Datto EDR icon

Datto EDR

Datto EDR (Infocyte): list and manage endpoints/agents, threats/alerts, scans, targets, quarantined files, and run response actions — isolate or scan an endpoint, archive or respond to alerts, restore quarantined files. For endpoint security operations, threat triage, and EDR reporting.

Actions60

Alert → Archive

AI-generated

Summary

Archives all Datto EDR alerts matching a LoopBack where-clause by sending a POST to the Alerts/archive endpoint.

Inputs

  • Where Filter (JSON) (required) — LoopBack where-clause JSON object selecting the alerts to archive, e.g. {"ID":"alert-ID-1"} or {"agentId":"agent-ID-1"}. Accepts a JSON string or an object. If left as {} the where query parameter is omitted entirely, so the request carries no filter. Check what the API does in that case before using it.

Output shape

A single item containing the JSON response returned by the Datto EDR Alerts/archive endpoint.

The where clause is sent as a JSON-encoded query-string parameter, not in the body. Invalid JSON in the filter throws a parse error. API errors (401, 403, 404, 429 and others) are raised as node errors, or emitted as an item with an error field if Continue On Fail is enabled. If the response is empty, the node outputs {found: 0, resource, operation}. The operation runs once per input item.

Examples

Example 1: Archive a single alert by ID after it has been triaged.

Resource: Alert; Operation: Archive; Where Filter (JSON): {"ID":"alert-ID-1"}

Example 2: Archive every alert from a specific agent, using an expression to pull the ID from a previous node.

Resource: Alert; Operation: Archive; Where Filter (JSON): {"agentId":"{{ $json.agentId }}"}

Links

Discussion