Bluetooth

Bluetooth watches file transfers over Bluetooth on a managed endpoint. Nightfall records the transfer as a Bluetooth / Bluetooth Transfer event and can monitor or block it when the file matches the policy.

This is not all Bluetooth activity. Pairing, audio, keyboards, and mice are not this trigger. The wizard label is Bluetooth.

Domain collections are not used. Data Source and Data Destination are disabled placeholders: Not applicable for Bluetooth action. There is no device-type picker on the policy. The policy applies to Bluetooth file transfers on devices in the policy scope. Device type and name show up on the event, not as policy filters.

If you do not see Bluetooth in the For dropdown, ask your Nightfall account team to enable it.

What you configure

1. Set For to Bluetooth.

2. Leave Data Source and Data Destination as shown. Switching to Bluetooth clears any asset-origin filters that were set on another trigger.

3. Content scanning and detection rules apply.

4. You can Monitor or Block.

5. End-user notification, when enabled, uses the title Assets transferred via Bluetooth. Destination is the comma-separated device names from the transfer, when Nightfall has them.

What shows up on an event

• Event type: Bluetooth file transfer (list views may say Bluetooth File Transfer; Forensic Search shortens the action to Bluetooth).

• File name, file hash, file size, start time.

• Bluetooth Devices on the event (when the feature is on): device name, type, vendor, MAC address, product id and name.

Device types you may see: Phone, Computer, Audio, HID, Wearable, Other.

Common use cases

• Catch a file sent from a laptop to a personal phone over Bluetooth.

• Investigate which nearby device received a transfer (name, type, MAC).

• Cover the path that is not USB and not AirDrop.

Policy recommendations

• Pair with AirDrop on Mac fleets and To removable media for physical drives.

• Use the event device list for investigation. You cannot allowlist a MAC address in the trigger today.

• HID or Audio in the device list on an event does not mean the policy watches keyboards or headsets. It means a file transfer involved a device Nightfall classified that way.

How this differs from nearby triggers

Need	Use
AirDrop to an iPhone	AirDrop
USB stick	To removable media
scp to another host	CLI Transfer
All Bluetooth pairing	Not available as a trigger

FAQ

Does this monitor every Bluetooth connection?

No. Only file transfers. Pairing and audio are out of scope.

Can I allow corporate Bluetooth devices and block everything else?

Not in the policy wizard. There is no include/exclude list for Bluetooth devices. Removable Media has vendor and serial filters; Bluetooth does not.

Why are Data Source and Data Destination greyed out?

Bluetooth file transfer does not take those filters.

What device details will I see?

When present: name, type (Phone, Computer, Audio, HID, Wearable, Other), vendor, MAC, product id, product name. Search the devices list on the event.

Can I block the transfer?

Yes. Enable the block action. Monitor-only still writes an event.

Is this the same as AirDrop?

No. AirDrop is Apple's peer transfer. Bluetooth is Bluetooth file send, and the event can list the other device.