Datto EDRInstall

Summary

Count Datto EDR alerts, optionally narrowed by one or more field conditions, by calling GET Alerts/count.

Inputs

• Filters — Zero or more conditions, each with a Field (Severity, Type, Hostname, Agent ID, Archived, Organization, MITRE ID), an Operator (Equals, Not Equals, Greater/Less Than or Equal, Contains, In List comma-separated) and a Value. Conditions are combined into one LoopBack where object sent as a query parameter. With no conditions, all alerts are counted.

Output shape

A single item holding the raw API response, which is typically an object like {"count": N}.

Conditions with an empty Value are skipped. Equals and the comparison operators convert numeric-looking values to numbers. Contains wraps the value in % wildcards (LIKE). In List splits on commas and trims each entry. Not Equals keeps the value as a string. Each field can hold only one condition, so a later condition on the same field overwrites an earlier one, which makes a range such as gte plus lte on one field impossible. The Archived value is typed as a string, so enter true or false as text. If the API returns an empty result, the node emits {found: 0, resource, operation}. API errors (401, 403, 404, 429) are raised as descriptive node errors.

Examples

Example 1: Count all critical alerts

Resource: Alert, Operation: Count; Filter: Field=Severity, Operator=Equals, Value=critical

Example 2: Count unarchived alerts for one host

Filters: Hostname Equals 'WS-042' and Archived Equals 'false'

Example 3: Count high or critical alerts

Filter: Severity, In List (Comma-Sep), Value='high,critical'

Links

• n8n community nodes installation guide