Session Detection: Corporate and Personal Account Filtering

Overview

User session detection allows Nightfall to distinguish between corporate and personal account activity on supported web domains. When enabled in an Endpoint Exfiltration policy, Nightfall uses browser session context to determine whether data is being uploaded from (or pasted to) a corporate account or a personal account. This lets you create policies that, for example, only trigger on uploads from corporate Google Drive or only flag paste actions to personal ChatGPT.

Session detection requires the Nightfall browser extension to be installed and connected. It works by inspecting the active browser session on supported domains to determine account ownership.

Supported Domains

Session detection is available on the following 32 domains, organized by category:

Configuring User Session Check in a Policy

When creating or editing an Endpoint Exfiltration policy, the Trigger step is where you configure session detection. The Trigger step contains two main sections: Asset Origin and Action.

The Action dropdown selects the type of endpoint activity to monitor. Available actions:

AI Agent Security - Monitors AI agent activity (Claude Code, Cursor, VS Code, Claude Cowork)
Browser uploads to - File uploads through the browser
Cloud syncing to - Cloud sync applications (Google Drive, Dropbox, OneDrive, Box, iCloud)
Git Push to - Git push operations to remote repositories
Paste to - Clipboard paste actions (browser or desktop apps)
Print - Print operations
To removable media - File transfers to USB/external drives
Uploads to desktop app - File uploads through thick/desktop applications

Data Source (From) - Asset Origin

The Asset Origin section lets you scope monitoring to assets originating from specific sources:

Select Source (Domain / URL-Based) from the scope dropdown
Choose Source in or Source not in to include or exclude specific domain collections
Select a domain collection from the collection picker

When you select collections, each collection pill displays with color coding:

Violet: The collection contains domains that support session detection and session check is enabled
Default: Standard collection display

Corporate Accounts Only Toggle

When the selected source collections include domains that support session detection, the Corporate accounts only toggle appears. Enabling this toggle restricts the policy to only trigger on data originating from corporate account sessions on supported domains.

The toggle only appears when:

The action is Browser uploads to, Paste to, or Git Push to
The scope is set to Source in (not "Source not in" or "Any source")
At least one selected collection contains session-detection-supported domains

Data Destination (To) - Action Section

For actions like Browser uploads to, Paste to, and Git Push to, you can also scope the destination:

Select the action type from the dropdown
Choose destination scope (Any, specific collections included, or specific collections excluded)
Select domain collections for the destination

Personal Accounts Only Toggle

When the selected destination collections include domains that support session detection, the Personal accounts only toggle appears. Enabling this toggle restricts the policy to only trigger on data sent to personal account sessions on supported domains.

The toggle only appears under the same conditions as the Corporate toggle (appropriate action type, "Source in" scope, and session-detection-supported domains in the selected collections).

Session Detection Support Indicator

When you select a domain collection, the UI shows an "X of Y domains supports session detection" indicator. This tells you how many of the domains in your selected collection are in the supported domains list. For example, if your collection has 10 domains and 6 are in the supported list, it shows "6 of 10 domains supports session detection."

Content Scanning

Content Scanning configuration has been moved from the Scope step to the Trigger step, keeping all trigger-related settings in one place.

Session Detection Support Matrix

Action Type

Session Detection Available

Notes

Browser uploads to

Yes

Requires browser extension

Paste to (Browser)

Yes

Requires browser extension

Git Push to

Yes

Not applicable

Cloud syncing to

Personal Google Drive, OneDrive, Dropbox are supported with session differentiation; Does not rely on browser extension

No browser context available

To removable media

No browser context available

Uploads to desktop app

Desktop apps lack browser session info

AI Agent Security

Hooks-based monitoring, no browser context

How it works

By default, with no session detection enabled, Nightfall monitors all uploads and paste events across all account types on all configured domains - it does not distinguish whether a user is in a personal Google account or a corporate Workspace account.

Session detection lets you scope monitoring to an account context. There are two independent toggles, each controlling a different axis:

Toggle

What it does

When to use it

Corporate accounts only (source)

Only tracks events where the file or content originated from a corporate account session

You care about where data came from

Personal accounts only (destination)

Only tracks events where the upload destination is a personal account session

You care about where data is going

These toggles are independent - enabling one does not affect the other.

Behavior by state

Source toggle

Destination toggle

What is monitored

Off

All events on all domains, no account-type distinction

Off

Only uploads/pastes into personal account sessions

Off

Only uploads/pastes from corporate account sessions, regardless of destination

Both constraints apply independently

Session detection coverage is domain-dependent. Not all domains in a collection support session detection. The UI shows how many domains in your selected collection are covered (e.g., "3 of 12 domains across 2 collections support session detection"). Domains outside coverage are always monitored for all account types, regardless of toggle state. If none of the selected domains support session detection, the toggle has no effect and all domains are monitored for all account types.

Destination toggle - personal account monitoring

The most common pattern. Enable this when your primary concern is data ending up in a personal account on a domain your organization also uses corporately.

