Datto EDR icon

Datto EDR

Datto EDR (Infocyte): list and manage endpoints/agents, threats/alerts, scans, targets, quarantined files, and run response actions — isolate or scan an endpoint, archive or respond to alerts, restore quarantined files. For endpoint security operations, threat triage, and EDR reporting.

Actions60

Alert → Get

AI-generated

Summary

Retrieves a single Datto EDR alert by ID via GET Alerts/{id}, optionally limiting the returned fields.

Inputs

  • Alert ID (required) — ID of the alert to fetch. Throws an error if empty.
  • Options > Fields — Comma-separated list of fields to include in the response. Sent as a LoopBack filter 'fields' list.
  • Options > Order — Shown in the UI, but ignored by Get at runtime (only used for Get Many).
  • Options > Where (JSON) — Shown in the UI, but ignored by Get at runtime. Only Get Many uses it.

Output shape

One n8n item per input item, containing the alert record as JSON.

If the alert isn't found, the API returns a 404 and the node errors (or emits an {error} item if Continue On Fail is enabled). The Include option is not offered for alerts. Requires the credential Base URL to end with /api.

Examples

Example 1: Fetch full details of an alert from a webhook payload

Alert ID = {{$json.alertId}}; no options

Example 2: Retrieve only selected fields of an alert

Alert ID = abc123; Options > Fields = "id,severity,hostname,type"

Links

Discussion