Discover available Datto EDR tools by domain. Returns tool names and descriptions for the selected domain. All tools are callable at any time — this is a help/discovery aid, not a prerequisite.

Check whether Datto EDR credentials are configured and list the available domains. Does not call the API; use datto_edr_test_connection for a live check.

Test the connection and token against the Datto EDR instance (GET /api/Version). Returns the instance host and API version.

List the API models this Datto EDR instance exposes (read from its /explorer/swagger.json), or pass "model" to see that model's paths and properties. Use it to find filterable field names before building a "where" filter.

Read-only escape hatch for Datto EDR API endpoints not covered by a typed tool. Prefer typed tools. Sends GET https:///api/; the token is added automatically. Object values in "query" are JSON-encoded, so pass a LoopBack filter as {"filter":{"where":{...},"limit":50}} or a count as path "Model/count" with {"where":{...}}. Credential and token models are refused.

List user activity (audit log) entries (GET /api/useractivities).

List or search Datto EDR endpoint agents (GET /api/Agents). Filter by hostname, IP, active/authorized state and last heartbeat; add any other property (OS, version, isolation state...) through "where" after checking field names with datto_edr_api_models {"model":"Agents"}. Paged with limit/skip.

Get one Datto EDR agent by id (GET /api/Agents/{id}).

Count agents matching the same filters as datto_edr_agents_list (GET /api/Agents/count). Useful for "how many agents are offline" questions.

List Datto EDR alerts, newest first (GET /api/Alerts). Filter by creation date range and archived state; filter by severity, host, organization, status or any other property through "where" (see datto_edr_api_models {"model":"Alerts"} for this instance's field names). Set archive_table for alerts older than 30 days.

Get one Datto EDR alert by id (GET /api/Alerts/{id}).

Count alerts matching the same filters as datto_edr_alerts_list (GET /api/Alerts/count).

List enriched alert records (GET /api/AlertDetails), which join alert, host and file/rule context. Use "where" to filter (e.g. by alert id or hostname) and "fields" to keep the response small.

List Datto EDR target groups (GET /api/targets). Target groups hold the hosts that scans and response actions run against; their ids are needed by datto_edr_scan_host and the response tools.

Get one target group by id (GET /api/targets/{id}).

List discovered host addresses (GET /api/Addresses), optionally within one target group. Shows whether each host was reachable and which agent it maps to.

List Datto EDR organizations (tenants/customers). The endpoint is looked up in this instance's /explorer/swagger.json; if it is missing, the error lists related models to query with datto_edr_raw_request.

Get one Datto EDR organization by id. The endpoint is looked up in this instance's /explorer/swagger.json; if it is missing, the error lists related models to query with datto_edr_raw_request.

List Datto EDR locations (sites inside organizations). Filter by organization through "where" once you know the field name (datto_edr_api_models). The endpoint is looked up in this instance's /explorer/swagger.json; if it is missing, the error lists related models to query with datto_edr_raw_request.

Get one Datto EDR location by id. The endpoint is looked up in this instance's /explorer/swagger.json; if it is missing, the error lists related models to query with datto_edr_raw_request.

List configured integrations (RMM, PSA, RocketCyber...). The endpoint is looked up in this instance's /explorer/swagger.json; if it is missing, the error lists related models to query with datto_edr_raw_request.

List Datto EDR scans (GET /api/scans), optionally for one target group.

Get one scan by id (GET /api/scans/{id}).

List user tasks (scans, responses, enumerations shown in the task list), newest first (GET /api/usertasks). Use status "Active" for running tasks.

Get one user task by id, including status, progress and message (GET /api/usertasks/{id}). Use it to follow a scan or response started by this server.

List the per-host items of a user task (GET /api/userTaskItems), e.g. the result of a scan or response on each host.

List background jobs (GET /api/jobs). Pass state "active" for running jobs.

⚠ HIGH-IMPACT: Start a forensic scan of one host (POST /api/targets/scan). Runs on the endpoint and uses its resources. Requires confirm: true; without it, returns the request it would send. Returns a task id for datto_edr_tasks_get.

⚠ HIGH-IMPACT: Run a response extension (e.g. kill process, isolate, collect evidence) on one host (POST /api/targets/scan with the extension). Identify the extension by id or exact name. Requires confirm: true; without it, returns the request it would send.

⚠ HIGH-IMPACT: Network-isolate one host by running the "Host Isolation" response extension. The host keeps talking to Datto EDR but loses all other network access until restored (Windows and Linux). Requires confirm: true.

⚠ HIGH-IMPACT: Remove network isolation from one host by running the "Host Isolation Restore" response extension. Requires confirm: true.

List Datto EDR detection rules (GET /api/rules).

Get one detection rule by id (GET /api/rules/{id}).

List Datto EDR extensions (GET /api/extensions): collection extensions and response actions such as "Host Isolation" and "Host Isolation Restore". Extension ids/names feed datto_edr_run_response.

Get one extension by id (GET /api/extensions/{id}).

List the response/action types the instance supports (GET /api/ActionTypes).