Frequently Asked Questions for Nightfall DLP for Salesforce
Nightfall DLP for Salesforce depends on the Platform Events messaging platform of a Salesforce org that Salesforce promotes as best practise to receive notifications for Salesforce events. Further, Platform Events limits are shared across all workflows that leverage Platform Events and, per Salesforce, are replinished on a 24 hour rolling basis.
Every time an update happens on one of the objects monitoried by Nightfall DLP for Salesfoce, Nightfall's Salesforce package triggers an event that is queued in the Salesforce orgs Platform Events messaging queue. Subsequently Nightfall DLP Platform retrieves the event and the payload from the Platform Events queue and processes the update.
Nightfall understands the criticality of Platform Events for Salesforce workflows and has defined a High Threshold and a Low Threshold for Platform Events usage on the customer's Salesforce org. If the Platform Events usage on the customer's Salesforce org breaches the High Threshold then Nightfall DLP for Salesforce will pause scan. Nightfall DLP for Salesforce will resume scan only when the Platform Events usage on the customer's Salesforce org goes below the Low Threshold. This way Nightfall DLP for Salesforce behaves as a model enterprise application and ensures that critical Salesforce workflows (like order processing) are prioritised over sensitive data scan.
Please reach out to your customer success manager for further details.
If you opted for both Redact and Delete actions in a policy for a set of objects and fields, Delete takes precedence over redact.
All potential sensitive tokens are automatically deleted from the configured objects and fields.
You can create two policies on the object;
one policy with a detection rule for the SSN detector, with redaction as the automated action.
Another policy with a detection rule for credit card detector with delete as the automation action.
Salesforce may save emails in draft stage multiple times either because of the user action or automatically. Every save triggers a Salesforce event which causes Nightfall to scane the contents of the email draft if there is a policy to scan emails objects. This can lead to a situation where multiple violations are reported for the same sensitive data if the email is saved multiple times in the draft stage.
So, Nightfall has disabled scanning of emails as long as they are in draft stage. However, emails will continue to be be scanned when other operations happen, for examples emails are sent, replied and forwarded. The user can reach out to Nightfall if they wish Nightfall to scan the drafts too, but it should be noted that as described above, this can lead to the same findings getting flagged across violations whenever the draft is saved.
Email message is an immutable object in Salesforce. Therefore, Nightfall cannot modify the object record. You can delete the email from within Salesforce, once you receive a notification.
I received a violation notification. However, the information was removed by the user in Salesforce. How will auto remediation respond?
If the object does not contain sensitive information at the time of remediation, Nightfall will not remediate any data. Nightfall will re-scan the violated object and fields before performing any remediation.
Nightfall detects that the object record does not exist anymore, and will stop remediation. A notification is sent to you.
Nightfall sends notifications for remediation action it performs.
No, Salesforce does not provide the option to delete specific versions of a file. Further, Salesforce only allows deletion of all the versions of an attachment. You can manually delete the attachment in Salesforce.
If the version was updated, and the object clears the scan, Nightfall will not delete the attachment and issues a notification with this information.
No. Nightfall does not have the capability to detect sensitive information in any entity synced by Einstein Activity Capture.
Please see some example webhook responses below:
Violations
Manual Remediation
Automated Remediation