Trigger

The Trigger section in Salesforce policies allows you to define the frequency of action that must be considered as an exfiltration event. In case of Salesforce policies, the download frequency is the trigger.

The download frequency can be defined as the number of downloads over a period to time. This allows you to set custom thresholds in terms of number of downloads over a specific period of time and can be useful to identify anomalous download patterns for specific locations, users or content type. This can be set in combination to other scoping capabilities.

Configuring Triggers

In the Actions section, you can define the download action that must be considered as a potential exfiltration attempt by Nightfall. Nightfall allows you to set the frequency of downloads as the action.

To configure Actions:

  1. Click the minimum number of files that must be the download threshold.

  1. Set the time period within which the minimum no. of downloads must be considered as exfiltration event.

In the following case, an exfiltration event is created if, there are 2 or more downloads within a minute.

Last updated

Was this helpful?