Skip to main content
To integrate Datto EDR, create an API token in the Datto EDR console, provide it to Wirespeed with your instance name, and select the organization to connect.

​
Prerequisites

  • Datto EDR access with the ability to create API tokens under Admin > Users & Tokens > API Tokens
  • A token user that can view organizations, alerts, and devices, and archive and comment on alerts unless the integration is Read Only
  • Your instance name: the INSTANCE in https://INSTANCE.infocyte.com

​
Create an API Token

  1. Log in to your Datto EDR console
  2. Open Admin > Users & Tokens > API Tokens
  3. Click Add, name the token for Wirespeed, and save it
  4. Copy the token
Datto EDR API tokens expire one year after creation. Create a new token and update the integration before it expires.

​
Add the Integration in Wirespeed

  1. In Wirespeed, navigate to Integrations > Add Integration > Datto EDR
  2. Enter your Instance and API Token. Paste the token as is, without a Bearer prefix
  3. Submit the integration
  4. On the integration page, click Complete Setup, select the organization that belongs to this Wirespeed team, and click Save organization
The integration starts ingesting once the organization is saved. The organization cannot be changed afterward; to connect a different one, remove and re-add the integration.

​
Separating MSP/MSSP clients

Each integration reads and updates a single Datto EDR organization. To keep your clients isolated in Wirespeed, add the integration on each client team and select that client’s organization. The same API token can be reused across integrations.

​
What Wirespeed Ingests

​
Alert Updates

When a detection is completed, Wirespeed archives the Datto EDR alert, and analyst comments are added to it. Alerts older than 30 days can only receive comments. To prevent these updates, enable Read Only in the advanced options when you add the integration; it cannot be changed afterward.

​
Current Limitations

  • Endpoint isolation and file quarantine are not available
  • Reopening a detection does not unarchive the Datto EDR alert
  • Detections do not escalate until Datto EDR categorization rules are defined