Filters - Legacy UI
SECURITY Refer to ACCOUNT > Filters and SITES > Filters in Security Level Details - Permissions
NAVIGATION Legacy UI > Sites > Default Device Filters or Custom Device Filters
NAVIGATION Legacy UI > Sites > click on a site > Default Device Filters or Site Device Filters
Refer to Device filters.
About filters
A filter in Datto RMM is a tool that is used to sort through a large number of devices. Filters rely on device audit data and are available at both the account and site level. A filter can be configured with certain criteria to target specific attributes of a device. It can even be set up to locate devices with specific software.
Filters are dynamic and work independently of sites so you can have a filter that looks for devices with specific criteria across all sites. As device attributes change, the filters will automatically be updated and all the devices that match the filter criteria will be displayed in the filter results.
Filters are a fundamentally critical part of Datto RMM as they can effectively target the right devices with reports, monitors, jobs, patch management, etc. If your servers go offline, for example, you can target an online status monitor at your servers with the help of a filter.
NOTE To see how filters work in a policy, refer to Managing policies - Legacy UI in the legacy UI and Policies in the New UI.
There are a set of Default Device Filters available in every account in Datto RMM. You can use them to filter through all of the devices in your account or just in one particular site.
- To filter through all of the devices in your account, click Sites and locate the Default Device Filters area in the left navigation pane.
- To filter through one site only, go to Sites > click on one of your sites and locate the Default Device Filters area in the left navigation pane.
- The following filter categories will be displayed:
Category | Description |
---|---|
Application | Contains filters for applications, such as Adobe Flash, Java, Microsoft Office. |
Backup solution | Contains filters for backup solutions, such as Autotask Endpoint Backup (Datto File Protection), Backup Exec, Veeam. |
Compliance | Contains filters for devices that need your attention as they run out of memory, their antivirus is not running, they need a reboot, etc. |
Operating system | Contains filters for operating systems, such as Linux, Windows, macOS. |
Role | Contains filters for servers, such as DNS servers, domain controllers, SQL servers. |
Security software | Contains filters for security software, such as ESET, Symantec, Webroot. |
Status | Contains filters for device status, such as Network Node, offline, online. |
Type | Contains filters for device types, such as all devices, ESXi devices, and so forth. |
- Expand a category to be able to see the various filters within it.
NOTE The Default Device Filters provided by Datto RMM cannot be edited or deleted. To understand how they are configured, refer to Default Device Filter definitions.
- Click on any of the filters to be directed to the list of devices that meet the filter requirements.
- You can also use the dynamic search above the filter categories. Start typing in the Search field and you'll be presented with the filters that match your query.
NOTE The Search field can be used by pressing Ctrl + / on your keyboard, without having to use your mouse.
The Default Device Filters provided by Datto RMM have been configured the following way:
Application | ||||
---|---|---|---|---|
Filter Name | Field | Qualifier | Criteria | Operator |
Adobe Flash | Software package | Begins with | Adobe Flash Player | |
Box.Net | Box Sync | |||
Dropbox | Dropbox | |||
Google Chrome | Google Chrome | AND | ||
Does not contain | Frame, Helper | |||
Java | Begins with | Java | ||
Microsoft Office | Microsoft Office 365, Microsoft Office Professional, Microsoft Office Home, Microsoft Office Standard, Microsoft Office Basic, Microsoft Office Small, Microsoft Office Ultimate, Microsoft Office Enterprise | |||
Mozilla Firefox | Mozilla Firefox | |||
SQL Express | Contains | SQL Server | AND | |
Express | ||||
Backup Solution | ||||
Filter Name | Field | Qualifier | Criteria | Operator |
Acronis TrueImage | Software package | Begins with | Acronis True, Acronis Backup, Acronis\\u00C2 True\\u00C2 NOTE Last query: to support mishandled UTF-8 encoding |
|
Ahsay | Ahsay A-Click Backup, AhsayOBM, AhsayACB, AhsayCBS, AhsayPRD, AhsayUBS, Ahsay Cloud Backup Suite | |||
