> For the complete documentation index, see [llms.txt](https://help.nightfall.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.nightfall.ai/data-exfiltration-prevention/exfiltration_endpoint/policies/trigger/git-push-monitoring.md).

# Git Push Monitoring

{% hint style="info" %}
**What to expect:** Git push monitoring alerts only. The push always completes. It runs on the macOS and Windows agents and detects pushes over HTTPS and SSH. It records metadata only. Content scanning and detection rules are not available for this trigger, and there is no end-user notification. For a full source code policy set, see [Recommendation 2](/data-exfiltration-prevention/exfiltration_endpoint/policies/recommended-policy-configurations.md).
{% endhint %}

Nightfall monitors the following signals during a Git push operation:

* The endpoint where the push originates
* The user performing the push
* The Git protocol (HTTPS / SSH)
* The remote destination URL
* The repository name and configured remotes

```
Managed Endpoint with Nightfall agent
   └── git push
        ├── Action: Git Push
        ├── Source: Managed device
        └── Destination:
             ├── Approved domain → Allowed
             └── Non‑approved domain → Exfiltration Event generated
```

A Git Push Monitoring policy evaluates where code is being pushed, not what is being pushed. If the destination does not match your approved Git domains, Nightfall generates an exfiltration event.

**Supported Git Destinations**

Git Push Monitoring supports:

* GitHub Cloud
* GitLab Cloud
* Bitbucket
* Any Git server accessible via HTTPS or SSH

**Policy Configuration**

1. **Step 1: Define Approved Git Destinations**

Customers define approved Git hosting locations using Domain Collections.

Examples:

* github.com/my‑company‑org/\*
* gitlab.company.com/\*
* bitbucket.org/company/\*

These domains represent where source code is allowed to be pushed.

2. **Step 2: Configure Git Push Monitoring Policy**

Policy Type: Endpoint Exfiltration\
Action: Git Push

Destination Condition Options:

* Any domain
* Domain in approved list
* Domain not in approved list (recommended)

Recommended Configuration:

```
Action: Git Push
For: Domain not in <Approved Git Domains>
```

This configuration alerts when developers push code outside approved repositories.

**Example Use Cases**

1. **Detect Personal GitHub Usage**
   1. Approved: github.com/company‑org/\*
   2. Detected: github.com/john‑doe/test‑repo
2. **Monitor Scratch or Temporary Repositories**
   1. Even if the repository is newly created or unnamed, Nightfall detects the push if the destination domain is not approved.
3. **Monitor Corporate GitHub & GitLab Usage**
   1. Confirm that production code stays within:
      1. Corporate GitHub organizations
      2. Internal GitLab instances

**Event Details**

When a Git push violates policy, Nightfall generates an event with metadata‑only context.

**Event Summary Fields**

| Field           | Description                 |
| --------------- | --------------------------- |
| Event Type      | Git Push                    |
| Repository      | Repository name             |
| Actor           | User performing the push    |
| Device          | Endpoint hostname           |
| Destination URL | Git remote URL              |
| Git Remotes     | origin, personal, etc.      |
| Risk            | Critical, High, Medium, Low |

**Example Scenarios**

The following scenarios illustrate the support matrix for this capability.

1. **Push to Approved Repository**
   1. Git operation succeeds
   2. No alert generated
2. **Push to Non‑Approved Repository**
   1. Git operation succeeds (no blocking)
   2. Exfiltration event generated
3. **HTTPS and SSH Both Supported**
   1. Detection works for both authentication methods
4. **Multiple Remotes Supported**
   1. Events reflect the actual remote used for the push
5. **Unmanaged Devices**
   1. No detection occurs without an endpoint agent

Git Push Monitoring provides organizations with a simple and effective control to:

* Detect source code exfiltration
* Monitor approved Git destinations
* Gain visibility into developer Git activity


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://help.nightfall.ai/data-exfiltration-prevention/exfiltration_endpoint/policies/trigger/git-push-monitoring.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.