AirDrop

AirDrop watches files sent through Apple AirDrop on a managed Mac. Nightfall records the transfer as an AirDrop / AirDrop Transfer event and can monitor or block it when the file matches the policy.

This is a file-transfer trigger. It is not the same as Removable Media (USB) or Bluetooth. The wizard label is AirDrop.

Domain collections are not used. Data Source and Data Destination are shown as disabled placeholders: Not applicable for AirDrop action. There is no recipient or nearby-device picker. The policy applies to AirDrop file transfers on devices in the policy scope.

If you do not see AirDrop in the For dropdown, ask your Nightfall account team to enable it.

What you configure

1. Set For to AirDrop.

2. Leave Data Source and Data Destination as shown. They are not configurable for this trigger. Switching to AirDrop clears any asset-origin filters that were set on another trigger.

3. Content scanning and detection rules apply.

4. You can Monitor or Block.

5. End-user notification, when enabled, uses the title Assets transferred via AirDrop. Destination on that notice is empty because the product does not store an AirDrop recipient.

Platform note

AirDrop is a macOS capability. The policy wizard does not currently lock the OS checkboxes to Mac only. Put macOS in the policy scope. Windows devices will not produce AirDrop events.

What shows up on an event

• Event type: AirDrop file transfer (list views may say Airdrop File Transfer; Forensic Search shortens the action to AirDrop).

• File name, file hash, file size, start time.

• No recipient device list (unlike Bluetooth).

Common use cases

• Stop a laptop from AirDropping a payroll sheet to a personal phone in a cafe.

• Log AirDrop of design files from a studio Mac to an unmanaged iPad.

• Cover the wireless hop that Removable Media and Browser Upload miss.

Policy recommendations

• Pair with To removable media and Bluetooth if you care about every off-device copy that never hits a browser.

• Use content detection if you only want to fire on sensitive files. You can also run a lineage-only policy if your tenant supports that pattern on other file-transfer triggers.

• Do not expect to allowlist a specific friend's iPhone. That control is not in the wizard.

How this differs from nearby triggers

Need	Use
USB / external disk	To removable media
Bluetooth file send, with device names	Bluetooth
scp / curl	CLI Transfer
Browser attach	Browser uploads to

FAQ

Can I limit AirDrop to certain people or devices?

No. The AirDrop scope has no recipient filter. The policy applies to matching transfers on in-scope endpoints.

Why are Data Source and Data Destination greyed out?

AirDrop does not take those filters. The placeholders say they are not applicable.

Does this cover AirPlay, Continuity, or iCloud?

No. This trigger is AirDrop file transfer only.

Will a Windows policy do anything?

You will not get AirDrop events from Windows. Scope the policy to macOS.

Can I block AirDrop?

Yes. Enable the block action on the policy. Monitor-only still writes an event.

Where do I see the file that was sent?

On the event: file name, size, hash, and start time, plus the usual user and device context.