Datto EDR icon

Datto EDR

Datto EDR (Infocyte): list and manage endpoints/agents, threats/alerts, scans, targets, quarantined files, and run response actions — isolate or scan an endpoint, archive or respond to alerts, restore quarantined files. For endpoint security operations, threat triage, and EDR reporting.

Actions60

Alert → Get Many

AI-generated

Summary

Retrieves multiple Datto EDR alerts from the Alerts endpoint, with optional filter conditions, sort order, field selection and either a result limit or full pagination.

Inputs

  • Return All — When true, pages through the API (100 per request, up to 200 pages) and returns every matching alert. Errors if more than 200 pages would be needed; add filters to narrow results.
  • Limit — Max alerts to return when Return All is off. Default 50, minimum 1.
  • Filters — Repeatable conditions of Field (Severity, Type, Hostname, Agent ID, Archived, Organization, MITRE ID), Operator (Equals, Not Equals, Greater/Less Than or Equal, Contains, In List comma-separated) and Value. Conditions with an empty value are skipped. Equals/comparison values that look numeric are sent as numbers; Contains is wrapped in %…%; In List splits on commas. Conditions on the same field overwrite each other.
  • Options > Order — Sort expression, e.g. "createdOn DESC".
  • Options > Fields — Comma-separated list of fields to include in each returned alert.
  • Options > Where (JSON) — Raw LoopBack where clause merged over the Filters (its keys override the same fields). Invalid JSON is silently ignored.

Output shape

One n8n item per alert, each item's json being the alert record as returned by the Datto EDR API.

If no alerts match, a single item {found: 0, resource, operation} is returned instead of an empty output. Filters, order and fields are sent as a LoopBack JSON filter query parameter. With continue-on-fail, errors become an item with an error message.

Examples

Example 1: Fetch the 100 most recent critical alerts

Return All off, Limit 100; Filter Severity Equals critical; Options > Order "createdOn DESC".

Example 2: Export all unarchived alerts for a host

Return All on; Filters: Hostname Equals WS-01, Archived Equals false.

Example 3: Find alerts mapped to specific MITRE techniques

Filter MITRE ID In List "T1059,T1055"; Options > Fields "id,type,hostname,severity".

Links

Discussion