# Retrieve the list of available behavior alert definitions

Retrieves the list of all available behavior alert definitions that can be used when creating exclusion rules. Each entry provides the behavior alert ID, a human-readable label, and a description. Use the returned IDs to populate the behaviour_id field in exclusion requests.

## Endpoint

`GET /edr/api/ext/exclusioncfg/behavior_alerts`

## Request

### Request URL

`https://{server-hostname}:8383/edr/api/ext/exclusioncfg/behavior_alerts`

### Scope

`EDR.READ`

### Header

`Authorization: d92d4xxxxxxxxxxxxx15f52`

### Request Parameters

#### Request Headers

- **Content-Type** `string` — **Mandatory**
  - `application/json`

#### Query Parameters

- **pageLimit** `integer` — Optional
- **page** `integer` — Optional
- **searchColumn** `string` — Optional
- **searchValue** `string` — Optional

### Sample Request

```curl
curl --request GET \
  --url 'https://appdomain/edr/api/ext/exclusioncfg/behavior_alerts?pageLimit=SOME_INTEGER_VALUE&page=SOME_INTEGER_VALUE&searchColumn=SOME_STRING_VALUE&searchValue=SOME_STRING_VALUE' \
  --header 'Authorization:  d92d4xxxxxxxxxxxxx15f52' \
  --header 'Content-Type: application/json'
```

## Response Parameters

### HTTP Code 200

Response body: `application/json`

`JSON Object`

- **id** `string`
  - Unique identifier string for the behavior alert (e.g., '101').
- **label** `string`
  - Short human-readable display name of the behavior alert (e.g., 'Suspicious Script Execution').
- **description** `string`
  - Detailed description explaining what the behavior alert detects and why it is significant.

### Sample Response: HTTP 200

List of available behavior alert definitions

```json
[
  {
    "description": "Detects execution of scripts from unusual locations or with encoded payloads",
    "id": "101",
    "label": "Suspicious Script Execution"
  },
  {
    "description": "Detects attempts to dump credentials from memory or the registry",
    "id": "102",
    "label": "Credential Dumping"
  }
]
```

### HTTP Code 400

Response body: `application/json`

`JSON Object`

- **errorCode** `string`
  - EDRCOMMON001 — Internal server error occurred while retrieving the behavior alert list.
- **errorMessage** `string`
  - General internal error message.

### Sample Response: HTTP 400

Unexpected server-side error

```json
{
  "errorMessage": "Exception while getting behaviorAlerts values",
  "errorCode": "EDRCOMMON001"
}
```

### HTTP Code 429

Response body: `application/json`

`JSON Object`

- **errorCode** `string`
  - Rate limit error code.
  - IAM0019 — Returned when the API call threshold is exceeded within the defined duration window.
- **errorMessage** `string`
  - Rate limit exceeded message with guidance on when to retry.

### Sample Response: HTTP 429

API call threshold exceeded

```json
{
  "errorCode": "IAM0019",
  "url": "/edr/api/ext/exclusioncfg/behavior_alerts",
  "errorMsg": "The URL /edr/api/ext/exclusioncfg/behavior_alerts was called too many times. Please retry after a while."
}
```

## Rate Limits

![](https://www.zohowebstatic.com/sites/zweb/images/people/ico-help.png)

**Duration:** 1 minute | **Threshold:** 30 | **Lock period:** 5 minutes

Duration - Time window for the threshold.  
Threshold - Number of API calls allowed within the specified duration.  
Lock Period - Wait time before consecutive API requests.