Unknown Session Behavior in Endpoint Exfiltration Policies

Overview

When Personal accounts only or Corporate accounts only is enabled, Nightfall uses the browser session to decide whether an event is in-scope. On supported domains, that usually means: the Nightfall browser extension reads the signed-in email, and Nightfall compares the email domain against your Corporate Domains collection.

Sometimes the session cannot be determined. Common causes:

• The user is not signed in

• The browser is in incognito / private mode

• The Nightfall browser extension is missing, disabled, or disconnected

• The site is loading and no logged-in identity is available yet

Unknown session behavior controls what the policy does in that case. It only applies to supported domains (hover the violet Supported domains pill to see the list). Domains that do not support session detection continue to be monitored for all account types, regardless of this setting.

When session cannot be determined

This control appears under the session-check toggle on the policy Trigger step.

Personal accounts only (destination)

Use this when the policy should fire only on uploads, pastes, or git pushes into a personal account.

Option	What Nightfall does	When to use it
Treat as corporate - skip incident (recommended default)	Treats the unknown session as corporate. A personal-account-only policy does not create an incident.	Production policies where you want to avoid false positives from extension gaps, incognito, or unsigned-in tabs
Treat as personal - create incident	Treats the unknown session as personal and creates an incident	High-risk or departing-user policies where missing a personal-account transfer is worse than extra noise
Create incident - mark account as unknown	Creates an incident and tags the account type as Unknown	Visibility into session-detection failures without asserting personal vs. corporate

Corporate accounts only (source)

Use this when the policy should fire only on data that originated in a corporate account. The default is inverted: skipping unknown sessions means treating them as not corporate.

Option	What Nightfall does	When to use it
Treat as personal - skip incident (recommended default)	Treats the unknown session as personal. A corporate-account-only policy does not create an incident.	Production source-scoped policies where you want to avoid false positives
Treat as corporate - create incident	Treats the unknown session as corporate and creates an incident	Fail-closed source policies (for example, departing-user watchlists)
Create incident - mark account as unknown	Creates an incident and tags the account type as Unknown	Visibility into session-detection failures on the source side

Recommended default: skip the incident when the session cannot be determined. This is the setting shown as Treat as corporate - skip incident on personal-account destination policies. It reduces false positives when Nightfall cannot read the signed-in user, while still enforcing the policy whenever the session is known to be personal.

How it works with supported vs. remaining domains

The toggle copy in the console is:

Only tracks data sent to personal account sessions for Supported domains. Remaining domains monitored for all account types.

That means:

1. Supported domain + known personal session → personal-account policy can create an incident

2. Supported domain + known corporate session → personal-account policy skips

3. Supported domain + unknown session → follows the radio option above

4. Unsupported domain → session check is not applied; the event is evaluated like any other destination/source match

Unsupported domains are not skipped just because unknown-session behavior is set to skip. They are monitored for all account types.

Prerequisites

• An Endpoint Exfiltration policy with Browser uploads to, Paste to (browser), or Git Push to

• At least one selected collection that includes session-detection-supported domains

• Nightfall browser extension installed, enabled, and connected on the device

• Nightfall Agent macOS v1.2.13+ or Windows v1.4.35+

Recommended configurations

Policy goal	Session toggle	Unknown-session setting
Block uploads to personal Drive / Gmail / ChatGPT with low noise	Personal accounts only	Treat as corporate - skip incident
Departing-user or watchlist: do not miss personal-account egress	Personal accounts only	Treat as personal - create incident, or mark as unknown
Audit trail of session-detection gaps (extension down, incognito)	Personal or Corporate accounts only	Create incident - mark account as unknown
Track data that left a corporate session, any destination	Corporate accounts only	Treat as personal - skip incident (default)

Validation checklist

After saving the policy:

1. Confirm the session toggle is On and the expected radio option is selected

2. Hover Supported domains and confirm the destinations you care about are listed

3. On a test device, sign into a personal account on a supported domain and confirm an incident is created

4. Sign into a corporate account on the same domain and confirm the personal-account policy does not fire

5. Repeat in incognito (or with the extension disabled) and confirm the unknown-session option behaves as configured

6. On an unsupported domain in the same collection, confirm the event is still monitored (all account types)

Frequently Asked Questions (FAQ)

Why did a personal-account policy not fire?

If the destination is a supported domain and the session could not be determined, the default (Treat as corporate - skip incident) intentionally does not create an incident. Check whether the user was signed in, whether the extension was connected, and whether the browser was in incognito.

Why am I still seeing incidents on domains that do not support session detection?

That is expected. Unknown-session behavior only applies to supported domains. Remaining domains in the collection are monitored for all account types.

Does skipping unknown sessions mean corporate uploads are allowed?

On a Personal accounts only policy, yes for supported domains: unknown and corporate sessions are out of scope. The file may still match a different policy that does not use session detection.

What does Account Type = Unknown mean on an incident?

The policy is configured to Create incident - mark account as unknown. Nightfall created the incident because the session could not be resolved, not because it confirmed a personal or corporate account.

Does this work in incognito?

The extension typically cannot read the signed-in user in private windows. Those events are unknown-session events and follow this setting.