# Add a new EDR exclusion rule

Adds a new exclusion rule to the EDR system. The rule prevents the EDR engine from raising alerts on trusted files, certificates, paths, or behaviours. Validates pattern format and checks for duplicate entries before saving.

## Endpoint

`POST /edr/api/ext/exclusion`

## Request URL

`https://{server-hostname}:8383/edr/api/ext/exclusion`

## Scope

`EDR.WRITE`

### Header

`Authorization: d92d4xxxxxxxxxxxxx15f52`

## Request Parameters

### Request Headers

- **Content-Type** — `string` — **Mandatory**
  - `application/json`

### Query Parameters

- **pageLimit** — `integer` — Optional
- **page** — `integer` — Optional
- **searchColumn** — `string` — Optional
- **searchValue** — `string` — Optional

### Request Body

`application/json`

- JSON Object
  - **data** — `JSON Object` — Optional
    - The exclusion rule definition object containing the type, detection source, and matching value.
  - **exclusion_type** — `string` — **Mandatory**
    - Type of exclusion.
    - `1` = Signer Certificate
    - `2` = SHA-256 Hash
    - `3` = Executable Path
    - `4` = Glob Pattern
  - **detection_source** — `string` — **Mandatory**
    - The detection engine to exclude from.
    - `0` - Select All.
    - `1` - Ransomware Detection Engine
    - `2` - Behavior Detection Engine
    - `3` - DeepAV Engine
    - `4` - Third Party AV Alert
    - `5` - Exfiltration Detection Engine Other values apply to the NGAV/Behaviour engine.
  - **signer_certificate** — `string` — Optional
    - Signer certificate thumbprint (40-char hex). Required when `exclusion_type = 1`.
  - **sha_256** — `string` — Optional
    - SHA-256 hash of the file (64-char hex). Required when `exclusion_type = 2`.
  - **executable_path** — `string` — Optional
    - Absolute Windows executable path (e.g., `C:\Program Files\App\app.exe`). Required when `exclusion_type = 3`.
  - **glob** — `string` — Optional
    - Glob pattern for file path matching (e.g., `C:\Logs*.log`). Required when `exclusion_type = 4`.
  - **exclusion_name** — `string` — Optional
    - A human-readable label for the exclusion rule.
  - **pe_internal_name** — `string` — Optional
    - Internal PE (Portable Executable) name of the file.
  - **behaviour_id** — `JSON Array` — Optional
    - List of behaviour alert IDs to exclude.
  - **allowed_path** — `JSON Array` — Optional
    - List of file paths permitted alongside this exclusion.
  - **command_line** — `JSON Array` — Optional
    - Command-line argument values associated with the exclusion.
  - **command** — `JSON Array` — Optional
    - PowerShell command values to be excluded.

## Sample Request

```curl
curl --request POST \
  --url 'https://appdomain/edr/api/ext/exclusion?pageLimit=SOME_INTEGER_VALUE&page=SOME_INTEGER_VALUE&searchColumn=SOME_STRING_VALUE&searchValue=SOME_STRING_VALUE' \
  --header 'Authorization:  d92d4xxxxxxxxxxxxx15f52' \
  --header 'Content-Type: application/json' \
  --data '{"data":{"signer_certificate":"A1B2C3D4E5F6A1B2C3D4E5F6A1B2C3D4E5F6A1B2","exclusion_type":1,"exclusion_name":"Trusted Certificate","detection_source":1}}'
```

### Sample Request Body

#### Add exclusion by signer certificate

```json
{
  "data": {
    "signer_certificate": "A1B2C3D4E5F6A1B2C3D4E5F6A1B2C3D4E5F6A1B2",
    "exclusion_type": 1,
    "exclusion_name": "Trusted Certificate",
    "detection_source": 1
  }
}
```

#### Add exclusion by executable path with behaviour IDs

```json
{
  "data": {
    "behaviour_id": [
      "101",
      "102"
    ],
    "exclusion_type": 3,
    "exclusion_name": "MyApp Exclusion",
    "detection_source": 1,
    "executable_path": "C:\\Program Files\\MyApp\\myapp.exe",
    "allowed_path": [
      "C:\\Logs\\"
    ],
    "command_line": [
      "--safe-mode"
    ],
    "command": [
      "Get-Process"
    ]
  }
}
```

#### Add exclusion by SHA-256 hash

```json
{
  "data": {
    "exclusion_type": 2,
    "exclusion_name": "Trusted Binary",
    "sha_256": "abc123def456abc123def456abc123def456abc123def456abc123def456abc1",
    "detection_source": 1
  }
}
```

## Response Parameters

### HTTP Code 400

#### Response Body — application/json

- JSON Object
  - **errorCode** — `string`
    - Exclusion validation error code.
    - `EDREX0002` or `IAM0025` — exclusion value does not match the required regex pattern.
    - `EDRCFG0001` — the selected `detection_source` is not supported for the user's product role.
    - `EDRCOMMON001` — Internal server error occurred while do the operation.
  - **errorMessage** — `string`
    - Detailed message explaining the specific validation failure.

### HTTP Code 409

#### Response Body — application/json

- JSON Object
  - **errorCode** — `string`
    - `EDREX0001` — Duplicate exclusion rule. An exclusion with the same data already exists for this customer.
  - **errorMessage** — `string`
    - Message indicating the exclusion rule already exists.

### HTTP Code 429

#### Response Body — application/json

- JSON Object
  - **errorCode** — `string`
    - Rate limit error code.
    - `IAM0019` — Returned when the API call threshold is exceeded within the defined duration window.
  - **errorMessage** — `string`
    - Rate limit exceeded message with guidance on when to retry.

## Sample Responses

### HTTP 200

```text
200 OK
```

### HTTP 400

#### Exclusion value fails regex validation

```json
{
  "errorCode": "IAM0025",
  "url": "/edr/api/ext/exclusion",
  "errorMsg": "{param_name} is an invalid parameter format."
}
```

#### User role does not permit the selected detection source

```json
{
  "errorMessage": "Unsupported Engine for this Product",
  "errorCode": "EDRCFG0001"
}
```

#### Server-side error during exclusion processing

```json
{
  "errorCode": "EDRCOMMON001",
  "errorMsg": "Exception while deploying Exclusion config"
}
```

### HTTP 409

#### Exclusion rule already exists

```json
{
  "errorMessage": "Rule already added",
  "errorCode": "EDREX0001"
}
```

### HTTP 429

#### API call threshold exceeded

```json
{
  "errorCode": "IAM0019",
  "url": "/edr/api/ext/exclusion",
  "errorMsg": "The URL /edr/api/ext/exclusion was called too many times. Please retry after a while."
}
```

## Rate Limit

![](https://www.zohowebstatic.com/sites/zweb/images/people/ico-help.png)

**Duration:** 1 minute | **Threshold:** 30 | **Lock period:** 5 minutes

Duration - Time window for the threshold.  
Threshold - Number of API calls allowed within the specified duration.  
Lock Period - Wait time before consecutive API requests.