Datto EDR icon

Datto EDR

Datto EDR (Infocyte): list and manage endpoints/agents, threats/alerts, scans, targets, quarantined files, and run response actions — isolate or scan an endpoint, archive or respond to alerts, restore quarantined files. For endpoint security operations, threat triage, and EDR reporting.

Actions60

Agent → Scan

AI-generated

Summary

Starts an on-demand scan on one or more Datto EDR agents by POSTing the agent IDs, plus any extra scan options, to the Agents/scan endpoint.

Inputs

  • Agent IDs (required) — Comma-separated list of agent IDs to scan. Whitespace is trimmed and empty entries are dropped. The list is sent as the ids array.
  • Scan Options (JSON) — JSON object of extra scan fields, default {}. Its keys are merged into the request body next to ids. If a key is also ids, it overrides the Agent IDs value. The JSON must be valid or the item fails. See the Datto EDR API docs for the available fields.

Output shape

One output item per input item. It holds the JSON response returned by the Datto EDR Agents/scan endpoint.

The response shape isn't defined in the node and depends on the API. If the response is empty, the item is {found: 0, resource, operation}. API errors are mapped to readable messages for 401, 403, 404 and 429. With Continue On Fail enabled, a failed item returns {error: message}. The node only queues the scan. To see results, use the Scan History operation.

Examples

Example 1: Scan two endpoints after a suspicious alert

Agent IDs: agent-1, agent-2; Scan Options left as {}.

Example 2: Scan agents whose IDs come from an earlier node

Agent IDs set to an expression such as {{ $json.agentId }}; Scan Options holds any API-specific fields as JSON.

Links

Discussion