# Exfiltration Events

The Nightfall Exfiltration page displays various details of the Exfiltration Events. An Exfiltration Event is automatically created in Nightfall  when an Exfiltration policy is violated. The Event displays useful information like the integration on which the exfiltration occurred (Google Drive, Salesforce, macOS/Windows Endpoint), the name of the policy violated, the details of the asset responsible for the violation, and so on.  

## Exfiltration Event List View

You can navigate to the Exfiltration Event page by clicking **Exfiltration Prevention** button from the left menu. 

<figure><img src="/files/Z6NZ7ulqL4Gq1igXdJ8l" alt=""><figcaption></figcaption></figure>

Once you land on the Exfiltration Events page, all the Exfiltration Events are listed. This view can be called as the **Event list view**. When you click an Event on the Event list view, the details of only the selected Event is displayed. We can call it the Event Detail view.&#x20;

{% hint style="info" %}
Some of the Event features are common to both Exfiltration and Data Detection and Response. In such cases, we will provide a link to the respective section in Data Detection and Response.&#x20;
{% endhint %}

The Event list view contains a table which displays details of the Events. You can [click here](https://help.nightfall.ai/dashboard/sdp_events#event-list-view) to learn more about the details displayed in the Event list view.&#x20;

## Filtering Data&#x20;

You can filter the data on the list view by date or by integrations. To filter the data by integrations, you must execute the following steps.&#x20;

1. Navigate to **Exfiltration Prevention** from the left menu.Steps 2-6 help you filter the events to only view the alerts generated by Windows OS.
2. Click **Filter**.
3. Click **+ Add Filter**.
4. Select **Integration**.
5. Select the check box required integration(s).
6. Click **Apply**.

<figure><img src="/files/4HLCREVWlVptEqbcHI2n" alt="" width="563"><figcaption></figcaption></figure>

You can also use the date filter to view historic Exfiltration events. To learn more about how to use the historic time filter, [refer this section](https://help.nightfall.ai/dashboard/sdp_events#historic-data-filter).&#x20;

## Search Events

Nightfall provides a powerful search bar to search specific Exfiltration events. Nightfall provides you various search operators to perform your search. You must use the following syntax to search data.&#x20;

```
search operator name:"search term"
```

For example, to search events that are in active state, you must use the `State` search operator with the following syntax.

```
State:"Active"
```

The various Exfiltration search operators provided by Nightfall are as follows.&#x20;

### General Search Operators

<table><thead><tr><th width="211.12890625">Search Operator Name</th><th>Description</th></tr></thead><tbody><tr><td>actor_Email</td><td>Search using the Email ID of the actor whose action triggered the Event.</td></tr><tr><td>actor_Name</td><td>Search using the name of the actor (device name) from which the Event was triggered.</td></tr><tr><td>event_id</td><td>Search the unique Exfiltration event ID.</td></tr><tr><td>event_type</td><td>Search the Exfiltration event type.</td></tr><tr><td>integration_name</td><td>Search the integration name. </td></tr><tr><td>last_action</td><td>Search the last action implemented on an event. Example of action can be Acknowledge, Ignore, Resolve, and so on.</td></tr><tr><td>last_actioned_by</td><td>Search for the user who last took an action on the event.</td></tr><tr><td>notes</td><td>Search the notes entered in an Event.</td></tr><tr><td>policy_id</td><td>Search the unique policy ID.</td></tr><tr><td>policy_name</td><td>Search the policy name.</td></tr><tr><td>resource_content_type</td><td>Search the resource type of the file that was exfiltrated. Resource type refers to the file format and can be PDF, .doc, d.ocx, and so on.</td></tr><tr><td>resource_id</td><td>Search the resource ID. This unique identifier is assigned to resources by their integration (Google Drive, Salesforce)</td></tr><tr><td>resource_name</td><td>Search the resource name (file name) that was exfiltrated.</td></tr><tr><td>resource_owner_email</td><td>Search the email of the user who owns the exfiltrated file.</td></tr><tr><td>resource_owner_name</td><td>Search the name of the user who owns the exfiltrated file.</td></tr><tr><td>state</td><td>Search the current status of the Event. This could be Active, Acknowledge, and so on.</td></tr><tr><td>violation_id</td><td>Search the unique violation ID of the event.</td></tr><tr><td>violation_type</td><td>Search the violation type</td></tr></tbody></table>

