Datto EDR icon

Datto EDR

Datto EDR (Infocyte): list and manage endpoints/agents, threats/alerts, scans, targets, quarantined files, and run response actions — isolate or scan an endpoint, archive or respond to alerts, restore quarantined files. For endpoint security operations, threat triage, and EDR reporting.

Quarantined File → Get

AI-generated

Summary

Retrieves a single Datto EDR quarantined file record by ID with a GET request to QuarantinedFiles/{id}, optionally limiting the returned fields.

Inputs

  • Quarantined File ID (required) — ID of the quarantined file to fetch. The operation throws an error if it is empty.
  • Options > Fields — Comma-separated list of field names to include in the response. Sent as a LoopBack filter 'fields' list.
  • Options > Order — Sort order option shown in the UI (e.g. "createdOn DESC"). It is not sent for Get, so it has no effect on a single-record lookup.
  • Options > Where (JSON) — Raw LoopBack where clause shown in the UI. It is not sent for Get, so it has no effect.

Output shape

One n8n item whose json is the quarantined file record returned by the Datto EDR API.

Which fields appear depends on the API and on the Fields option. A missing ID returns a 404 error from the API, which the node surfaces as an error (or as an {error} item if Continue On Fail is on). If the response is empty, the node outputs {found: 0, resource, operation}.

Examples

Example 1: Look up details of a quarantined file reported by an alert or a previous Get Many step.

Resource: Quarantined File; Operation: Get; Quarantined File ID: {{$json.id}}

Example 2: Fetch only a few fields to keep the output small.

Quarantined File ID: abc123; Options > Fields: "id,hostname,agentId"

Links

Discussion