Datto EDR icon

Datto EDR

Datto EDR (Infocyte): list and manage endpoints/agents, threats/alerts, scans, targets, quarantined files, and run response actions — isolate or scan an endpoint, archive or respond to alerts, restore quarantined files. For endpoint security operations, threat triage, and EDR reporting.

Actions60

Agent → Retrieve Logs

AI-generated

Summary

Triggers a log-retrieval job on a single Datto EDR agent by sending a POST to Agents/{agentId}/retrieveLogs, and returns the API's response.

Inputs

  • Agent ID (required) — ID of the agent to retrieve logs from. Used in the request path. If empty, the node throws an error saying "agentId" is required.

Output shape

One output item per input item, containing the JSON response from the Datto EDR API for the log-retrieval request.

No request body or query parameters are sent. The call only requests the job, and the node doesn't download log contents itself. If the API returns an empty response, the node outputs {found: 0, resource, operation}. Errors (401, 403, 404, 429, etc.) are raised as API errors, or emitted as an {error} item when Continue On Fail is enabled.

Examples

Example 1: Collect logs from a suspicious endpoint after an alert fires

Resource: Agent; Operation: Retrieve Logs; Agent ID: expression {{$json.agentId}} from the upstream alert item.

Example 2: Request logs from one specific agent manually

Resource: Agent; Operation: Retrieve Logs; Agent ID: the agent's ID as a fixed string.

Links

Discussion