Datto EDR icon

Datto EDR

Datto EDR (Infocyte): list and manage endpoints/agents, threats/alerts, scans, targets, quarantined files, and run response actions — isolate or scan an endpoint, archive or respond to alerts, restore quarantined files. For endpoint security operations, threat triage, and EDR reporting.

Actions60

Quarantined File → Delete Files

AI-generated

Summary

Schedules agent jobs that permanently delete quarantined files in Datto EDR matching a LoopBack where filter. It POSTs to QuarantinedFiles/createDeleteFileJobs and returns the API response.

Inputs

  • Where Filter (JSON) (required) — LoopBack where-clause JSON object selecting the quarantined files to delete, e.g. {"agentId":"agent-ID-1"} or {"ID":"qf-ID-1"}. Parsed from JSON and sent as the where query string parameter. If left as {}, no where parameter is sent, so the request has no filter. Invalid JSON causes an error.

Output shape

One output item per input item, containing the JSON response from the Datto EDR createDeleteFileJobs endpoint (the created delete jobs/result as returned by the API).

The deletion is asynchronous: the operation only schedules agent jobs, so files are not necessarily deleted when the node finishes. If the API returns an empty result, the node emits {found: 0, resource, operation}. With Continue On Fail enabled, errors are emitted as {error: message}. Requires a Datto EDR credential whose Base URL ends in /api.

Examples

Example 1: Purge all quarantined files from a specific endpoint after review.

Resource: Quarantined File; Operation: Delete Files; Where Filter: {"agentId":"agent-ID-1"}

Example 2: Delete a single quarantined file by its ID taken from a previous Get Many step.

Where Filter set to an expression such as {"ID":"{{ $json.id }}"}

Links

Discussion