> ## Documentation Index
> Fetch the complete documentation index at: https://docs.wirespeed.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Datto EDR

> Ingest Datto EDR alerts and logs, and synchronize endpoint inventory

To integrate Datto EDR, create an API token in the Datto EDR console, provide it to Wirespeed with your instance name, and select the organization to connect.

## Prerequisites

* Datto EDR access with the ability to create API tokens under **Admin > Users & Tokens > API Tokens**
* A token user that can view organizations, alerts, and devices, and archive and comment on alerts unless the integration is **Read Only**
* Your instance name: the `INSTANCE` in `https://INSTANCE.infocyte.com`

## Create an API Token

1. Log in to your Datto EDR console
2. Open **Admin > Users & Tokens > API Tokens**
3. Click **Add**, name the token for Wirespeed, and save it
4. Copy the token

<Warning>
  Datto EDR API tokens expire one year after creation. Create a new token and update the integration before it expires.
</Warning>

## Add the Integration in Wirespeed

1. In Wirespeed, navigate to **Integrations** > [**Add Integration**](https://app.wirespeed.co/settings/integrations?tab=browse) > **Datto EDR**
2. Enter your **Instance** and **API Token**. Paste the token as is, without a `Bearer` prefix
3. Submit the integration
4. On the integration page, click **Complete Setup**, select the organization that belongs to this Wirespeed team, and click **Save organization**

The integration starts ingesting once the organization is saved. The organization cannot be changed afterward; to connect a different one, remove and re-add the integration.

## Separating MSP/MSSP clients

Each integration reads and updates a single Datto EDR organization. To keep your clients isolated in Wirespeed, add the integration on each client team and select that client's organization. The same API token can be reused across integrations.

## What Wirespeed Ingests

| Source | Datto EDR API | Purpose |
| - | - | - |
| Signal alerts | `GET /AlertDetails` | Detections with the host, file, process, user, connection, and MITRE ATT\&CK context |
| Other alerts | `GET /AlertDetails` | Lower-confidence rule hits, stored as searchable logs |
| Agents | `GET /AgentDetails` | Endpoint inventory for asset correlation |

## Alert Updates

When a detection is completed, Wirespeed archives the Datto EDR alert, and analyst comments are added to it. Alerts older than 30 days can only receive comments. To prevent these updates, enable **Read Only** in the advanced options when you add the integration; it cannot be changed afterward.

## Current Limitations

* Endpoint isolation and file quarantine are not available
* Reopening a detection does not unarchive the Datto EDR alert
* Detections do not escalate until Datto EDR categorization rules are defined


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.