Common policies seen in practice:

"Block Uploads to Personal Storage Accounts"
"PII to Personal Accounts"
"ChatGPT/Claude/Dropbox - Uploads to Personal Accounts"
"PHI Upload to Personal Account"

Why this matters: On domains like drive.google.com, dropbox.com, or chatgpt.com, the same domain hosts both corporate and personal accounts. Without session detection, a policy scoped to these domains fires on all uploads - including uploads from an employee using their company-issued Google Workspace account, which is typically approved. Enabling the destination toggle narrows the policy to only fire when the upload goes into a personal session, eliminating noise from legitimate corporate activity.

Recommended use:

Cloud storage: Separate a policy for drive.google.com personal from corporate Workspace. Enable destination toggle; scope collection to personal Google accounts.
AI tools: Most AI tools (ChatGPT, Claude) don't have a corporate/personal domain split - chatgpt.com is used by both. If your organization has a corporate ChatGPT Enterprise deployment on a subdomain, use the destination toggle on the public domain to filter for personal sessions only.
Sanctioned vs. unsanctioned: Some organizations run two policies on the same domain - one with session detection (alert-only for personal account use) and one without (broader coverage for truly unsanctioned destinations).

Source toggle - corporate account monitoring

Enable this when you want to track data that originated from a corporate account, regardless of where it ends up - including destinations that don't support session detection.

Common policies seen in practice:

"Personal Account Upload From Corporate Account"
"Block Uploads of Corporate Docs to Unsanctioned Apps"
"Monitor Uploads of Customer Lists to Unsanctioned Cloud Storage"
"Departing Users - Block Google Workspace"

Why this matters: The destination toggle only catches events where the destination domain supports session detection. If an employee copies a file from their corporate Google Drive and uploads it to a small SaaS tool or a domain that Nightfall can't distinguish account types on, the destination toggle misses it. The source toggle catches it because it evaluates account context at the point of copy, not the point of upload.

This is also the appropriate pattern for departing user policies, where the goal is to track all outbound movement from corporate accounts during an offboarding window - regardless of destination.

Recommended use:

Departing users: Enable source toggle scoped to all corporate domain collections. Apply to a user group or device scope targeting the departing user.
Broad corporate data egress: When you want to monitor "anything that left a corporate account session today" as an audit trail, source-only gives you the widest coverage without depending on destination session support.

Important: Source-only policies deliberately monitor destinations outside Nightfall's session detection coverage. This is by design, not a misconfiguration. Do not add a destination toggle to these policies expecting it to refine them - it will instead restrict coverage and may miss the exfiltration paths the policy was built to catch.

Applies to: Browser Uploads, Clipboard Paste, Git Push Monitoring

Session detection works identically for these three triggers. For clipboard paste, the source toggle checks which account session the copied content came from; the destination toggle checks where the paste event lands. Given that clipboard events often land on domains with limited session detection support (note-taking apps, internal tools, miscellaneous SaaS), source-only session detection is generally more effective for clipboard monitoring than destination-only. For git push monitoring, content scanning is not supported - Nightfall monitors the source code originating from a corporate organization and subsequently getting transferred to a non-corporate organization or repository.

Frequently Asked Questions (FAQ)

Why is the Corporate/Personal toggle grayed out or not visible?

The toggle only appears when all three conditions are met:

The action type supports session detection (Browser uploads, Paste to browser)
The collection scope is set to Source in (specific included collections)
At least one domain in the selected collections supports session detection

If your selected collections don't include any of the 32 supported domains, the toggle will not appear.

What does "X of Y domains supports session detection" mean?

This indicator shows how many domains in your selected collection are in Nightfall's supported domains list. Only those domains will have session-level account detection. Other domains in the collection will still be monitored but without corporate/personal distinction.

I enabled Corporate accounts only but uploads aren't being blocked

Check the following:

Supported domains: Verify the source domains are in the supported list above
Browser extension: Ensure the Nightfall browser extension is installed, enabled, and connected on the user's device
Correct browser: Session detection requires a supported browser with the extension (Chrome, Edge, Firefox). Safari require the extension to be installed separately
Not incognito: Session detection does not work in incognito/private browsing mode

Does session detection work with Git Push / Print / Removable media?

Git Push to: Yes, session detection is available
Print: No. Print operations don't have browser context
To removable media: No. File transfers to external drives don't involve browser sessions

Which domains support session detection?

See the Supported Domains section above for the full list of 32 supported domains organized by category.

What happens if I select a collection with no session-detection domains?

The Corporate/Personal accounts only toggle will not appear. The policy will still work for monitoring the selected domains, but without the ability to distinguish between corporate and personal accounts.

Unsupported Scenarios

Session detection is not available in the following scenarios:

Actions without browser context: Cloud syncing, Print, To removable media, and Uploads to desktop app operate outside the browser and cannot access session information
AI Agent Security: This action type uses hooks and OpenTelemetry for monitoring, not browser context
Domains not in the supported list: Even with the browser extension installed, session detection only works on the 32 listed domains
Browser extension not installed or disconnected: The extension must be installed, enabled, and actively connected
Incognito/private browsing: Browser extensions are typically disabled in private windows by default
Firefox/Safari without extension: These browsers require separate extension installation;
Domain collections with "Source not in" scope: Session check toggles only appear when using "Source in" (include) scope, not "Source not in" (exclude) scope

PreviousUploads, Paste to Desktop Apps NextCloud Sync App Uploads

Last updated 2 months ago

Was this helpful?