DRMM Security Card: Endpoint Security Statuses

Security Card Overview

The Security Card on the Device Summary page in Datto RMM serves as the centralized dashboard for auditing and managing the security tools installed on an endpoint. It provides real-time metrics and statuses for critical technologies, categorized into:

Datto Endpoint Security: Includes the monitoring of Datto EDR and Ransomware Detection (RWD).

Malware Protection: Monitors the antivirus product, which can be Datto AV or Managed Windows Defender Antivirus.

RocketCyber: Monitors the installation and status of the RocketCyber Agent.

2. How Datto RMM Determines Security Statuses

Rather than relying on simple network pings, Datto RMM determines the security status by continuously reading a structured telemetry file generated by the local agent. The EDR agent writes this telemetry to a file named dattoEdr.json, located in the C:\ProgramData\KaseyaOne directory.

For example, querying this file locally via PowerShell (PS C:\ProgramData\KaseyaOne> cat dattoEdr.json) outputs the exact telemetry data the platform uses to determine the Security Card statuses:

PS C:\ProgramData\KaseyaOne> cat dattoEdr.json

{

"dattoAv": true,

"dattoAvUpToDate": true,

"dattoAvLastUpdate": 1783024164,

"dattoAvPolicyName": "VM No Options",

"dattoAvPolicyId": "b143c635-f297-4354-8809-dd897b218ed6",

"dattoAvRealTimeProtection": false,

"edrPolicyName": "EDR no options",

"edrPolicyId": "ed9a6efe-9908-4f8f-897e-e53cfad51b32",

"rwdPolicyName": "Ransomware with no options",

"rwdPolicyId": "4f6ddca0-f3c0-4b72-a6a3-1ad700e8f704",

"dattoEdr": true,

"dattoEdrAgentVersion": "3.17.1.5552",

"dattoEdrRealTime": false,

"dattoEdrTamperProtection": false,

"ransomwareDetection": true,

"ransomwareRollback": false,

"managedWinDefAntivirus": false,

"winDefAntivirusActive": true,

"rebootRequired": false,

"isIsolated": false,

"timestamp": "2026-07-02T22:13:22.745340600Z",

"davEngineVersion": "8.4.2.12",

"davSignatureVersion": "8.21.2.132",

"davSignatureUpdate": "2026-07-02T11:36:05Z"

}

Note: The timestamp in dattoEdr.json is in UTC and ISO 8601 format.

Datto RMM audits this state file and its associated Windows services. Specifically, the monitoring engine evaluates:

Windows Service Status: It verifies that the required services are in a "Running" state.
Telemetry Freshness: The Datto EDR status JSON file must have been updated by the agent within the last three minutes.
Internal Boolean Flags: Specific properties in the JSON file dictate the exact behavior reported to the platform. For example, properties like "dattoEdr": true, "dattoAvUpToDate": true, and "isIsolated": false define the exact security posture.

3. Endpoint Security statuses

This status is available only if the Datto Endpoint Security Integration is enabled for your Datto RMM account.

Datto RMM service on Windows for troubleshooting purposes: "cag service"

4. Datto AV (Antivirus) Statuses

This status appears in the following locations:

Device summary page: Antivirus Product field in the Security card.
List of devices: Managed Antivirus column.

Note:

Endpoint Protection Service, and the redundant service: Endpoint Protection Service 2 are the Datto AV services available in Windows.
The device(s) must be targeted by an Endpoint Security policy with the Datto Endpoint Security configuration.

Enforced	Status color: green
Inactive	Status color: gray

5. Managed Windows Defender Antivirus

Device summary page: Managed Windows Defender field in the Security card.
List of devices: Managed Antivirus column.
Dashboard: Managed Windows Defender Status widget.

