Datto EDR icon

Datto EDR

Datto EDR (Infocyte): list and manage endpoints/agents, threats/alerts, scans, targets, quarantined files, and run response actions — isolate or scan an endpoint, archive or respond to alerts, restore quarantined files. For endpoint security operations, threat triage, and EDR reporting.

Actions60

Alert → Add Comment

AI-generated

Summary

Posts a new comment on a Datto EDR alert by sending the comment text to the alert's comments endpoint, and returns the API's response.

Inputs

  • Alert ID (required) — ID of the alert to comment on. Used in the request path (Alerts/{alertId}/comments). The operation throws an error if it is empty.
  • Comment (required) — Comment text to add. Sent as the "value" field of the request body (the API's UserComment).

Output shape

One output item per input item, containing the JSON response from the Datto EDR API for the newly created comment.

The response fields are whatever the API returns, and the source doesn't define them. If the API returns an empty response, the node emits a placeholder item with found: 0, resource and operation. API errors (401, 403, 404, 429 and others) are raised as node errors, or emitted as an {error} item if Continue On Fail is enabled.

Examples

Example 1: Record triage notes on an alert after an automated enrichment step.

Resource: Alert; Operation: Add Comment; Alert ID: {{$json.alertId}}; Comment: "Enriched via VirusTotal: malicious, escalated to SOC".

Example 2: Leave a note when a ticket is created for an alert.

Resource: Alert; Operation: Add Comment; Alert ID set from a previous Alert Get Many node; Comment: "Ticket #{{$json.ticketId}} opened".

Links

Discussion