You can filter Events based on several parameters, to view violations that occurred:

• During specific time periods. You can filter based on pre-set time ranges of last 7 days, 30 days, 90 days and 180 days,

• Integration - the application that is being monitored by Nightfall.

• Detector - the detector that you selected as part of your policies to monitor.

• Likelihood - the confidence level of the detection by Nightfall.

• Status - the current current status of the violation

• User - the user associated to the violation

To filter violations,

1. Select a Filter.
2. Select an Option. You can select one or many options.
3. Click Apply. The filtered list of violations displays.

Note: Nightfall offers additional monitoring capabilities to meet various monitoring needs. You can learn more about using email, Slack and other monitoring options using our supported alerts destinations including alerting to http endpoints using webhook alerts.

This document describes all the operators provided by Nightfall to perform search operations on the Events page. You can use these operators to search for specific Events.

Nightfall provides you with two types of operators which are described in the following sections.

General Operators

Integration Operators

Confluence Operators

Confluence.parent_page_name

This operator allows you to filter violations using the Confluence page's parent page name in which the Event was discovered.

Confluence.space_name

This operator allows you to filter Events using Confluence's space name in which the Event was discovered.

GitHub Operators

GitHub.author_email

This operator allows you to filter Events using the Email ID of the GitHub user who triggered the Event.

GitHub.branch

This operator allows you to filter Events using the name of the GitHub branch in which the Event was triggered.

GitHub.commit

This operator allows you to filter Events using the GitHub commit ID in which the Event was discovered.

GitHub.org

This operator allows you to filter Events using the GitHub organization name in which the Event was discovered.

github.repository

This operator allows you to filter Events using the GitHub repository name in which the Event was discovered.

github.repository_owner

This operator allows you to filter Events using the name of the GitHub repository owner in which the Event was discovered.

JIRA Operators

jira.project_name

This operator allows you to filter Events using the name of the JIRA project in which the Event was discovered.

jira.ticket_number

This operator allows you to filter Events using the ticket number of the JIRA in which the Event was discovered.

Notion Operators

notion.created_by

This operator allows you to filter Events using the name of the user who created the notion page in which the Event was discovered.

notion.last_edited_by

This operator allows you to filter Events using the name of the user who last edited the notion page in which the Event was discovered.

Notion.page_title

This operator allows you to filter Events using the title of the page in which the Event was discovered.

notion.workspace_name

This operator allows you to filter Events using the name of the Notion workspace in which the Event was discovered.

Slack Operators

Slack.channel_id

This operator allows you to filter Events using the ID of the Slack channel in which the Event was discovered.

Slack.channel_name

This operator allows you to filter vEvents using the name of the Slack channel in which the Event was discovered.

slack.workspace

This operator allows you to filter Event using the name of the Slack Workspace in which the Event was discovered.

MS Teams

teams.channel_name

This operator allows you to filter Events using the name of the channel in which the Event was discovered.

teams.channel_type

This operator allows you to filter Events using the channel type name in which the Event was discovered.

teams.msg_attachment

teams.msg_importance

teams.sender

This operator allows you to filter Events using the name of the sender who triggered the Event.

teams.team_name

This operator allows you to filter Events using the name of the team in which the Event occured.

teams.team_sensitivity

Zendesk

zendesk.current_user_role

This operator allows you to filter Events using the name of the current user who triggered the Event.

zendesk.ticket_group_assignee

This operator allows you to filter Events using the name of the group to which the Event ticket is assigned.

zendesk.ticket_status

This operator allows you to filter Events using the Zendesk ticket status.

zendesk.ticket_title

This operator allows you to filter Events using the name of the Ticket.

The Status of an Event implies the current state of the Event. For instance, an Event whose status displays Notified, implies that the end-user whose actions caused the violation has been notified about their actions. They must now take appropriate actions.

When a new Event is created in Nightfall, the status is Active. The status of the violation gets modified by one of the following methods.

• Automatically: If you have configured either Admin alerting, end-user alerting, or have allowed end-user remediation, the status of the violation changes automatically.

