Deploying the delete_file extension

NAVIGATION  Alerts

SECURITY  To upload and enable extensions: Datto EDR subscription with administrator-level platform access

SECURITY  To deploy response extensions: Datto EDR subscription with analyst-level platform access

This article describes the purpose and function of the delete_file response extension and how to use it.

For more information about collection and response extensions, refer to Leveraging collection and response extensions.

Overview

Extension details

Name

Delete File
File type Datto EDR extension
Extension type

Response
Global variables

Yes
Description

Deletes a file by path
Author

Datto EDR
Notes

This is an official Datto EDR extension. Editing it is not permitted. However, you may create a copy of this extension if you wish to edit it.

Usage

Before you can use extensions, you must enable them. To do so, perform the following steps:

  1. In your EDR platform, navigate to > Admin > Extensions.

  2. The Extensions page will load.

  3. To create a new deployable solution, click Add Extension, complete all applicable fields, and then click Save. The new executable file will appear in the list of available solutions.

  4. To enable an extension, check its corresponding selector in the Active field. If the selected executable file is a response action, it will become available at Alerts >  > Respond.

  5. To disable an extension, clear its selector.

  1. In the top navigation menu, click Alerts.

  2. The Alerts page will load. You'll see a list of the threats that Datto EDR has detected during audits of your endpoints, with the most recent suspected malicious content displayed first.

  1. Locate the alert to which you'd like to respond.

  2. Click the (action menu) at the end of the alerted object's line.

  3. Click Respond. The response action menu will open.

  1. Select the Delete File action. Then, click Confirm.

  1. If the malicious file is present on the endpoint during the next agent and instance communication, the delete file action will remove it.

From the Tasks menu

  1. In the top navigation menu, click Tasks. You'll see a list of the most recently-queued tasks and their current status. If the action's execution finished, you'll see a Complete status indicated beneath its progress bar.

  2. Clicking the task will open its detail page. Verify that a Success status is indicated in the Results field.

From the Respond page

  1. In the top navigation menu, click Respond. The Responses page will open.

  1. Locate the task you deployed.

  2. Verify that Completed is shown in the Status column and that a icon appears in the Execution & Summary column.

Additional resources