Datto EDR icon

Datto EDR

Datto EDR (Infocyte): list and manage endpoints/agents, threats/alerts, scans, targets, quarantined files, and run response actions — isolate or scan an endpoint, archive or respond to alerts, restore quarantined files. For endpoint security operations, threat triage, and EDR reporting.

Flag → Get Many

AI-generated

Summary

Retrieves multiple Flag records from the Datto EDR (Infocyte) API's Flags model, either all of them or up to a set limit, with optional sorting, field selection and a raw LoopBack where clause.

Inputs

  • Return All — When true, pages through the Flags endpoint (100 per page, up to 200 pages) and returns every record. Defaults to false.
  • Limit — Maximum number of records to return. Shown only when Return All is off. Minimum 1, default 50.
  • Options > Order — LoopBack sort expression, e.g. "createdOn DESC".
  • Options > Fields — Comma-separated list of field names to include in each returned record.
  • Options > Where (JSON) — Raw LoopBack where clause as JSON, e.g. {"name":"foo"}. Used to filter results. Ignored if empty or "{}". If the JSON is invalid it is silently ignored rather than raising an error.

Output shape

One n8n item per Flag record returned by the API, containing the record's JSON fields.

If no records match, a single item {found: 0, resource, operation} is output. With Return All, the node throws if more than 200 pages are returned, so narrow with Where. The Flag resource defines no Filters UI, so filtering is only possible through Where (JSON). API errors (401/403/404/429) are raised as node errors, or output as {error} items if Continue On Fail is enabled.

Examples

Example 1: Fetch the 50 most recent flags

Return All off, Limit 50, Options > Order = "createdOn DESC".

Example 2: Export all flags with only selected fields

Return All on, Options > Fields = "id,name".

Example 3: Fetch flags matching a condition

Return All on, Options > Where (JSON) = {"name":"example"}.

Links

Discussion