> For the complete documentation index, see [llms.txt](https://help.nightfall.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.nightfall.ai/data-exfiltration-prevention/exfiltration_endpoint/policies/trigger/airdrop.md).

# AirDrop

AirDrop watches files sent through Apple AirDrop on a managed Mac. Nightfall records the transfer as an **AirDrop** / **AirDrop Transfer** event and can monitor or block it when the file matches the policy.

This is a file-transfer trigger. It is not the same as Removable Media (USB) or Bluetooth. The wizard label is **AirDrop**.

Domain collections are not used. Data Source and Data Destination are shown as disabled placeholders: *Not applicable for AirDrop action.* There is no recipient or nearby-device picker. The policy applies to AirDrop file transfers on devices in the policy scope.

If you do not see **AirDrop** in the **For** dropdown, ask your Nightfall account team to enable it.

**What you configure**

1. Set **For** to **AirDrop**.
2. Leave Data Source and Data Destination as shown. They are not configurable for this trigger. Switching to AirDrop clears any asset-origin filters that were set on another trigger.
3. Content scanning and detection rules apply.
4. You can **Monitor** or **Block**.
5. End-user notification, when enabled, uses the title *Assets transferred via AirDrop*. Destination on that notice is empty because the product does not store an AirDrop recipient.

**Platform note**

AirDrop is a macOS capability. The policy wizard does not currently lock the OS checkboxes to Mac only. Put **macOS** in the policy scope. Windows devices will not produce AirDrop events.

**What shows up on an event**

* Event type: AirDrop file transfer (list views may say **Airdrop File Transfer**; Forensic Search shortens the action to **AirDrop**).
* File name, file hash, file size, start time.
* No recipient device list (unlike Bluetooth).

**Common use cases**

* Stop a laptop from AirDropping a payroll sheet to a personal phone in a cafe.
* Log AirDrop of design files from a studio Mac to an unmanaged iPad.
* Cover the wireless hop that Removable Media and Browser Upload miss.

**Policy recommendations**

* Pair with **To removable media** and **Bluetooth** if you care about every off-device copy that never hits a browser.
* Use content detection if you only want to fire on sensitive files. You can also run a lineage-only policy if your tenant supports that pattern on other file-transfer triggers.
* Do not expect to allowlist a specific friend's iPhone. That control is not in the wizard.

**How this differs from nearby triggers**

| Need                                   | Use                |
| -------------------------------------- | ------------------ |
| USB / external disk                    | To removable media |
| Bluetooth file send, with device names | Bluetooth          |
| `scp` / `curl`                         | CLI Transfer       |
| Browser attach                         | Browser uploads to |

## FAQ

**Can I limit AirDrop to certain people or devices?**

No. The AirDrop scope has no recipient filter. The policy applies to matching transfers on in-scope endpoints.

**Why are Data Source and Data Destination greyed out?**

AirDrop does not take those filters. The placeholders say they are not applicable.

**Does this cover AirPlay, Continuity, or iCloud?**

No. This trigger is AirDrop file transfer only.

**Will a Windows policy do anything?**

You will not get AirDrop events from Windows. Scope the policy to macOS.

**Can I block AirDrop?**

Yes. Enable the block action on the policy. Monitor-only still writes an event.

**Where do I see the file that was sent?**

On the event: file name, size, hash, and start time, plus the usual user and device context.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://help.nightfall.ai/data-exfiltration-prevention/exfiltration_endpoint/policies/trigger/airdrop.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.