# Retrieve the list of devices affected by a specific grouped threat

Returns the list of devices affected by a specific grouped alerts. This is the drill-down API for Get EDR Grouped Alerts — it returns all individual devices impacted by a threat cluster, along with the alert count and latest detection time per device. Supports filtering by device name and domain name.

## Endpoint

`GET /edr/api/view/grouped_alert_devices`

## Request

### Request URL

`https://{server-hostname}:8383/edr/api/view/grouped_alert_devices`

### Scope

`EDR.READ`

### Header

`Authorization: d92d4xxxxxxxxxxxxx15f52`

### Request Parameters

#### Request Headers

- **Accept** (`string`, Mandatory): `application/json`

#### Query Parameters

- **deviceName** (`string`, Optional): Filter devices within the group by hostname (partial match supported, e.g., 'example-hostname'). Fetch device hostnames from [Get EDR Devices](https://www.manageengine.com/products/desktop-central/help/api/onpremise/edrview-devices-get-edrdevices.html).
- **domainName** (`string`, Optional): Filter devices within the group by domain name (partial match supported, e.g., 'example.com').
- **page** (`string`, Optional): Page number for pagination. Defaults to 1.
- **pageLimit** (`string`, Optional): Number of records per page. Default is 25, maximum is 1000.

### Sample Request

```curl
curl --request GET \
  --url 'https://appdomain/edr/api/view/grouped_alert_devices?deviceName=SOME_STRING_VALUE&domainName=SOME_STRING_VALUE&page=SOME_STRING_VALUE&pageLimit=SOME_STRING_VALUE' \
  --header 'Accept: application/json' \
  --header 'Authorization:  d92d4xxxxxxxxxxxxx15f52'
```

## Response Parameters

### HTTP Code 200

Response body: `application/json`

- `status` (`string`): Response status. 'success' if the request completed successfully, 'failure' if an error occurred.
- `totalRecords` (`string`): Total number of records matching the applied filters.
- `totalPages` (`string`): Total number of pages available based on the current page limit.
- `metadata` (`JSON Object`): Pagination metadata containing the current page number and page limit.
- `Links` (`JSON Object`): Navigation links to the next and previous pages of results.
- `messageResponse` (`JSON Object`): Actual grouped alert device item response.

#### Sample Response: HTTP 200

Paginated list of devices affected by a specific threat group

```json
{
  "metadata": {
    "limit": 25,
    "page": 3
  },
  "totalRecords": "51",
  "messageResponse": [
    {
      "resource_name_transform": "DESKTOP-EXAMPLE",
      "component_id": "3000000000000001",
      "managed_status": "61",
      "managedcomputer_resource_id": "2000000000000001",
      "component_status_transform": "1",
      "nearest_recovery": "0",
      "last_sync_time": null,
      "resource_resource_id": "2000000000000001",
      "is_suspended": "false",
      "managededrcomponenttoerrcode_component_id": null,
      "recovery_status": "0",
      "agent_uninstalled_on": "-1",
      "agent_version": "11.x.xxxx.xx.W",
      "process_started_time_transform": "Jan 15, 2025 10:29 AM",
      "isolation_status": null,
      "name": null,
      "resource_id": "2000000000000001",
      "alert_count_transform": "10",
      "error_code": null,
      "customer_id": "1000000000000001",
      "domain_netbios_name_transform": "CORP",
      "alert_raised_time_transform": "Jan 15, 2025 10:30 AM",
      "status_update_time": "1700012700000",
      "status": "2"
    }
  ],
  "totalPages": 3,
  "Links": {
    "next": "null",
    "prev": "/edr/api/view/grouped_alert_devices?page=2&pageLimit=25"
  },
  "status": "success"
}
```

### HTTP Code 400

Response body: `application/json`

- `errorCode` (`string`): EDRCOMMON001 — Internal server error occurred while retrieving devices for the specified alert group.
- `errorMessage` (`string`): General internal error message.

#### Sample Response: HTTP 400

Unexpected server-side error

```json
{
  "errorMessage": "Exception while retrieving devices for the specified alert group",
  "errorCode": "EDRCOMMON001"
}
```

### HTTP Code 429

Response body: `application/json`

- `errorCode` (`string`): Rate limit error code. IAM0019 — Returned when the API call threshold is exceeded within the allowed duration window.
- `errorMessage` (`string`): Rate limit exceeded message with guidance on when to retry.

#### Sample Response: HTTP 429

API call threshold exceeded

```json
{
  "errorCode": "IAM0019",
  "url": "/edr/api/view/grouped_alert_devices",
  "errorMsg": "The URL /edr/api/view/grouped_alert_devices was called too many times. Please retry after a while."
}
```

## Rate Limit

**Duration:** 1 minute | **Threshold:** 30 | **Lock period:** 5 minutes

Duration - Time window for the threshold.
Threshold - Number of API calls allowed within the specified duration.
Lock Period - Wait time before consecutive API requests.