Deploying the delete_file extension
NAVIGATION Alerts
SECURITY To upload and enable extensions: Datto EDR subscription with administrator-level platform access
SECURITY To deploy response extensions: Datto EDR subscription with analyst-level platform access
This article describes the purpose and function of the delete_file response extension and how to use it.
For more information about collection and response extensions, refer to Leveraging collection and response extensions.
Overview
| Extension details | |
|---|---|
|
Name |
Delete File |
| File type | Datto EDR extension |
| Extension type |
Response |
| Global variables |
Yes |
| Description |
Deletes a file by path |
| Author |
Datto EDR |
| Notes |
This is an official Datto EDR extension. Editing it is not permitted. However, you may create a copy of this extension if you wish to edit it. |
Usage
Creating or enabling extensions
Before you can use extensions, you must enable them. To do so, perform the following steps:
-
In your EDR platform, navigate to
> Admin > Extensions. -
The Extensions page will load.
-
To create a new deployable solution, click Add Extension, complete all applicable fields, and then click Save. The new executable file will appear in the list of available solutions.
-
To enable an extension, check its corresponding selector in the Active field. If the selected executable file is a response action, it will become available at Alerts >
> Respond.
-
To disable an extension, clear its selector.
Using the delete_file extension
-
In the top navigation menu, click Alerts.
-
The Alerts page will load. You'll see a list of the threats that Datto EDR has detected during audits of your endpoints, with the most recent suspected malicious content displayed first.
-
Locate the alert to which you'd like to respond.
-
Click the
(action menu) at the end of the alerted object's line. -
Click Respond. The response action menu will open.
-
Select the Delete File action. Then, click Confirm.
-
If the malicious file is present on the endpoint during the next agent and instance communication, the delete file action will remove it.
Verifying file removal
From the Tasks menu
-
In the top navigation menu, click Tasks. You'll see a list of the most recently-queued tasks and their current status. If the action's execution finished, you'll see a Complete status indicated beneath its progress bar.
-
Clicking the task will open its detail page. Verify that a Success status is indicated in the Results field.
From the Respond page
-
In the top navigation menu, click Respond. The Responses page will open.
-
Locate the task you deployed.
-
Verify that Completed is shown in the Status column and that a
icon appears in the Execution & Summary column.
