Retrieve a paginated list of all configured EDR exclusion rules

Open in ChatGPT Open in ChatGPT to ask questions about this page
Open in Claude Open in Claude to ask questions about this page
Copy as MarkdownCopy this page as markdown to use with AI assistants
View as Markdown Open this page as markdown in a new tab

Returns a paginated list of all configured EDR exclusion rules for the authenticated customer. Each record includes the exclusion type, detection source, the excluded value, and metadata such as creation time and the user who added the rule. Supports filtering by engine type, exclusion type, and exclusion name.

Endpoints

Request URL

https://{serverurl}/edr/api/view/exclusion

Scope

DesktopCentralCloud.EDR.READCopied!

Header

Authorization: Zoho-oauthtoken d92d4xxxxxxxxxxxxx15f52

Request Parameters

- Request Headers

AcceptstringMandatory
application/jsonapplication/jsonCopied!

- Query Parameters

engineTypestringOptional

Filter exclusions by detection engine type.
0 - All,
1 - NGAV,
2 - Behaviour,
3 - Ransomware,
5 - Exfiltrate.

exclusionTypestringOptional

Filter exclusions by type.
1 - Signer Certificate,
2 - SHA-256 Hash,
3 - Executable Path,
4 - Glob Pattern,
5 - PE Internal Name.

exclusionNamestringOptional

Filter exclusions by name (partial match supported - e.g., 'example.exe').

pagestringOptional

Page number for pagination. Defaults to 1.

pageLimitstringOptional

Number of records per page. Default is 25, maximum is 1000.

Sample Request

Curl
Java
Python
Deluge
PowerShell
Copied!
curl --request GET \
  --url https://appdomains/edr/api/view/exclusion \
  --header 'Accept: application/json' \
  --header 'Authorization: Zoho-oauthtoken  d92d4xxxxxxxxxxxxx15f52'

Response Parameters

- HTTP code 200

Response Body - application/json
JSON Object
Hide Sub-Attributes
statusstring

Response status. 'success' if the request completed successfully, 'failure' if an error occurred.

totalRecordsstring

Total number of records matching the applied filters.

totalPagesstring

Total number of pages available based on the current page limit.

metadataJSON Object

Pagination metadata containing the current page number and page limit.

Show Sub-Attributes
limitstring

Number of records returned per page.

pagestring

Current page number (1-based).

LinksJSON Object

Navigation links to the next and previous pages of results.

Show Sub-Attributes
nextstring

URL to the next page of results, in the form '{api_url}?page=&pageLimit='. null if the current page is the last page or there are no records to retrieve.

prevstring

URL to the previous page of results, in the form '{api_url}?page=&pageLimit='. null if the current page is the first page or there are no records to retrieve.

messageResponseJSON Object

Actual exclusion item response.

Show Sub-Attributes
exclusion_idstring

Unique identifier of the exclusion rule.

exclusion_exclusion_idstring

Duplicate reference field for the exclusion rule identifier.

exclusion_types_transformstring

Human-readable display version of the exclusion_types field (e.g., 'Signer Certificate').

exclusion_name_transformstring

Human-readable display version of the exclusion_name field.

value_transformstring

Human-readable display version of the value field.

detection_source_transformstring

Human-readable display version of the detection_source field (e.g., 'Ransomware Engine').

alert_id_transformstring

Human-readable display version of the alert_id field (e.g., 'User-Applied').

edr_config_idstring

Internal EDR config record ID associated with this exclusion.

exclusion_group_idstring

Group ID this exclusion belongs to.

edrexclusiongrouptoexclusion_exclusion_group_idstring

Duplicate reference field for the exclusion group ID.

process_execution_internal_namestring

Internal PE (Portable Executable) name of the excluded process.

first_name_transformstring

Human-readable display version of the first_name field.

user_idstring

User ID of the person who created the exclusion rule.

last_modified_bystring

User ID of the person who last modified the exclusion rule.

added_timestring

Unix timestamp (ms) when the exclusion rule was created.

last_updated_time_transformstring

Human-readable display version of the last_updated_time field (e.g., 'Jan 15, 2025 01:30 PM').

edrsuspiciousevent_sup_event_idstring

Linked suspicious event ID if this exclusion originated from an alert event. null if not linked to an event.

customer_idstring

Customer or tenant identifier this exclusion belongs to.

- HTTP code 400

Response Body - application/json
JSON Object
Hide Sub-Attributes
errorCodestring

EDRCOMMON001 — Internal server error occurred while retrieving the EDR exclusion list.

errorMessagestring

General internal error message.

- HTTP code 429

Response Body - application/json
JSON Object
Hide Sub-Attributes
errorCodestring

Rate limit error code.
IAM0019 — Returned when the API call threshold is exceeded within the allowed duration window.

errorMessagestring

Rate limit exceeded message with guidance on when to retry.

Possible Response Codes

200HTTP code
400HTTP code
429HTTP code

Sample Response: HTTP 200

Paginated list of configured EDR exclusion rules

Copied!
  {
    "metadata": {
      "limit": 25,
      "page": 3
    },
    "totalRecords": "51",
    "messageResponse": [
      {
        "value_transform": "a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2",
        "added_time": "1700012600000",
        "edrexclusiongrouptoexclusion_exclusion_group_id": "9000000000000003",
        "exclusion_group_id": "9000000000000003",
        "detection_source_transform": "Ransomware Engine",
        "alert_id_transform": "User-Applied",
        "exclusion_name_transform": "edr ex",
        "edrsuspiciousevent_sup_event_id": null,
        "last_modified_by": "1000000000000002",
        "last_updated_time_transform": "Jan 15, 2025 01:30 PM",
        "exclusion_id": "9000000000000002",
        "exclusion_exclusion_id": "9000000000000002",
        "first_name_transform": "John",
        "exclusion_types_transform": "Signer Certificate",
        "user_id": "1000000000000002",
        "process_execution_internal_name": "C:/example/process",
        "edr_config_id": "9000000000000001",
        "customer_id": "1000000000000001"
      }
    ],
    "totalPages": 3,
    "Links": {
      "next": "null",
      "prev": "/edr/api/view/exclusion?page=2&pageLimit=25"
    },
    "status": "success"
  }
                
Show full

Sample Response: HTTP 400

Unexpected server-side error

Copied!
  {
    "errorMessage": "Exception while retrieving EDR exclusion list",
    "errorCode": "EDRCOMMON001"
  }
                
Show full

Sample Response: HTTP 429

API call threshold exceeded

Copied!
  {
    "errorCode": "IAM0019",
    "url": "/edr/api/view/exclusion",
    "errorMsg": "The URL /edr/api/view/exclusion was called too many times. Please retry after a while."
  }
                
Show full

Duration: 1 minute | Threshold: 30 | Lock period: 5 minutes

Duration - Time window for the threshold.
Threshold - Number of API calls allowed within the specified duration.
Lock Period - Wait time before consecutive API requests.