Datto RMM Audit — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Datto RMM Audit (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Audit data in Datto RMM provides detailed hardware and software inventory for managed devices. The agent periodically collects this information and reports it to the platform. This skill covers accessing audit data, understanding its structure, and common audit workflows.
RocketCyber reports application telemetry from its own sensor; use rocketcyber-apps.
periodic snapshot and goes stale; use datto-rmm-devices.
itglue-configurations.
| Category | Description | Examples |
|---|---|---|
| Hardware | Physical components | CPU, RAM, disks, motherboard |
| Software | Installed applications | Programs, versions, publishers |
| Network | Network configuration | Interfaces, IPs, MACs |
| Operating System | OS details | Version, build, architecture |
| ESXi | VMware hypervisor info | VMs, datastores, hosts |
| Printer | Network printers | Name, model, status |
Audit data is collected periodically:
Audit responses are grouped into hardware, operatingSystem, network, plus the ESXi-specific blocks. The most-used fields:
| Block | Key fields |
|---|---|
hardware.processor | name, cores, logicalProcessors, speed |
hardware.memory | totalRam, availableRam, slots[] (bytes, not MB) |
hardware.disks[] | name, size, freeSpace, type |
operatingSystem | name, version, architecture, installDate, lastBootTime |
network.interfaces[] | name, macAddress, ipv4, dhcpEnabled |
| root | lastAuditDate (epoch ms) |
See references/fields.md for the complete field reference (hardware, software, network, and ESXi host audits).
| Purpose | Endpoint |
|---|---|
| Full device audit | GET /api/v2/device/{deviceUid}/audit |
| Software inventory | GET /api/v2/device/{deviceUid}/audit/software |
| ESXi host audit | GET /api/v2/device/{deviceUid}/audit/esxi |
| Printer audit | GET /api/v2/device/{deviceUid}/audit/printers |
All audit endpoints take the device UID, not the device ID, and all timestamps (lastAuditDate, lastScan, lastBootTime) are epoch milliseconds.
See references/api.md for the full request/response examples for each endpoint.
Reference implementations for the common audit workflows — software compliance check, hardware inventory report, find-devices-with-specific-software, disk space analysis, and ESXi capacity report — are in references/examples.md.
| Error | Status | Cause | Resolution |
|---|---|---|---|
| Device not found | 404 | Invalid deviceUid | Verify device exists |
| Audit not available | 404 | No audit data yet | Wait for agent collection |
| Device offline | - | Agent not reporting | Check device connectivity |
A 404 from an audit endpoint is ambiguous: it means either the device UID is wrong or the agent has never completed an audit. Check the device exists before concluding the audit is missing.
See references/errors.md for the audit freshness validation helper.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.