GET - Exclusions by ID

Prev Next

Overview

This endpoint retrieves the full details for a single detection exclusion using its unique ID. Target a specific rule by its exclusionId in the path. The response is a single object containing all settings for that exclusion, including its name, description, and expression. Use this API to verify the exact criteria of a specific exclusion. It's the standard method for fetching the current state of a rule before you update it, or to confirm that a new exclusion was created with the correct parameters. This API provides on-demand access to individual exclusion rules, enabling precise and automated validation within your policy management workflows.

Authentication

Authentication type: Bearer Token, API Key.

You can create a token using client credentials obtained through the developer portal. The API Key (x-api-key) is provided in your onboarding email or on the API Access Management page.

Path (or URL)

GET https://{Trellix EDR_gateway_URL}/edr/v2/remediation/exclusions/{exclusionId}

Example — {exclusionId}: 8e63d190-51e5-4f10-8367-e84f58795e4d

Request

Request headers
Authorization: Bearer <your_bearer_token>
Content-Type: application/vnd.api+json
x-api-key: <your_api_key>
Accept-Encoding: gzip
  • Authorization: This header is used to authenticate your request. You need to replace <your_bearer_token> with the actual token you generate.

  • Content-Type: This header tells the server that the request body format is json:api. Even though this specific call has no request body, the API requires this header.

  • x-api-key: This is a custom header required by the Trellix API for authentication. You'll need to replace <your_api_key> with the key from your onboarding email or the API Access Management page.

  • Accept-Encoding: This is an optional header you can include to tell the server you can accept a compressed response (using gzip), which can make the data transfer faster.

Request parameters

Parameters

Data type/Values

Description

exclusionId

string

Unique identifier for threat exclusion.

Accept-Encoding

string

Enable GZIP Compression to return compressed data.

Example: gzip, deflate, br

Response

Response example
{
  "jsonapi": {
    "version": "1.0"
  },
  "meta": {
    "totalResourceCount": 1
  },
  "data": {
    "type": "threatExclusion",
    "id": "666ccb51-a80c-4536-80c1-f658a1b89b73",
    "attributes": {
      "name": "RuntimeBroker.exe",
      "description": "CMDLINE for Datagenerator executable",
      "expression": [
        "[process:command_line='C:\\Windows\\System32\\gsdhfagsf.exe -Embedding']"
      ],
      "created": "2023-08-29T09:23:08.025273",
      "updated": "2023-08-29T09:23:08.025273"
    }
  }
}

Response codes

Status

Response

Description

200

OK

Your request was processed successfully. The server has returned the requested data.

400

Bad request

The server couldn't understand your request, likely due to a syntax error or an invalid parameter.

401

Access denied request

Your request was rejected because it lacks valid authentication credentials. Check your API key and token.

403

Forbidden

You are not authorized to access this resource. While your credentials may be valid, you don't have the necessary permissions.

404

Not Found

The specific resource or endpoint you requested does not exist.

415

Unsupported Media Type

The server rejected your request because the data format (Content-Type) is not supported.

429

Too Many Requests

You've exceeded the rate limit by sending too many requests in a short period. The Retry-After header in the response will tell you how long to wait before trying again.

500

Internal Server Error

Something went wrong on the server's end. This is not an issue with your request.