datto_edr_run_response
Run a response extension on a Datto EDR host to kill a process, isolate the host, or collect evidence; requires confirm:true, otherwise it previews the request.
Instructions
⚠ HIGH-IMPACT: Run a response extension (e.g. kill process, isolate, collect evidence) on one host (POST /api/targets/scan with the extension). Identify the extension by id or exact name. Requires confirm: true; without it, returns the request it would send.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| target | Yes | Hostname or IP address of the host | |
| confirm | No | Must be true to execute. Without it the tool only describes what it would do. | |
| arguments | No | Arguments passed to the extension | |
| extension_id | No | Extension id | |
| extension_name | No | Exact extension name (used when extension_id is not given) | |
| target_group_id | Yes | Target group id the host belongs to (see datto_edr_target_groups_list) |