Autotask Endpoint Backup (Datto File Protection) | Autotask Endpoint Backup | |||
Backup Exec | Symantec Backup Exec | |||
StorageCraft | Contains | StorageCraft ShadowProtect, ShadowSnap | ||
Veeam | Begins with | Veeam Backup, Veeam Endpoint, Veeam Hyper-V, Veeam Agent for Microsoft Windows | ||
Compliance | ||||
Filter Name | Field | Qualifier | Criteria | Operator |
< .NET 4.0.3 | .NET Version | Begins with | 1., 2., 3., 4.0.0, 4.0.1, 4.0.2 | |
< 2GB Free Space | Disk freespace | Less than | 2G | |
< 2GB Memory | Memory | Less than | 2G | |
Antivirus Not Running | Antivirus status | Is | Not running NOTE The information is only stored for servers, desktops, and laptops. Refer to Status. |
|
No MS Office | Software package | Does not contain | Microsoft Office | AND |
Device type | Contains | Desktop, Laptop | ||
No Splashtop Streamer | Software package | Does not contain | Splashtop Streamer | AND |
Device type | Contains | Desktop, Laptop | ||
Reboot Required | Reboot required Boolean | Equals | True | |
Suspended Devices | Status - Suspended Boolean | Equals | True | |
Network | ||||
Filter Name | Field | Qualifier | Criteria | Operator |
Firewalls - FortiGate | Manufacturer | Contains | Fortinet | AND |
Device type | Network Device (Firewall) | |||
Firewalls - SonicWALL | Manufacturer | Sonicwall | ||
Device type | Network Device (Firewall) | |||
Firewalls - pfSense | SNMP Description | pfSense NOTE Filtering on a pfSense device requires the device in question to be added as a Network Device, not an Agent Device. pfSense devices can have an Agent installed on them, but two separate device listings will be required, with the Network Device listing requiring manual (IP-based) addition. |
||
NAS Devices - QNAP | Manufacturer | Begins with | QNAP | AND |
Device type | Contains | Network Device (NAS) | ||
NAS Devices - Synology | NIC Vendor | Synology | ||
Device type | Network Device (NAS) | |||
Routers - Cisco | Manufacturer | Cisco | ||
Systems | ||||
Device type | Network Device (Router) | |||
Routers - Huawei | Manufacturer | Huawei | ||
Device type | Network Device (Router) | |||
Routers - Juniper | Manufacturer | Juniper | ||
Device type | Network Device (Router) | |||
Routers - Netgear | Manufacturer | Netgear | ||
Device type | Network Device (Router) | |||
Routers - ZyXEL | Manufacturer | Zyxel | ||
Device type | Network Device (Router) | |||
SAN Devices - Dell | Manufacturer | Begins with | Dell Inc | |
Device type | Contains | Network Device (SAN) | ||
SAN Devices - EMC | Manufacturer | Begins with | EMC Data, EMC C | |
Device type | Contains | Network Device (SAN) | ||
SAN Devices - HP | Manufacturer | Begins with | Hewlett, HP | |
Device type | Contains | Network Device (SAN) | ||
SAN Devices - NetApp | Manufacturer | Network Appliance Corporation | ||
Device type | Network Device (SAN) | |||
Servers - Dell | Manufacturer | Begins with | Dell Inc | |
Device type | Contains | Server | ||
Servers - Fujitsu | Manufacturer | Fujitsu | ||
Device type | Server | |||
Servers - HP | Manufacturer | Begins with | Hewlett, HP | |
Device type | Contains | Server | ||
Switches - Cisco | Manufacturer | Cisco | ||
Systems | ||||
Device type | Network Device (Switch) | |||
Switches - HP | Manufacturer | Begins with | Hewlett, HP | |
Device type | Contains | Network Device (Switch) | ||
Switches - Juniper | Manufacturer | Juniper | ||
Device type | Network Device (Switch) | |||
UPS Devices - APC | Manufacturer | Begins with | American Power Conversion Corp, Schneider Electric | |
Device type | Contains | Network Device (UPS) | ||
Operating System | ||||
Filter Name | Field | Qualifier | Criteria | Operator |
All Desktop O/S | Device type | Does not contain | Smartphone, ESXi host, Printer | OR |
Operating system | Server, iOS, Android, ESXi | |||
AND Is not empty | ||||
All Server O/S | Contains | Server | ||
All Windows Desktops | Windows | AND | ||
Does not contain | Server | |||
All Windows Servers | Contains | Server | AND | |
Windows | ||||
Apple iOS | iOS | |||
Google Android | Android | |||
Linux | Linux | |||
MS Win XP | XP | |||
MS Win Vista | Vista | |||
MS Win 7 | Windows 7 | |||
AND Does not contain | Server | OR | ||
Mac | ||||
MS Win 8 | Contains | Windows 8 | ||
MS Win 10 | Microsoft Windows 10 | |||
MS Win 11 | Begins with | Microsoft Windows 11 | ||
MS Win Server 2003 | Contains | 2003 | ||
MS Win Server 2008 | 2008 | |||