### Integration Operators

<table><thead><tr><th>Integration </th><th width="270.78125">Operator Name</th><th>Description</th></tr></thead><tbody><tr><td>Endpoint (Browser upload)</td><td>endpoint.browser_upload.browser_name</td><td>Search the Web browser that was used to upload file.</td></tr><tr><td>Endpoint (Browser upload)</td><td>endpoint.browser_upload.domain</td><td>Search the domain name that was used to upload file.</td></tr><tr><td>Endpoint (Browser upload)</td><td>endpoint.browser_upload.file_name</td><td>Search the name of the file. </td></tr><tr><td>Endpoint (Browser upload)</td><td>endpoint.browser_upload.origin.browser_name</td><td>Search the browser from which the exfiltrated file emerged.</td></tr><tr><td>Endpoint (Browser upload)</td><td>endpoint.browser_upload.origin.domain</td><td>Search the domain from which the exfiltrated file emerged.</td></tr><tr><td>Endpoint (Browser upload)</td><td>endpoint.browser_upload.origin.url</td><td>Search the exact URL from which the exfiltrated file emerged.</td></tr><tr><td>Endpoint (Browser upload)</td><td>endpoint.browser_upload.url</td><td>Search the URL used to upload the exfiltrated file.</td></tr><tr><td>Endpoint (Clipboard Copy/Paste)</td><td>endpoint.clipboard_copy.destination.browser_name</td><td>Search the destination browser name to which  the copied data was pasted.</td></tr><tr><td>Endpoint (Clipboard Copy/Paste)</td><td>endpoint.clipboard_copy.destination.domain</td><td>Search the destination domain name to which  the copied data was pasted.</td></tr><tr><td>Endpoint (Clipboard Copy/Paste)</td><td>endpoint.clipboard_copy.origin.browser_name</td><td>Search the origin browser name from which  the data was copied.</td></tr><tr><td>Endpoint (Clipboard Copy/Paste)</td><td>endpoint.clipboard_copy.origin.domain</td><td>Search the origin domain name from which  the data was copied.</td></tr><tr><td>Endpoint (Clipboard Copy/Paste)</td><td>endpoint.clipboard_copy.origin.url</td><td>Search the origin URL from which  the data was copied.</td></tr><tr><td>Endpoint (Cloud Sync)</td><td>endpoint.cloud_sync.account_name</td><td>Search the name of the account to which the file was uploaded.</td></tr><tr><td>Endpoint (Cloud Sync)</td><td>endpoint.cloud_sync.account_type</td><td>Search the account type (personal/business) of the account to which the file was uploaded.</td></tr><tr><td>Endpoint (Cloud Sync)</td><td>endpoint.cloud_sync.app</td><td>Search the cloud storage app name (Google Drive, OneDrive) to which the file was uploaded.</td></tr><tr><td>Endpoint (Cloud Sync)</td><td>endpoint.cloud_sync.destination_file_path</td><td>Search the destination directory in the storage app to which the file was exfiltrated.</td></tr><tr><td>Endpoint (Cloud Sync)</td><td>endpoint.cloud_sync.email</td><td>Search the email ID of the account to which the file was uploaded.</td></tr><tr><td>Endpoint (Cloud Sync)</td><td>endpoint.cloud_sync.file_name</td><td>Search the name of the file which was uploaded to a cloud storage app.</td></tr><tr><td>Endpoint </td><td>endpoint.device_id</td><td>Search the endpoint device ID of the device from which the exfiltration was performed.</td></tr><tr><td>Endpoint </td><td>endpoint.machine_name</td><td>Search the endpoint device name from which the exfiltration was performed.</td></tr><tr><td>Google Drive</td><td>gdrive.drive</td><td>Search a drive within Google Drive. Returns all the events that were exfiltrated from the searched drive. </td></tr><tr><td>Google Drive</td><td>gdrive.file_owner</td><td>Search a Google Drive user. Returns all the events that were owned by the searched user and were exfiltrated.</td></tr><tr><td>Google Drive</td><td>gdrive.label_name</td><td>Search a Google Drive label. Returns all the events that contained the searched label and were exfiltrated.</td></tr><tr><td>Google Drive</td><td>gdrive.permission</td><td>Search a Google drive permission (restricted, pubic). Returns all the events that contain the searched permission and exfiltrated. </td></tr><tr><td>Google Drive</td><td>gdrive.shared_external_email</td><td>Search the shared Gmail external email ID. </td></tr><tr><td>Google Drive</td><td>gdrive.shared_internal_email</td><td>Search the shared Gmail internal email ID. </td></tr><tr><td>Salesforce</td><td>salesforce.file.session_level</td><td>Search for Salesforce session level file</td></tr><tr><td>Salesforce</td><td>salesforce.file.source_ip</td><td>Search the IP address of the source machine that initiated the exfiltration of the file. </td></tr><tr><td>Salesforce</td><td>salesforce.report.description</td><td>Search the description provided in Salesforce report. </td></tr><tr><td>Salesforce</td><td>salesforce.report.event_source</td><td>Search the Salesforce report event source.</td></tr><tr><td>Salesforce</td><td>salesforce.report.operation</td><td>Search the Salesforce report operation.</td></tr><tr><td>Salesforce</td><td>salesforce.report.scope</td><td>Search the Salesforce report scope.</td></tr><tr><td>Salesforce</td><td>salesforce.report.session_level</td><td>Search the Salesforce session level report.</td></tr><tr><td>Salesforce</td><td>salesforce.report.source_ip</td><td>Search the source IP address of the Salesforce report. </td></tr></tbody></table>

To learn more about how to search special characters, refer to [this section](https://help.nightfall.ai/dashboard/sdp_events#special-characters). Nightfall allows you to share and download the Event data. The **Share** button creates a link to the current view with all the filters applied. When you click this link, the Events page opens with all the filters applied.


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://help.nightfall.ai/data-exfiltration-prevention/dashboard-and-events/exfiltration-events.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.