version of the critical_alert_count field.

ml_alert_countstring

Number of machine-learning-based (DeepAV) alerts in this group.

behaviour_alert_countstring

Number of behaviour-based alerts in this group.

script_alert_countstring

Number of script-based alerts in this group.

ransomware_alert_count_transformstring

Human-readable display version of the ransomware_alert_count field.

exfiltration_alert_countstring

Number of data exfiltration alerts in this group.

telemetry_hunting_alert_countstring

Number of threat hunting telemetry alerts in this group.

telemetry_custom_ioc_alert_countstring

Number of custom IOC telemetry alerts in this group.

telemetry_global_ioc_alert_countstring

Number of global IOC telemetry alerts in this group.

telemetry_unknown_alert_countstring

Number of unknown telemetry category alerts in this group.

third_party_av_alert_countstring

Number of third-party AV alerts in this group.

incident_unresolved_transformstring

Human-readable display version of the incident_unresolved field.

incident_resolvedstring

Number of resolved alerts in this group.

incident_ticket_notsetstring

Number of alerts in this group with no ticket status set.

incident_ticket_true_positivestring

Number of alerts in this group marked as True Positive.

incident_ticket_false_positivestring

Number of alerts in this group marked as False Positive.

customerinfo_customer_idstring

Internal reference field for the customer identifier.

customer_idstring

Customer or tenant identifier.

customer_namestring

Display name of the customer or tenant.

- HTTP code 400

Response Body - application/json

JSON Object

Hide Sub-Attributes

errorCodestring

EDRCOMMON001 — Internal server error occurred while retrieving the grouped alert list.

errorMessagestring

General internal error message.

- HTTP code 429

Response Body - application/json

JSON Object

Hide Sub-Attributes

errorCodestring

Rate limit error code.
IAM0019 — Returned when the API call threshold is exceeded within the allowed duration window.

errorMessagestring

Rate limit exceeded message with guidance on when to retry.

Possible Response Codes

200HTTP code

400HTTP code

429HTTP code

Sample Response: HTTP 200

Paginated list of alerts grouped by threat name and detection source

Copied!

  {
    "metadata": {
      "limit": 25,
      "page": 3
    },
    "totalRecords": "51",
    "messageResponse": [
      {
        "incident_name_transform": "f_000001",
        "customerinfo_customer_id": "1000000000000001",
        "telemetry_hunting_alert_count": "0",
        "exfiltration_alert_count": "0",
        "incident_ticket_notset": "3",
        "telemetry_custom_ioc_alert_count": "0",
        "medium_alert_count": "0",
        "incident_resolved": "0",
        "low_alert_count": "0",
        "incident_id_transform": "5000000000000001",
        "incident_ticket_false_positive": "0",
        "sha256_transform": "B2C3D4E5F6A1B2C3D4E5F6A1B2C3D4E5F6A1B2C3D4E5F6A1B2C3D4E5F6A1B2C3",
        "detectedtime_transform": "Jan 15, 2025 10:30 AM",
        "critical_alert_count_transform": 0,
        "behaviour_alert_count": "0",
        "third_party_av_alert_count": "0",
        "incident_unresolved_transform": 0,
        "telemetry_unknown_alert_count": "0",
        "ransomware_alert_count_transform": 0,
        "high_alert_count": "3",
        "ml_alert_count": "3",
        "telemetry_global_ioc_alert_count": "0",
        "devicecount_transform": "1",
        "incident_ticket_true_positive": "0",
        "script_alert_count": "0",
        "customer_name": "John Doe",
        "customer_id": "1000000000000001"
      }
    ],
    "totalPages": 3,
    "Links": {
      "next": "null",
      "prev": "/edr/api/view/grouped_alerts?page=2&pageLimit=25"
    },
    "status": "success"
  }

▼ Show full

Sample Response: HTTP 400

Unexpected server-side error

Copied!

  {
    "errorMessage": "Exception while retrieving grouped alert list",
    "errorCode": "EDRCOMMON001"
  }

▼ Show full

Sample Response: HTTP 429

API call threshold exceeded

Copied!

  {
    "errorCode": "IAM0019",
    "url": "/edr/api/view/grouped_alerts",
    "errorMsg": "The URL /edr/api/view/grouped_alerts was called too many times. Please retry after a while."
  }

▼ Show full

Duration: 1 minute | Threshold: 30 | Lock period: 5 minutes

Duration - Time window for the threshold.
Threshold - Number of API calls allowed within the specified duration.
Lock Period - Wait time before consecutive API requests.