# Retrieve a paginated list of EDR alerts grouped by threat name

Returns a paginated list of EDR alerts grouped by SHA256 value. Each record represents a unique threat type with aggregated device count and alert counts per severity and detection engine. Suitable for dashboards and executive summaries. Use Get EDR Grouped Alert Devices to drill down into devices affected by a specific threat group.

## Endpoints

`GET /edr/api/view/grouped_alerts`

## Request URL

`https://{serverurl}/edr/api/view/grouped_alerts`

## Scope

`DesktopCentralCloud.EDR.READ`

## Header

`Authorization: Zoho-oauthtoken d92d4xxxxxxxxxxxxx15f52`

## Request Parameters

### Request Headers

- **Accept** (`string`, Mandatory): `application/json`

### Query Parameters

- **alert_status** (`string`, Optional): Filter grouped alerts by status.
  - `0` - All
  - `1` - Unresolved
  - `3` - Resolved
- **sha256** (`string`, Optional): Filter grouped alerts by the SHA-256 hash of the incident's primary file. Get SHA-256 from [Get Alerts details](https://www.manageengine.com/products/desktop-central/help/api/cloud/edrview-alerts-get-alerts.html).
- **incidentName** (`string`, Optional): Filter grouped alerts by incident or threat cluster name (partial match supported, e.g., `example-incident`).
- **page** (`string`, Optional): Page number for pagination. Defaults to `1`.
- **pageLimit** (`string`, Optional): Number of records per page. Default is `25`, maximum is `1000`.

## Sample Request

```curl
curl --request GET \
  --url https://appdomains/edr/api/view/grouped_alerts \
  --header 'Accept: application/json' \
  --header 'Authorization: Zoho-oauthtoken  d92d4xxxxxxxxxxxxx15f52'
```

## Response Parameters

### HTTP Code 200

Response Body: `application/json`

`JSON Object`

- **status** (`string`): Response status. `success` if the request completed successfully, `failure` if an error occurred.
- **totalRecords** (`string`): Total number of records matching the applied filters.
- **totalPages** (`string`): Total number of pages available based on the current page limit.
- **metadata** (`JSON Object`): Pagination metadata containing the current page number and page limit.
- **Links** (`JSON Object`): Navigation links to the next and previous pages of results.
- **messageResponse** (`JSON Object`): Actual grouped alert item response.

### HTTP Code 400

Response Body: `application/json`

`JSON Object`

- **errorCode** (`string`): `EDRCOMMON001` — Internal server error occurred while retrieving the grouped alert list.
- **errorMessage** (`string`): General internal error message.

### HTTP Code 429

Response Body: `application/json`

`JSON Object`

- **errorCode** (`string`): Rate limit error code.
  - `IAM0019` — Returned when the API call threshold is exceeded within the allowed duration window.
- **errorMessage** (`string`): Rate limit exceeded message with guidance on when to retry.

## Possible Response Codes

- **200**: HTTP code
- **400**: HTTP code
- **429**: HTTP code

## Sample Response: HTTP 200

Paginated list of alerts grouped by threat name and detection source

```json
{
  "metadata": {
    "limit": 25,
    "page": 3
  },
  "totalRecords": "51",
  "messageResponse": [
    {
      "incident_name_transform": "f_000001",
      "customerinfo_customer_id": "1000000000000001",
      "telemetry_hunting_alert_count": "0",
      "exfiltration_alert_count": "0",
      "incident_ticket_notset": "3",
      "telemetry_custom_ioc_alert_count": "0",
      "medium_alert_count": "0",
      "incident_resolved": "0",
      "low_alert_count": "0",
      "incident_id_transform": "5000000000000001",
      "incident_ticket_false_positive": "0",
      "sha256_transform": "B2C3D4E5F6A1B2C3D4E5F6A1B2C3D4E5F6A1B2C3D4E5F6A1B2C3D4E5F6A1B2C3",
      "detectedtime_transform": "Jan 15, 2025 10:30 AM",
      "critical_alert_count_transform": 0,
      "behaviour_alert_count": "0",
      "third_party_av_alert_count": "0",
      "incident_unresolved_transform": 0,
      "telemetry_unknown_alert_count": "0",
      "ransomware_alert_count_transform": 0,
      "high_alert_count": "3",
      "ml_alert_count": "3",
      "telemetry_global_ioc_alert_count": "0",
      "devicecount_transform": "1",
      "incident_ticket_true_positive": "0",
      "script_alert_count": "0",
      "customer_name": "John Doe",
      "customer_id": "1000000000000001"
    }
  ],
  "totalPages": 3,
  "Links": {
    "next": "null",
    "prev": "/edr/api/view/grouped_alerts?page=2&pageLimit=25"
  },
  "status": "success"
}
```

## Sample Response: HTTP 400

Unexpected server-side error

```json
{
  "errorMessage": "Exception while retrieving grouped alert list",
  "errorCode": "EDRCOMMON001"
}
```

## Sample Response: HTTP 429

API call threshold exceeded

```json
{
  "errorCode": "IAM0019",
  "url": "/edr/api/view/grouped_alerts",
  "errorMsg": "The URL /edr/api/view/grouped_alerts was called too many times. Please retry after a while."
}
```

![ ](https://www.zohowebstatic.com/sites/zweb/images/people/ico-help.png)

**Duration:** 1 minute | **Threshold:** 30 | **Lock period:** 5 minutes

Duration - Time window for the threshold.  
Threshold - Number of API calls allowed within the specified duration.  
Lock Period - Wait time before consecutive API requests.