Datto EDR icon

Datto EDR

Datto EDR (Infocyte): list and manage endpoints/agents, threats/alerts, scans, targets, quarantined files, and run response actions — isolate or scan an endpoint, archive or respond to alerts, restore quarantined files. For endpoint security operations, threat triage, and EDR reporting.

Actions60

Alert → Unarchive

AI-generated

Summary

Unarchives Datto EDR alerts that match a LoopBack where-clause by calling POST Alerts/unarchive, restoring previously archived alerts in bulk.

Inputs

  • Where Filter (JSON) (required) — LoopBack where-clause JSON object that selects the alerts to unarchive, e.g. {"ID":"alert-ID-1"} or {"agentId":"agent-ID-1"}. It is sent as the where query string parameter. If the object is empty ({}), no where parameter is sent, so the request carries no filter. Check the Datto EDR API behavior before running with an empty filter.

Output shape

One output item per input item, containing the JSON response returned by the Datto EDR Alerts/unarchive endpoint.

The response shape is whatever the API returns and is not transformed by the node. If the response is empty, the node emits {found: 0, resource, operation}. Invalid JSON in the filter throws an error. API errors (401, 403, 404, 429 and others) are raised as node errors, or emitted as {error} items if Continue On Fail is enabled.

Examples

Example 1: Restore all archived alerts for one endpoint

Resource: Alert; Operation: Unarchive; Where Filter (JSON): {"agentId":"agent-ID-1"}

Example 2: Unarchive a single alert by ID, using an expression from an earlier node

Resource: Alert; Operation: Unarchive; Where Filter (JSON): {"ID":"{{ $json.alertId }}"}

Links

Discussion