Datto EDR icon

Datto EDR

Datto EDR (Infocyte): list and manage endpoints/agents, threats/alerts, scans, targets, quarantined files, and run response actions — isolate or scan an endpoint, archive or respond to alerts, restore quarantined files. For endpoint security operations, threat triage, and EDR reporting.

Actions60

Quarantined File → Restore Files

AI-generated

Summary

Schedules agent jobs in Datto EDR that restore quarantined files matching a LoopBack where-filter to their original locations.

Inputs

  • Where Filter (JSON) (required) — LoopBack where-clause JSON object selecting the quarantined files to restore, e.g. {"agentId":"agent-ID-1"} or {"ID":"qf-ID-1"}. It is parsed from JSON if given as a string and sent as the where query parameter. If it is an empty object {}, no where parameter is sent, so the request has no filter. Check what the API does in that case before running it.

Output shape

A single item whose json is the Datto EDR API's response to the POST request to QuarantinedFiles/createRestoreFileJobs. The response is typically a summary of the jobs created.

The exact response fields are not defined in the node and depend on the API. The operation only creates restore jobs. It does not wait for the agents to finish restoring the files. If the response is empty, the node outputs {found: 0, resource, operation}. Invalid JSON in the filter throws an error, or yields an error item if Continue On Fail is enabled. The request runs once for each input item.

Examples

Example 1: Restore every quarantined file on one endpoint after a false positive.

Resource: Quarantined File; Operation: Restore Files; Where Filter: {"agentId":"agent-ID-1"}

Example 2: Restore one specific quarantined file using an ID from a previous Get Many step.

Where Filter set by expression, e.g. {"ID":"{{ $json.id }}"}

Links

Discussion