d Performing a manual scan

NAVIGATION  You can initiate a manual scan from various areas of the EDR UI. Please refer to the navigations listed in the sections of this article.

SECURITY   Datto EDR subscription with administrator-level platform access

SECURITY   Datto AV subscription with administrator-level platform access

BEFORE YOU BEGIN  The type of subscription you have may define the features available to you on this page.

This article explains how you can perform a manual scan to capture an in-the-moment snapshot of an endpoint's state or to ensure that collection is working as expected for a newly-added endpoint. To be eligible for scanning, a device must be licensed and have an Active Status.

If your endpoint is currently offline, refer to Scanning an offline endpoint.

IMPORTANT  An endpoint must have the agent software installed and be associated with a location before our analysis engine can scan it.

How to...

Scan an entire organization

To run a manual scan from the Organization page against one or multiple organizations, perform the following steps:

  1. In the top navigation menu of your instance, click Organizations.
  2. The Organizations page will load. Click the check box of the client organization(s) you'd like to scan.
  3. In the upper right corner of the page, click Scan.
  4. In the Scan Organization dialog box, choose your desired scan options or use the pre-configured choices. Then, click Scan.

Scan a location

To run a manual scan against one or more locations, perform the following steps:

  1. In the top navigation menu of your instance, click Organizations.
  2. The Organizations page will load. In the left navigation menu, click Locations.
  3. Click the check box of the client location(s) you'd like to scan.
  4. In the upper right corner of the page, click Scan.
  5. In the Scan Location dialog box, choose your desired scan options or use the pre-configured choices. Then, click Scan.

Scan devices within a location

To run a manual scan against one or more EDR agents within a location, perform the following steps:

  1. In the top navigation menu of your instance, click Organizations.
  2. The Organizations page will load. In the left navigation menu, click Locations.
  3. In Location column, click the name of the desired location.
  4. The Location details page is displayed. In the Devices table, select the check box(es) for the desired device(s).
  5. In the Scan device dialog box, choose your desired scan options or use the pre-configured choices. Then, click Scan.

Scan an individual agent

To run a manual scan against one EDR agent from the Device details page, perform the following steps:

  1. In the top navigation menu of your instance, click Organizations.
  2. The Organizations page will load. In the left navigation menu, click Devices.
  3. In the Filter field, use the Host filter to filter by the desired hostname.
  4. In the Device column, click the desired device.
  5. On the Device details page, click Scan.
  6. In the Scan device dialog box, choose your desired scan options or use the pre-configured choices. Then, click Scan.

Automatically run extensions during scans

You can configure any enabled extension to run at each scan interval. To do so, perform the following steps:

  1. In the top navigation menu, select > Admin.
  2. In the left navigation menu, click Extensions.
  3. In the Default column, click the option for each extension you want to run during each scan. Only collection Type extensions can be selected.
  4. To stop an extension from running with every scan, click the option in Default column to deselect it.

View the results of a scan

Datto AV

For Datto AV scans, any items that are detected by the engine will result in an alert being generated against that host. For more information on working with alerts, refer to the article Working with the Alerts page.

Datto EDR

For Datto EDR scans, suspected threats and notable adversary behaviors detected by the Datto EDR analysis engine will result in alert being generated against that host. For more information on working with alerts, refer to the article Working with the Alerts page.

I addition, you are able to view the data collected from a scan by using the Search tab of the UI. For details on working with the Search tab and performing searches, refer to Understanding the Search page.

 

Revision Date
Updated all PRs. 9/18/25