Overview
This endpoint retrieves the full details for a single detection exclusion using its unique ID. Target a specific rule by its exclusionId in the path. The response is a single object containing all settings for that exclusion, including its name, description, and expression. Use this API to verify the exact criteria of a specific exclusion. It's the standard method for fetching the current state of a rule before you update it, or to confirm that a new exclusion was created with the correct parameters. This API provides on-demand access to individual exclusion rules, enabling precise and automated validation within your policy management workflows.
Authentication
Authentication type: Bearer Token, API Key.
You can create a token using client credentials obtained through the developer portal. The API Key (x-api-key) is provided in your onboarding email or on the API Access Management page.
Path (or URL)
GET https://{Trellix EDR_gateway_URL}/edr/v2/remediation/exclusions/{exclusionId}Example — {exclusionId}: 8e63d190-51e5-4f10-8367-e84f58795e4d
Request
Request headers
Authorization: Bearer <your_bearer_token> Content-Type: application/vnd.api+json x-api-key: <your_api_key> Accept-Encoding: gzip
Authorization: This header is used to authenticate your request. You need to replace
<your_bearer_token>with the actual token you generate.Content-Type: This header tells the server that the request body format is
json:api. Even though this specific call has no request body, the API requires this header.x-api-key: This is a custom header required by the Trellix API for authentication. You'll need to replace
<your_api_key>with the key from your onboarding email or the API Access Management page.Accept-Encoding: This is an optional header you can include to tell the server you can accept a compressed response (using gzip), which can make the data transfer faster.
Request parameters
Parameters | Data type/Values | Description |
|---|---|---|
exclusionId | string | Unique identifier for threat exclusion. |
Accept-Encoding | string | Enable GZIP Compression to return compressed data. Example: gzip, deflate, br |
Response
Response example
{
"jsonapi": {
"version": "1.0"
},
"meta": {
"totalResourceCount": 1
},
"data": {
"type": "threatExclusion",
"id": "666ccb51-a80c-4536-80c1-f658a1b89b73",
"attributes": {
"name": "RuntimeBroker.exe",
"description": "CMDLINE for Datagenerator executable",
"expression": [
"[process:command_line='C:\\Windows\\System32\\gsdhfagsf.exe -Embedding']"
],
"created": "2023-08-29T09:23:08.025273",
"updated": "2023-08-29T09:23:08.025273"
}
}
}Response codes
Status | Response | Description |
|---|---|---|
200 | OK | Your request was processed successfully. The server has returned the requested data. |
400 | Bad request | The server couldn't understand your request, likely due to a syntax error or an invalid parameter. |
401 | Access denied request | Your request was rejected because it lacks valid authentication credentials. Check your API key and token. |
403 | Forbidden | You are not authorized to access this resource. While your credentials may be valid, you don't have the necessary permissions. |
404 | Not Found | The specific resource or endpoint you requested does not exist. |
415 | Unsupported Media Type | The server rejected your request because the data format |
429 | Too Many Requests | You've exceeded the rate limit by sending too many requests in a short period. The |
500 | Internal Server Error | Something went wrong on the server's end. This is not an issue with your request. |