> For the complete documentation index, see [llms.txt](https://help.nightfall.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.nightfall.ai/data-exfiltration-prevention/exfiltration_endpoint/policies/trigger/bluetooth.md).

# Bluetooth

Bluetooth watches **file transfers** over Bluetooth on a managed endpoint. Nightfall records the transfer as a **Bluetooth** / **Bluetooth Transfer** event and can monitor or block it when the file matches the policy.

This is not all Bluetooth activity. Pairing, audio, keyboards, and mice are not this trigger. The wizard label is **Bluetooth**.

Domain collections are not used. Data Source and Data Destination are disabled placeholders: *Not applicable for Bluetooth action.* There is no device-type picker on the policy. The policy applies to Bluetooth file transfers on devices in the policy scope. Device type and name show up on the **event**, not as policy filters.

If you do not see **Bluetooth** in the **For** dropdown, ask your Nightfall account team to enable it.

**What you configure**

1. Set **For** to **Bluetooth**.
2. Leave Data Source and Data Destination as shown. Switching to Bluetooth clears any asset-origin filters that were set on another trigger.
3. Content scanning and detection rules apply.
4. You can **Monitor** or **Block**.
5. End-user notification, when enabled, uses the title *Assets transferred via Bluetooth*. Destination is the comma-separated device names from the transfer, when Nightfall has them.

**What shows up on an event**

* Event type: Bluetooth file transfer (list views may say **Bluetooth File Transfer**; Forensic Search shortens the action to **Bluetooth**).
* File name, file hash, file size, start time.
* **Bluetooth Devices** on the event (when the feature is on): device name, type, vendor, MAC address, product id and name.

Device types you may see: Phone, Computer, Audio, HID, Wearable, Other.

**Common use cases**

* Catch a file sent from a laptop to a personal phone over Bluetooth.
* Investigate which nearby device received a transfer (name, type, MAC).
* Cover the path that is not USB and not AirDrop.

**Policy recommendations**

* Pair with **AirDrop** on Mac fleets and **To removable media** for physical drives.
* Use the event device list for investigation. You cannot allowlist a MAC address in the trigger today.
* HID or Audio in the device list on an event does not mean the policy watches keyboards or headsets. It means a file transfer involved a device Nightfall classified that way.

**How this differs from nearby triggers**

| Need                  | Use                        |
| --------------------- | -------------------------- |
| AirDrop to an iPhone  | AirDrop                    |
| USB stick             | To removable media         |
| `scp` to another host | CLI Transfer               |
| All Bluetooth pairing | Not available as a trigger |

## FAQ

**Does this monitor every Bluetooth connection?**

No. Only file transfers. Pairing and audio are out of scope.

**Can I allow corporate Bluetooth devices and block everything else?**

Not in the policy wizard. There is no include/exclude list for Bluetooth devices. Removable Media has vendor and serial filters; Bluetooth does not.

**Why are Data Source and Data Destination greyed out?**

Bluetooth file transfer does not take those filters.

**What device details will I see?**

When present: name, type (Phone, Computer, Audio, HID, Wearable, Other), vendor, MAC, product id, product name. Search the devices list on the event.

**Can I block the transfer?**

Yes. Enable the block action. Monitor-only still writes an event.

**Is this the same as AirDrop?**

No. AirDrop is Apple's peer transfer. Bluetooth is Bluetooth file send, and the event can list the other device.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://help.nightfall.ai/data-exfiltration-prevention/exfiltration_endpoint/policies/trigger/bluetooth.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.