MS Win Server 2012 | Windows Server 2012 | |||
MS Win Server 2016 | Server 2016 | |||
MS Win Server 2019 | Server 2019 | |||
MS Win Server 2022 | Begins with | Microsoft Windows Server 2022 | ||
macOS | Contains | OS X, macOS | ||
Role | ||||
Filter Name | Field | Qualifier | Criteria | Operator |
DHCP Servers | Service name (not "Service display name") |
Begins with | DHCPServer | |
DNS Servers | Equals | DNS | ||
Domain Controllers | Begins with | NTDS | ||
Exchange Servers | MSExchange | AND | ||
Operating system | Contains | Server | ||
Hyper-V Hosts | Service name (not "Service display name") |
Begins with | vmms | |
IIS Webservers | w3svc | |||
SQL Servers | SQLServer, SQLExpress | |||
Sharepoint Servers | SPAdminV, SPTimerV, SPTraceV, Osearch | |||
WSUS Servers | Contains | WSUSService | ||
Security Software | ||||
Filter Name | Field | Qualifier | Criteria | Operator |
AVG | Software package | Begins with | AVG 20, AVG Anti, AVG Free | |
Avira | Avira AntiVir, Avira Antivirus, Avira Endpoint, Avira Free, Avira Internet, Avira Professional, Avira Server | |||
ESET | ESET | AND | ||
Contains | Cyber, Antivirus, Security | |||
Kaspersky | Begins with | Kaspersky Anti-Virus, Kaspersky Endpoint, Kaspersky Internet, Kaspersky PURE, Kaspersky Total Security | ||
McAfee | McAfee All, McAfee Anti, McAfee Endpoint Protection, McAfee Internet, McAfee LiveSafe, McAfee Multi, McAfee Security, McAfee Total, McAfee Virus | |||
Panda | Panda Cloud Antivirus, Panda Cloud Office, Panda Cloud Cleaner, Panda A, Panda Endpoint Protection, Panda Free, Panda Global, Panda Gold, Panda Internet | |||
Sophos | Sophos Anti, SophosAnti, Sophos Endpoint | |||
Symantec | Symantec | AND | ||
Contains | Endpoint, Antivirus | |||
Trend Micro | Worry-Free, Antivirus, Client, Server, Inter, Max, OfficeScan, Security, Titanium | OR | ||
Begins with | Trend Micro | |||
Webroot | Webroot | AND | ||
Contains | SecureAnywhere, AntiVirus | |||
Status | ||||
Filter Name | Field | Qualifier | Criteria | Operator |
Last Seen > 30 Days | Last seen date | Older than 30 days | ||
Network Node | Network Node Boolean | Equals | True | |
Offline Devices | Status - Online/Offline Boolean | False | ||
Online Devices | True | |||
Offline > 1 Week | Last seen date | Self-explanatory | ||
Offline Desktop O/S | Status - Online/Offline Boolean | Equals | False | AND |
Operating system | Does not contain | iOS, Android, Server, ESXi | ||
Device type | Smartphone, Printer, ESXi Host | |||
Offline Server O/S | Operating system | Contains | Server | AND |
Status - Online/Offline Boolean | Equals | False | ||
Online Desktop O/S | Operating system | Does not contain | Server, iOS, Android, ESXi | AND |
Is not empty | ||||
Device type | Does not contain | Smartphone, Printer, ESXi Host | ||
Status - Online/Offline Boolean | Equals | True | ||
Online Server O/S | AND | |||
Operating system | Contains | Server | ||
Reboot > 30 Days | Last reboot | Older than 30 days | ||
Type | ||||
Filter Name | Field | Qualifier | Criteria | Operator |
All Datto Continuity Devices | Device type | Contains | Datto Continuity | |
All Datto Protected Devices | Device type | Contains | Datto Continuity Protected Devices | |
All Devices | No filter | |||
All Firewalls | Device type | Contains | Network Device (Firewall) | |
All Laptops | Laptop | |||
All Mobiles | Operating system | iOS | OR | |
Android | ||||
All NAS Devices | Device type | Network Device (NAS) | ||
All Network Devices | NetworkDevice | |||
All Network Printers | Printer | |||
All Routers | Network Device (Router) | |||
All SAN Devices | Network Device (SAN) | |||
All Switches | Network Device (Switch) | |||
ESXi | Operating system | ESXi NOTE ESX devices are unsupported. This filter will not display them. |
||
(Deprecated) Local Cache | Local Cache | Equals | True IMPORTANT With the 10.0.0 release, the local cache functionality has been deprecated as part of Datto's continued commitment to security. References to the local cache remain in the UI at present, but will be removed in the future. |
|
Physical Servers | Manufacturer | Does not contain | VMWare, Citrix, Microsoft, Parallels, InnoTek | OR |
Operating system | Contains | Server | ||
Virtual Machines | Manufacturer | Contains | Microsoft, Citrix, Xen, VMWare, Parallels, InnoTek | AND |
Model | Does not begin with | Surface |
