CLI Transfer

CLI Transfer watches file movement started by selected command-line tools on a managed endpoint. The agent intercepts the process (for example scp or curl) when it uploads or downloads a file. You pick the tools on the policy. Nightfall does not treat every shell command as this trigger.

This is not Git Push. git push is a separate trigger (Git Push to). CLI Transfer is for the tools listed below.

Domain collections are not used as a destination list for this trigger. You do not pick domains or apps. You pick CLI tools. Data Source (asset origin) is still available, the same as on Browser Upload.

If you do not see CLI Transfer in the For dropdown, ask your Nightfall account team to enable it.

What you configure

1. In the policy wizard, set For to CLI Transfer.

2. Under CLI Tools, select at least one tool. Next stays disabled until you do.

3. Optional: set Data Source / asset origin if you only care about files that came from certain apps or domains.

4. Content scanning and detection rules apply. You can Monitor or Block. Block copy in the product: This will block file transfers that match this policy.

5. End-user notification and screen replay follow the same endpoint rules as other triggers, when those options are on for your tenant.

CLI tools you can select

Tool	Typical use
scp	Copy files over SSH
curl	HTTP(S) upload or download
wget	HTTP(S) download (macOS only; see Windows notes)
rsync	Sync files to a remote host (macOS only; see Windows notes)
aws s3	AWS CLI S3 copy / sync
npm	Package publish / fetch that moves files through npm

sftp and ssh are not available in the CLI Tools picker.

Windows notes for wget and rsync

These two cannot be enforced on Windows:

• rsync has no native Windows binary the agent can intercept.

• PowerShell wget is an alias for in-process Invoke-WebRequest, so the agent never sees a process-create event.

Behavior in the picker:

• Windows-only policy: wget and rsync are disabled. Tooltip: {tool} cannot be enforced on Windows endpoints, so it is unavailable for Windows-only policies. If an older policy still had them saved, Nightfall strips them on edit.

• macOS and Windows together: wget and rsync stay selectable, with an amber warning. Tooltip: {tool} applies to macOS endpoints only. It cannot be enforced on the Windows endpoints in this policy's scope.

• macOS only: all six tools are available.

scp, curl, aws s3, and npm have no Windows restriction in the wizard.

What shows up on an event

Events are labeled CLI Transfer. The agent records both file upload and file download through the selected tools.

Typical fields: tool, command, remote host, remote path, parent process, execution source, file name, local path, size, and hash when available.

Execution source values you may see:

• User Terminal

• AI Agent Subprocess

• Other

Common use cases

• Stop engineers from scp or rsync of customer exports to a home machine.

• Catch curl or aws s3 of a secrets file to an unmanaged bucket.

• Watch npm publish from a laptop that is not supposed to ship internal packages.

• Pair with Git Push if you care about both git push and raw file copy over SSH.

Policy recommendations

• Start with scp, curl, and aws s3. Add wget/rsync only if you have macOS in scope.

• Do not rely on CLI Transfer for git push. Use Git Push to.

• If you also run AI agents that shell out to curl, look at Execution Source AI Agent Subprocess on the event.

How this differs from nearby triggers

Need	Use
git push to a personal remote	Git Push to
File copied to a USB stick	To removable media
File attached in Chrome	Browser uploads to
File sent with AirDrop	AirDrop
File sent over Bluetooth	Bluetooth

FAQ

Which tools does CLI Transfer cover?

Only the tools you check: scp, curl, wget, rsync, aws s3, npm. Other binaries are out of scope, even if they move files.

Why are wget and rsync greyed out?

The policy is Windows-only. Those tools cannot be enforced on Windows. Use a macOS (or mixed) OS scope, or drop those two tools.

Why is there an amber warning on wget or rsync?

The policy includes Windows and macOS. Those tools still apply on Mac. They will not apply on the Windows devices in the same policy.

Why can't I click Next?

You have not selected a CLI tool. Select at least one.

Does this monitor every command in Terminal?

No. Only the selected tools, when they transfer a file.

Is this the same as Git Push?

No. Git Push evaluates git remotes and is monitor-only. CLI Transfer evaluates scp/curl/and the rest, and can block.

Can I limit destinations (only certain hosts)?

Not in this trigger. There is no domain or host allowlist on CLI Transfer. Scope by OS, users, devices, optional asset origin, and tool list.

Does Block actually stop the transfer?

Yes, when you enable the block action on this trigger. The confirm text is about blocking file transfers that match the policy.

Do I need a browser extension?

No. This is endpoint-agent interception of the CLI process.