Enforced	Status color: green
Inactive	Status color: gray

6. Ransomware Detection (RWD) Statuses

This status appears in the following locations:

Device summary page: Ransomware Detection field in the Security card

The Ransomware Detection has its own service on Windows: RWDWrapper

Status Status Color Description Specifications

Active

Green

The device is targeted by Ransomware Detection and the agent is sending back data, which occurs in any of the following scenarios:

The device is targeted by a Datto RMM Ransomware monitor at the device level, from a Monitoring policy, or from an Endpoint Security policy with Ransomware Detection enabled. For information about standalone Datto RMM Ransomware Detection, refer to Standalone Datto RMM Ransomware Detection.
The Datto Endpoint Security Integration is enabled in Datto RMM, the device is targeted by an Endpoint Security policy with Datto Endpoint Security enabled and Ransomware Detection not enabled in Datto RMM, and the device is targeted by a Ransomware Detection policy in your Datto EDR/AV portal. Refer to Understanding Datto EDR's ransomware detection and Ransomware policy in the Datto EDR Help system. This security configuration is recommended for optimal performance.
The Datto Endpoint Security Integration is enabled in Datto RMM, the device is targeted by an Endpoint Security policy with both Datto Endpoint Security and Ransomware Detection enabled in Datto RMM, and the device is not targeted by a Ransomware Detection policy in your Datto EDR/AV portal. To prevent conflicts, this security configuration is not recommended.

NOTE: If you are using the Datto Endpoint Security Integration in Datto RMM (recommended), you should deploy Ransomware Detection through Datto EDR/AV. In doing so, the Ransomware Detection status for devices targeted by the Datto Endpoint Security configuration in an Endpoint Security policy will show as Active in Datto RMM.

The RWDWrapper service is running (as indicated in Task Manager or Services.msc).
The Datto EDR status JSON file has been updated in the last three minutes.
The Datto EDR status JSON file indicates a correct and functional state (ransomwareDetection property = true).

The Datto RMM Ransomware monitor is present.

Inactive Gray Ransomware Detection is not targeting the device(s).

Pending Yellow Ransomware Detection is targeting the device(s), but the Ransomware Detection status is pending until the agent begins sending back data.

Important note: Ransomware Detection is only available on supported Windows version, check the following documentation for more information: Understanding Datto EDR's Ransomware Detection

7. Deep Monitoring and Performance Diagnostics (System Metrics)

To troubleshoot stubborn states where RMM shows "Needs Attention" or high resource consumption by the agent, utilize the following tools from the Device Details page:

Start Metrics Collection: Collects File Sizes and System Usage data for one hour. This is highly useful for troubleshooting resource consumption issues generated by the agent.

Start Verbose Logging: Sets the EDR Agent into a verbose "Trace" log level for 7 days, and then automatically reverts to the "Informational" level. This is ideal for troubleshooting anomalous behavior.

Status Monitoring: Provides up to 180 days of history tracking when a device goes online or offline. This makes it easier to troubleshoot connectivity issues and spot recurring patterns.

Datto AV Scan History: Provides a 90-day record of completed and failed scans (including Scan Time, Scan Type, and Status) which can be exported as a CSV report for audit needs.

8. Frequently Asked Questions & Troubleshooting Scenarios

Q1: Why does the Security Card show "Needs Attention" even though all services are running?

If (json) hasn't been updated in the last 3 minutes then, it will show "needs attention"
It's recommended to run the "Datto EDR Maintenance Win/Mac" (for windows, and macOS)

Q2: What does it mean if AV status is "Unknown"?

None of the statuses Defined, Security center, and override are not reporting.
we can check the json and verify if the endpointprotectionservices are running.

Q3: How do I resolve a "Stale" or "Inactive" status?

Confirm the device is online and can reach the Datto RMM platform.
Run the component "Datto EDR Maintenance Win/Mac". This will restart the agent and might fix issues on the system. Otherwise, reach out to the support team for further assistance.

Q4: What if RWD is "Pending" for an extended period?