• Manually: If you apply an action on a Violation manually either from the Violations page or from any other platform, the status of the violation changes accordingly.

Status List

The various Status available in Nightfall are listed as follows.

Active

This status implies that the Event is newly created and no action (not even notification about the Event) is implemented.

Acknowledged

This status implies that the Nightfall admin has viewed acknowledged the Event. A further action needs to be taken in future.

Notified

This status implies that the end-users have been notified about their actions that caused the Event.

Redacted

This status implies that the sensitive data that triggered the Event, is redacted.

Quarantined

This status implies that the entity (file, email, and so on) that contains the sensitive data is quarantined from rest of the data.

Accepted

Rejected

Scheduled

Removed Internal Users

This status implies that the access to the file or entity that contains sensitive data is no longer accessible to the internal users of the organization.

Removed External Users

This status implies that the access to the file or entity that contains sensitive data is no longer accessible to the external users who are not part of your organization.

Link Settings Changed

This status implies that the file's (that contains sensitive data) access permissions have been modified.

Deleted

This status implies that the file or the entity that contained the sensitive data is deleted.

Ignored

This status implies that the Nightfall admin has ignored the Event either because its false positive or because they wish to look into it in the later.

Disabled Download

This status implies that the file that contains sensitive data has been disabled from downloading. This prevents any user from downloading the file.

Marked as Private

This status implies that the file or the entity containing sensitive data is marked as private.

Attachment Deleted

This status implies that the attachment that contains sensitive data has been deleted.

Sent to JIRA

This status implies that a new JIRA ticket has been created to represent this Event.

Encrypted

This status implies that the sensitive data has been encrypted.

Blocked

This status implies that the entity containing the sensitive data has been encrypted.

Input Requested

This status implies that a notification has been sent to the end-user requesting justification for their actions that caused the Event.

Input Received

This status implies that the end-user has provided justification of their action(s) that triggered the Event.

Restricted to Owner

This status implies that the access to the file containing sensitive data is now restricted only to the owner of the file.

Deleted File

This status implies that the file containing sensitive data is deleted.

Moved to Recycle Bin

This implies that the entity containing sensitive data is moved to recycle bin.

Quarantined Email

This status implies that the email has been quarantined. A Nightfall admin must visit the quarantine settings in Gmail and take an action accordingly. This status is applicable only to Gmail.

Released Email

This status implies that the email was sent to the recipient after scanning. There were no actions taken on the email. This status is applicable only to Gmail.

Pending

These are the violations which have been notified to the end-users. However no action has been taken by the end-users or any other user.

Resolved

This status implies that the sensitive data issue in the Event has been addressed and thus the Event is resolved.

Expired

This status implies that the Event has expired since no action has been taken even after the stipulated time period.

When an Event is registered, a Nightfall admin can take suitable action on the registered Event. The action(s) performed on an Event ensures that the prevention of sensitive data leakage. Nightfall provides a set of actions that the Nightfall admin can implement. The actions vary for each integration. You can implement an action on an Event from the Event list view or Event detail view.

When a new Event is registered, by default, the Event is assigned the Active status and you can find it under the Active tab. The Pending tab displays the list of violations on which you have taken some action but have not yet resolved them. The Resolved tab displays the list of violations that have been resolved.

You can apply an action on a Violation either from the Violation list view page or the Violation details page, as displayed in the following image.

Event Actions

The list of Actions provided by Nightfall are as follows.

Copy Event Link

The action copies the link to the Event. You can save or send this link to directly open the Event. This action is available only on the Event detail view.

View in <integration name>

This action opens the document from within the integration that contains sensitive data. This action is available only on the Event detail view.

Download Original Content:

This action downloads the file that contains sensitive data. If the file is deleted or moved to a different location within OneDrive, this action fails. This action is available only on the Event detail view.

Ignore

This action moves the Event to the Ignored tab. For Google Drive, you can choose to Ignore multiple existing Events or future violations simultaneously. To learn more about the Ignore all feature in Google Drive, see Manage Google Drive Events (step 5).