Datto RMM's Default Device Filters are useful in many cases but you probably want to create your own filters to make the most of this functionality. Custom filters allow you to apply jobs, monitors or patches to a carefully selected subset of your estate. Any user can create filters that can be applied at both the Account level (Custom Device Filter) and Site level (Site Device Filter). You can filter on any bit of information that is pulled back and visible in the device audit which is updated at least once a day for Managed devices and at least once every 7 days for OnDemand devices.
How to...
- Go to Sites and locate the Custom Device Filters area in the left navigation pane.
- Click the green plus icon to add a new filter.
- Specify the filter criteria in the New Custom Device Filter window.
Field | What to Enter |
---|---|
Name | Give your filter a descriptive name, such as "PDF reader and 20 GB disk space" (see Example: create a Custom Device Filter below). |
Criteria | Use the drop-down menu to select the criteria you want to filter on. The drop-down menu will list a set of criteria collected through device audits. You can specify more than one criterion in the filter by clicking on the green plus icon either at the end of the row or underneath a row. For more information, refer to Filter by multiple criteria. NOTE For a complete list of filter criteria, refer to Filter criteria definitions. NOTE Using a pipe "|" character within the Software Package field for Software Package (CONTAINS Name)/version and Software Package (EXACT Name)/version is only supported in the New UI. Refer to Device filters. |
Select devices in all of my sites. | Select this option if you want the filter to contain devices from every site. |
Only select devices in the following sites. | Select this option if you want the filter to contain devices from selected sites only. Hold the Ctrl / Cmd key for multiple selections and click Include or Exclude accordingly. |
Share this filter with users in the following security level(s). | By default, only filter creators can view, edit, and delete the definitions for a Custom Device Filter. However, you can specify whether you want to share the filter with other security levels within the account. Hold the Ctrl / Cmd key for multiple selections and click Include or Exclude accordingly. NOTE The users with whom you shared the filter will be able to open the filter shared with them, see the criteria it uses, and view the results of the filter. They will also be able to edit or delete the filter if they have Manage permissions for Filters. Refer to Permissions. |
- Once the above fields are filled in, click Save.
- Under Custom Device Filters, click on the newly created filter to see which devices match the criteria.
- Go to Sites and select a site.
- Locate the Site Device Filters area in the left navigation pane.
- Click the green plus icon to add a new filter.
- Specify the filter criteria in the New filter for site window.
Field | What to Enter |
---|---|
Name | Give your filter a descriptive name. |
Criteria | Use the drop-down menu to select the criteria you want to filter on. The drop-down menu will list a set of criteria collected through device audits. You can specify more than one criterion in the filter by clicking on the green plus icon either at the end of the row or underneath a row. For more information, refer to Filter by multiple criteria. NOTE For a complete list of filter criteria, refer to Filter criteria definitions. NOTE Using a pipe "|" character within the Software Package field for Software Package (CONTAINS Name)/version and Software Package (EXACT Name)/version is only supported in the New UI. Refer to Device filters. |
Add this filter to my other sites | Select this option if you want this filter to be available in all of your sites. |
Share this filter with users in the following security level(s). | By default, only filter creators can view, edit, and delete the definitions for a site filter. However, you can specify whether you want to share the filter with other security levels within the account. Hold the Ctrl / Cmd key for multiple selections and click Include or Exclude accordingly. NOTE The users with whom you shared the filter will be able to open the filter shared with them, see the criteria it uses, and view the results of the filter. They will also be able to edit or delete the filter if they have Manage permissions for Filters. Refer to Permissions. |
- Once the above fields are filled in, click Save.