Ensure the device is assigned a valid RWD policy and the RWDWrapper service is running. Check for policy synchronization issues in the RMM and EDR portals.

Q5: How do I interpret the "isIsolated" flag?

If isIsolated: true, the device is network-isolated by EDR. Use the RMM or EDR portal to revert isolation once the threat is cleared.

Q6: How do I collect logs for support?

Use the “Fetch Logs” feature in the EDR portal or collect logs from the paths listed in your process/service/log reference guide.

8. Best Practices for Maintaining Healthy Security Card Status

Regularly audit device policies to ensure all endpoints are assigned the correct EDR, AV, and RWD policies.
Schedule periodic reboots for endpoints to ensure updates and policy changes are applied.
Use the RMM’s built-in maintenance and diagnostic tools for proactive monitoring.
Educate end users to report any tray icon changes or security card warnings immediately.

Status on Card	Color	Description	Specifications
Active	Green	The Datto EDR service is running and active. In the applied Endpoint Security policy, the Threat Detection monitor in the Datto Endpoint Security configuration is functioning as expected to target the device(s).	The Datto EDR Agent (HUNTAgent) service is running (as indicated in Task Manager or Services.msc). The Datto EDR status JSON file has been updated in the last three minutes. The Datto EDR status JSON file indicates a correct and functional state (dattoEdr property = true).
Needs Attention	Orange	The Datto EDR service has stopped, or a Datto EDR agent update has failed. As an initial troubleshooting step, we recommend running the Datto EDR Maintenance [WIN] component, available from the ComStore, to help diagnose problems. Refer to ComStore. NOTE: Isolating a device through the Security card on the device summary page or through the Ransomware monitor in Datto RMM results in this status.	This is the default status if a Datto Endpoint Security configuration is present but none of the other status rules apply.
Isolated	Red	Datto EDR has isolated the device or number of devices from the network in attempt to stop suspected ransomware processes and prevent further spread of the infection to other devices. To learn about device isolation in Datto EDR, refer to Ransomware monitoring options in the Datto EDR Help system. To return devices to a normal state after they have been isolated, you can click Revert isolation next to the status: NOTE: This link will only show if a device has been isolated by Datto EDR. Alternately, you can run the Host Isolation Restore extension on the Alerts page in Datto EDR. Doing so will revert any isolation that has occurred on a device and return its ability to contact the internet and other devices on the network. For instructions, refer to Responding to alerts and Leveraging collection and response extensions in the Datto EDR Help system. NOTE: Isolating a device via Datto RMM does not produce the Isolated status. If the device is isolated through the Security card on the device summary page or through the Ransomware monitor in Datto RMM, its status will change to Needs Attention. Isolation can be triggered by policy or manually from the portal.	The Datto EDR Agent (HUNTAgent) service is running (as indicated in Task Manager or Services.msc). The Datto EDR status JSON file has been updated in the last three minutes. The Datto EDR status JSON file indicates host isolation (`Isolated` property = `true`).
No EDR Policy	Yellow	The Datto EDR service is running, but no Datto EDR policy is applied to the device(s). Review the device(s) in your instance of Datto EDR to apply a policy and protect the device(s). Refer to the policies overview in the Datto EDR Help system.	The Datto EDR Agent (HUNTAgent) service is running (as indicated in Task Manager or Services.msc). The Datto EDR status JSON file has been updated in the last three minutes. The Datto EDR status JSON file indicates no policy is applied (`dattoEdr` property = `false`).
Not Installed	Gray	The Datto EDR agent is not installed on the device(s).	The Datto EDR agent is absent.
No RMM Policy	Gray	The device(s) is/are not targeted by an Endpoint Security policy, or the applied Endpoint Security policy does not have the Datto Endpoint Security configuration. Apply an Endpoint Security policy with the Datto Endpoint Security configuration to enable monitoring.	This is the default status if a Datto Endpoint Security configuration is missing.

Browse this section