datto_edr_alerts_list
Lists Datto EDR alerts newest first, with filters for date range, severity, host, organization, status, and archived or older-than-30-days archive data.
Instructions
List Datto EDR alerts, newest first (GET /api/Alerts). Filter by creation date range and archived state; filter by severity, host, organization, status or any other property through "where" (see datto_edr_api_models {"model":"Alerts"} for this instance's field names). Set archive_table for alerts older than 30 days.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| skip | No | Number of results to skip (use nextSkip from the previous page) | |
| limit | No | Max results per page (1-1000, default 50) | |
| order | No | LoopBack order, e.g. "createdOn DESC" or "hostname ASC" | |
| where | No | Extra LoopBack where filter, combined with AND, e.g. {"hostname":{"ilike":"%sql%"}}. Operators: eq, neq, gt, gte, lt, lte, between, inq, nin, like, ilike, and, or. Use datto_edr_api_models to see a model's properties. | |
| fields | No | Only return these properties (keeps responses small) | |
| end_time | No | Only alerts created at or before this ISO date/time | |
| start_time | No | Only alerts created at or after this ISO date/time | |
| archive_table | No | Query the alert archive table (alerts older than 30 days) instead of live alerts | |
| include_archived | No | Include alerts marked archived (default false) |