wyre-ai/msp-claude-plugins/audit

Datto RMM Audit Data

Overview

Audit data in Datto RMM provides detailed hardware and software inventory for managed devices. The agent periodically collects this information and reports it to the platform. This skill covers accessing audit data, understanding its structure, and common audit workflows.

Anti-triggers

• Software observed running rather than software installed —

RocketCyber reports application telemetry from its own sensor; use rocketcyber-apps.

• Whether the device is reachable right now — audit data is a

periodic snapshot and goes stale; use datto-rmm-devices.

• Inventory as documentation of record — use

itglue-configurations.

Key Concepts

Audit Categories

Audit Freshness

Audit data is collected periodically:

• Standard devices: Every 24 hours
• Software changes: Real-time detection
• On-demand: Triggered by agent commands

Field Reference

Audit responses are grouped into hardware, operatingSystem, network, plus the ESXi-specific blocks. The most-used fields:

See references/fields.md for the complete field reference (hardware, software, network, and ESXi host audits).

API Patterns

All audit endpoints take the device UID, not the device ID, and all timestamps (lastAuditDate, lastScan, lastBootTime) are epoch milliseconds.

See references/api.md for the full request/response examples for each endpoint.

Workflows

Reference implementations for the common audit workflows — software compliance check, hardware inventory report, find-devices-with-specific-software, disk space analysis, and ESXi capacity report — are in references/examples.md.

Error Handling

A 404 from an audit endpoint is ambiguous: it means either the device UID is wrong or the agent has never completed an audit. Check the device exists before concluding the audit is missing.

See references/errors.md for the audit freshness validation helper.

Best Practices

1. Check audit freshness - Verify data is recent before reporting
2. Handle missing data - Not all devices have complete audits
3. Use software inventory for compliance - Track required applications
4. Monitor disk space trends - Use audit data for capacity planning
5. Track hardware lifecycle - Use warranty and spec data
6. ESXi-specific queries - Use dedicated ESXi endpoints
7. Filter software results - Exclude Windows updates if needed
8. Document hardware standards - Use audit to verify standards

Related Skills

• Datto RMM Devices - Device management
• Datto RMM Alerts - Disk/hardware alerts
• Datto RMM Variables - Store audit metadata
• Datto RMM API Patterns - Authentication and pagination