Datto EDR: connect, sync endpoint protection and alert posture

Datto EDR (formerly Infocyte) is where your endpoint detection-and-response agents live. This connector reads two things out of it — each customer's endpoint-protection inventory and their alert posture — and hangs them off the matching Current company so they can feed your executive and CIO business reviews. It is read-only in the strictest possible sense: Current reads Datto EDR and can never change anything in it.

Datto EDR runs on the LoopBack framework and authenticates with a long-lived API access token. Creating one is an admin/analyst action inside your EDR instance, and there are two things Current needs: your instance's base URL and the token itself.

1. 1
   1 · Find your instance base URL

   Log into Datto EDR and look at the address bar — your instance is a per-partner subdomain, e.g. https://yourcompany.infocyte.com. Current needs that URL with /api on the end: https://yourcompany.infocyte.com/api. The trailing /api is mandatory — without it, authentication and company loading fail.
2. 2
   2 · Open API Tokens

   Go to Admin ▸ Users & Tokens ▸ API Tokens (it is also under My Settings ▸ API Tokens). You need an EDR subscription with administrator, analyst, or external-analyst access to see it.
3. 3
   3 · Create a new token

   Choose Create new token. Give it a name that says what it is for, e.g. "Current reporting (read-only)".
4. 4
   4 · Copy the token now

   Copy the token immediately — Datto EDR may not show it again. If you lose it, delete it and create a fresh one.

1. 1
   Open the Datto EDR card

   In Current's left sidebar open Integrations (it sits under Admin, so Tenant Admins have the link), find the Datto EDR card in the Reporting integrations section, and paste your details.
2. 2
   Paste the instance URL and token

   Put https://<yourcompany>.infocyte.com/api in Instance base URL and your token in API Token.
3. 3
   Press Test connection

   Current validates the URL (it must be https and a real host) and then makes a single one-row read against your instance to prove the token works — before storing anything. A bad token, wrong subdomain, or a missing /api is rejected on the spot with the real reason. On success the token is stored server-side only; the browser never sees it again.

The sync runs every 6 hours on its own, and Sync now covers the impatient path. Each run reads your endpoint inventory and a bounded, recent window of alerts, then writes value-signals — never a raw event firehose.

Datto EDR's LoopBack API is unusual: it auto-generates full create/update/delete operations — and response actions like isolate host, release, and run scan — on nearly every model, sitting right next to the reads. That makes the guarantee here especially important. Every request Current makes passes through a read-only guard that only permits a strict, explicit list of GET read paths (endpoints, organizations/sites, locations, and alerts). The API allows changes; Current's code physically cannot issue them — the write and response endpoints are not on the allowlist and are unreachable, even by a code bug.

Inside one Datto EDR instance your customers are modelled at two levels — Organizations (the broad grouping) and, beneath them, Locations (the finer one). Many MSPs run just a couple of organizations with every customer as a Location under them, so Current makes BOTH mappable. It enumerates your organizations and your locations, keys each on its id and name, and auto-matches each to one of your Current companies by normalized name — lowercased, with punctuation and Inc/LLC/Ltd-style suffixes stripped — linking it only when exactly one company matches. Anything it can't match confidently is left for you. When both a location and its parent organization are mapped, the location mapping wins: an endpoint's or alert's customer is taken from its location first, and only falls back to its organization when the location isn't mapped.

• ＋Unmatched organizations and locations appear on the Datto EDR card's mapping panel — each carries a small Org or Location badge so you can tell the level apart — press Map to pick the right Current company by hand.
• ＋A manual mapping is never overwritten by the auto-matcher on a later sync, and neither is a manual unlink.
• ＋Unmapped sites still sync — their endpoints and alerts are stored — but the data only appears on a company once the site is mapped to it.
• ＋Run a separate EDR instance per client instead of multiple sites in one? That works too: connect each with its own instance URL + token, and Current maps that whole instance to the one company.