Datto EDR icon

Datto EDR

Datto EDR (Infocyte): list and manage endpoints/agents, threats/alerts, scans, targets, quarantined files, and run response actions — isolate or scan an endpoint, archive or respond to alerts, restore quarantined files. For endpoint security operations, threat triage, and EDR reporting.

Report → Get Many

AI-generated

Summary

Retrieves Datto EDR reports from the Reports endpoint, either all of them or up to a limit, with optional name filtering, sorting, field selection and a raw LoopBack where clause.

Inputs

  • Return All — If true, pages through the Reports endpoint (100 per request) and returns every match. It stops with an error after 200 pages, so add a filter for very large sets. Default false.
  • Limit — Maximum number of reports to return when Return All is off. Minimum 1, default 50.
  • Filters — Zero or more conditions on the Name field. Each has an operator (Equals, Not Equals, Contains, Greater/Less Than or Equal, In List with comma-separated values) and a value. Contains is sent as a %value% pattern. Conditions with an empty value are ignored. Numeric-looking values are converted to numbers for equals and comparison operators.
  • Options > Order — LoopBack sort expression, e.g. "createdOn DESC".
  • Options > Fields — Comma-separated list of fields to include in each returned report.
  • Options > Where (JSON) — Raw LoopBack where clause as JSON. It is merged over the Filters, so its keys override them. Invalid JSON is silently ignored.

Output shape

One n8n item per report returned by the API, with the report record as the item's JSON. If nothing matches, a single item is emitted: {found: 0, resource, operation}.

The exact report fields come from the Datto EDR API and are not defined by the node. With Return All off, only a single request is made, limited by Limit. API errors (401, 403, 404, 429 and others) raise node errors unless Continue On Fail is enabled, in which case an item with an error message is emitted. A non-JSON response, usually caused by a Base URL that doesn't end in /api, also raises an error.

Examples

Example 1: List the 20 most recent reports

Return All off, Limit 20, Options > Order "createdOn DESC".

Example 2: Find reports whose name contains "weekly"

Return All on, Filters: Name Contains "weekly".

Example 3: Fetch only names and IDs of reports from a specific list of names

Filters: Name In List "Monthly,Quarterly"; Options > Fields "id,name".

Links

Discussion