> For the complete documentation index, see [llms.txt](https://help.nightfall.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.nightfall.ai/data-exfiltration-prevention/exfiltration_endpoint/policies/trigger/cli-transfer.md).

# CLI Transfer

CLI Transfer watches file movement started by selected command-line tools on a managed endpoint. The agent intercepts the process (for example `scp` or `curl`) when it uploads or downloads a file. You pick the tools on the policy. Nightfall does not treat every shell command as this trigger.

This is not Git Push. `git push` is a separate trigger (**Git Push to**). CLI Transfer is for the tools listed below.

Domain collections are not used as a destination list for this trigger. You do not pick domains or apps. You pick CLI tools. Data Source (asset origin) is still available, the same as on Browser Upload.

If you do not see **CLI Transfer** in the **For** dropdown, ask your Nightfall account team to enable it.

**What you configure**

1. In the policy wizard, set **For** to **CLI Transfer**.
2. Under **CLI Tools**, select at least one tool. Next stays disabled until you do.
3. Optional: set Data Source / asset origin if you only care about files that came from certain apps or domains.
4. Content scanning and detection rules apply. You can **Monitor** or **Block**. Block copy in the product: *This will block file transfers that match this policy.*
5. End-user notification and screen replay follow the same endpoint rules as other triggers, when those options are on for your tenant.

**CLI tools you can select**

| Tool   | Typical use                                                 |
| ------ | ----------------------------------------------------------- |
| scp    | Copy files over SSH                                         |
| curl   | HTTP(S) upload or download                                  |
| wget   | HTTP(S) download (macOS only; see Windows notes)            |
| rsync  | Sync files to a remote host (macOS only; see Windows notes) |
| aws s3 | AWS CLI S3 copy / sync                                      |
| npm    | Package publish / fetch that moves files through npm        |

`sftp` and `ssh` are not available in the CLI Tools picker.

**Windows notes for wget and rsync**

These two cannot be enforced on Windows:

* rsync has no native Windows binary the agent can intercept.
* PowerShell `wget` is an alias for in-process `Invoke-WebRequest`, so the agent never sees a process-create event.

Behavior in the picker:

* **Windows-only** policy: wget and rsync are disabled. Tooltip: *{tool} cannot be enforced on Windows endpoints, so it is unavailable for Windows-only policies.* If an older policy still had them saved, Nightfall strips them on edit.
* **macOS and Windows** together: wget and rsync stay selectable, with an amber warning. Tooltip: *{tool} applies to macOS endpoints only. It cannot be enforced on the Windows endpoints in this policy's scope.*
* **macOS only**: all six tools are available.

scp, curl, aws s3, and npm have no Windows restriction in the wizard.

**What shows up on an event**

Events are labeled **CLI Transfer**. The agent records both file upload and file download through the selected tools.

Typical fields: tool, command, remote host, remote path, parent process, execution source, file name, local path, size, and hash when available.

Execution source values you may see:

* User Terminal
* AI Agent Subprocess
* Other

**Common use cases**

* Stop engineers from `scp` or `rsync` of customer exports to a home machine.
* Catch `curl` or `aws s3` of a secrets file to an unmanaged bucket.
* Watch `npm` publish from a laptop that is not supposed to ship internal packages.
* Pair with Git Push if you care about both `git push` and raw file copy over SSH.

**Policy recommendations**

* Start with scp, curl, and aws s3. Add wget/rsync only if you have macOS in scope.
* Do not rely on CLI Transfer for `git push`. Use **Git Push to**.
* If you also run AI agents that shell out to curl, look at Execution Source **AI Agent Subprocess** on the event.

**How this differs from nearby triggers**

| Need                            | Use                |
| ------------------------------- | ------------------ |
| `git push` to a personal remote | Git Push to        |
| File copied to a USB stick      | To removable media |
| File attached in Chrome         | Browser uploads to |
| File sent with AirDrop          | AirDrop            |
| File sent over Bluetooth        | Bluetooth          |

## FAQ

**Which tools does CLI Transfer cover?**

Only the tools you check: scp, curl, wget, rsync, aws s3, npm. Other binaries are out of scope, even if they move files.

**Why are wget and rsync greyed out?**

The policy is Windows-only. Those tools cannot be enforced on Windows. Use a macOS (or mixed) OS scope, or drop those two tools.

**Why is there an amber warning on wget or rsync?**

The policy includes Windows and macOS. Those tools still apply on Mac. They will not apply on the Windows devices in the same policy.

**Why can't I click Next?**

You have not selected a CLI tool. Select at least one.

**Does this monitor every command in Terminal?**

No. Only the selected tools, when they transfer a file.

**Is this the same as Git Push?**

No. Git Push evaluates git remotes and is monitor-only. CLI Transfer evaluates scp/curl/and the rest, and can block.

**Can I limit destinations (only certain hosts)?**

Not in this trigger. There is no domain or host allowlist on CLI Transfer. Scope by OS, users, devices, optional asset origin, and tool list.

**Does Block actually stop the transfer?**

Yes, when you enable the block action on this trigger. The confirm text is about blocking file transfers that match the policy.

**Do I need a browser extension?**

No. This is endpoint-agent interception of the CLI process.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://help.nightfall.ai/data-exfiltration-prevention/exfiltration_endpoint/policies/trigger/cli-transfer.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.