Datto EDR icon

Datto EDR

Datto EDR (Infocyte): list and manage endpoints/agents, threats/alerts, scans, targets, quarantined files, and run response actions — isolate or scan an endpoint, archive or respond to alerts, restore quarantined files. For endpoint security operations, threat triage, and EDR reporting.

Actions60

Agent → Isolate

AI-generated

Summary

Isolate one or more Datto EDR agents from the network, or release them from isolation, with a single call to the Agents/toggleIsolation endpoint.

Inputs

  • Agent IDs (required) — Comma-separated list of agent IDs. The node splits on commas, trims whitespace and drops empty entries, then sends them as the ids array.
  • Isolate — Boolean, default true. True isolates the agents. False releases them from isolation. Sent as the isolated field.

Output shape

One output item per input item, containing the raw JSON response from the Datto EDR POST Agents/toggleIsolation call.

The response shape is whatever the API returns, and the node doesn't reshape it. If the API returns an empty result, the node emits {found: 0, resource, operation} instead. API errors (401, 403, 404, 429 and others) are raised as node errors. With Continue On Fail enabled, an {error} item is emitted instead. The node doesn't check that the agent IDs are valid.

Examples

Example 1: Quarantine a compromised host after a high-severity alert fires.

Resource: Agent, Operation: Isolate, Agent IDs: {{ $json.agentId }}, Isolate: true

Example 2: Release several hosts from isolation once they've been remediated.

Agent IDs: "id-1, id-2, id-3", Isolate: false

Links

Discussion