Datto EDR icon

Datto EDR

Datto EDR (Infocyte): list and manage endpoints/agents, threats/alerts, scans, targets, quarantined files, and run response actions — isolate or scan an endpoint, archive or respond to alerts, restore quarantined files. For endpoint security operations, threat triage, and EDR reporting.

Quarantined File → Count

AI-generated

Summary

Counts Datto EDR quarantined files, optionally restricted by filter conditions on hostname, agent ID, or organization. Calls GET QuarantinedFiles/count and returns the API's count result.

Inputs

  • Filters — Repeatable conditions, each with a Field (Hostname, Agent ID, Organization), an Operator (Equals, Not Equals, Contains, Greater/Less Than or Equal, In List comma-separated) and a Value. Conditions are combined into a LoopBack where clause and sent as a JSON query parameter. Conditions with an empty value are skipped. Conditions on the same field overwrite each other, since each field is a single key in the clause. With no filters, all quarantined files are counted.

Output shape

One item per input item, containing the JSON response from the count endpoint (typically an object like {"count": N}).

The exact response shape comes from the Datto EDR API and is not transformed by the node. Equals, greater/less than operators convert numeric-looking values to numbers. Contains wraps the value in % wildcards (LIKE). Not Equals keeps the value as a string. API errors (401/403/404/429) are raised as node errors unless Continue On Fail is enabled.

Examples

Example 1: Count quarantined files on a specific host

Filters: Field=Hostname, Operator=Equals, Value=WS-042

Example 2: Count quarantined files across several agents

Filters: Field=Agent ID, Operator=In List (Comma-Sep), Value=agent-1, agent-2

Example 3: Total quarantined files in the tenant

No filters added

Links

Discussion