- Under Site Device Filters, click on the newly created filter to see which devices match the criteria.
To filter by multiple criteria:
- Click the plus sign below a criterion.
- Select the OR or AND operator.
NOTE If both conditions must be true for a device to be included in the search results, select AND. If either one must be true, select OR.
NOTE When you add additional criteria, you cannot combine AND and OR. The selection you made first is repeated for any subsequent criterion.
- Select the next criterion.
- Click the minus sign to remove any of the criteria.
To group queries within a criterion:
- Click the plus sign next to a criterion.
- Select the OR or AND operator.
NOTE Standard SQL dictates that grouped queries on a positive criterion (for example, "Software package contains 1", "Software package contains 2", "Software package contains 3") need to be grouped with OR. For example, "Software package contains Adobe Reader OR Foxit Reader OR Sumatra PDF" will return devices that have either Adobe Reader or Foxit Reader or Sumatra PDF installed.
Negative queries (for example, "Software package does not contain 1", "Software package does not contain 2", "Software package does not contain 3") need to be grouped with AND. For example, "Software package does not contain Adobe Reader AND Foxit Reader AND Sumatra PDF" will only return devices that have neither Adobe Reader nor Foxit Reader or Sumatra PDF installed.
NOTE When you add additional queries, you cannot combine AND and OR. The selection you made first is repeated for the subsequent queries.
- Select the next criterion.
- Click the minus sign to remove any of the criteria.
The Default Device Filters provided by Datto RMM cannot be edited or deleted, however, custom filters can be edited or deleted by their creator.
NOTE The users with whom you shared the filter will be able to open the filter shared with them, see the criteria it uses, and view the results of the filter. They will also be able to edit or delete the filter if they have Manage permissions for Filters. Refer to Permissions.
To edit or delete a custom filter:
- Go to Sites > Custom Device Filters OR Sites > click on one of the sites > Site Device Filters.
- Hover over the filter you want to edit or delete.
- Click the pencil icon to edit the filter.
- Click the Remove filter icon to delete the filter. Deleting a filter will affect anything that uses it as a target (for example, scheduled jobs or policies). Once a filter is deleted, it can no longer be used as a target. Check the I understand that this action is irreversible check box before clicking the Permanently Delete Filter button.
In our example, we will filter for devices that have a software application installed that can open PDF files, such as Adobe Reader or Foxit Reader and have 20 GB of free disk space available. This filter will be applied for the entire account.
- Go to Sites > Custom Device Filters and click the green plus icon to add a new filter.
- Give your filter a Name, such as "PDF reader and 20 GB disk space".
- In the criteria section, specify "Software package contains Adobe Reader".
- Click the green plus icon at the end of the row (not the one underneath) to add an additional value in this section.
- Enter Foxit Reader as a new value.
- Make sure to set the blue and/or button to OR to see any devices that have either Adobe Reader or Foxit Reader.
- Click the green plus icon underneath to add a new section.
- Make sure to set the blue and/or button to AND to see devices that match the criteria of the first and second set.
- In the new section, specify "Disk free space is greater than 20G".
- Leave the rest of the options at their default selection.
- Click Save.
- Under Custom Device Filters, click on the name of the newly created filter to see a list of all the devices that fit these two sets of requirements.
Note
NOTE When using the Does not contain criterion, the Is empty criterion is implicitly included.
The following table illustrates a difference in how empty fields are handled in custom filters:
Criterion | Does it include the "Is empty" criterion? |
---|---|
Does not contain | Yes |
Does not equal | No |
Does not begin with | No |
Does not end with | No |
EXAMPLE For instance, if User-Defined Field 1 is empty for a device, that device will show up in a filter for User-Defined Field 1 does not contain XYZ but will not show up in a filter for User-Defined Field 1 does not equal XYZ.
The Is empty criterion can be added to any of the above criteria using OR.
EXAMPLE In the above example, the Is empty criterion could be included along with Does not equal by adding another criterion of OR User-Defined Field 1 is empty.