Acknowledge

Acknowledge action sends an email alert about the policy Event to the email account associated with your login.

Notify

This action allows you to notify end users about the Event. The notification can be via Slack, Email or MS Teams (varies for each integration)

Send to JIRA

This action allows you to select a JIRA project and create a ticket for this Event.

Redact

This action redacts the sensitive data found.

Quarantine

This action temporarily moves files or sensitive data from the original place in which it was discovered to a quarantined Nightfall space for further review. You can restore the quarantined items or permanently remove them by approving or rejecting them through Nightfall alerts.

Change Link Settings

This action modifies the link setting to anyone signed in to an account in your organization to use the link to your file.

Disable Download

This action applies to Google Drive integration and disables download, print, and copy actions for Commenter and Viewer roles. Editor roles will retain all actions.

Delete Attachment

This action deletes the attachment with sensitive tokens in a ticket comment (public replies and internal notes). You cannot revert this action.

Mark as Private

This action modifies the permissions of a ticket comment from a public reply to an internal note. Converting to an internal note means the ticket comment will no longer be visible to the end user. This action is permanent.

Remove Access

This action removes the page from the web and/or removes guest access to the page. This action is active when it applies to the page at the time of the violation

Notify GitHub

This action is specific to the GitHub integration and sends a notification to GitHub about the violation.

Resolve

This action marks the violation as resolved. You can revert this action.

Actions Supported for each Integration

The following table displays the list of all the Nightfall integrations and the Actions supported for each of these integrations.

An Event is an incident that is triggered when a data leak is detected by Nightfall. The Data Sensitive Events page displays all the details about the data sensitive events recorded in Nightfall from all the integrations.

Before we proceed further, let's understand what exactly is a Finding and a Event.

Finding: A Finding refers to a single instance of a data leak incident detected during scanning.

Event: An Event is an incident of data leaks, and a collection of findings that were detected while scanning an entire document or data in your database.

Events vs Finding

When Nightfall scans data, a single Event can have multiple findings. For instance, consider that you upload a document to Google Drive. This document has 10 instances of secret information (10 API keys or 10 credit card numbers). These 10 instances are known as Findings. Since Nightfall scans the entire Google document at once, these 10 Findings are recorded as a single Event.

Event List View

The sensitive data Event list view page consists of a table that displays the details of each Event. The contents consist of columns which are described as follows.

Event Likelihood

The Finding column displays the name of the detector whose condition was violated thus resulting in the generation of the Event. The Finding column displays a list of Events that originated from scanning a single file, a web page, or any other publicly available entity.

Each Event's name is the same as the Detector's name whose condition was violated. You can also view the Likelihood or confidence level (Possible, Likely, Very Likely) of an Event being an actual case of data leak and also the number of instances for each Likelihood. The Possible Likelihood Findings are displayed in blue color with a fully dotted blue circle. The Likely Finding is displayed in yellow color with a half-dotted and half-shaded yellow circle. The Very Likely Finding is displayed in red color with a red circle.

For instance, in the following image, a detector called Person name violated 28 times. Of these 28 instances of violations, 1 is Possible Event (in blue), 5 are Likely Events (in yellow), and 22 are Very Likely Events (in red).

Event Detail View

The Event detail view consists of various sections. These sections are as follows.

Event Detail View First Section

Each field is highlighted and a number is associated with the highlighted field. Using the number, you can refer to the section that follows the image to learn more about the field associated with that number.

1 - Name of the Event

2 - Current Status of the Event. For more information on Event status, refer to the Event Status document.

3 - The nature (Credit card in the above image) and number of Findings (1 in the above image) in the Event.

4 - The name of the document in which the sensitive data was found (TEst Automation Action.Docx in the above image). If there are multiple documents that contain sensitive data, each document is listed here. However, in this case only one document contained sensitive data.

5 - The actual sensitive data found in the document (4242-4242-4242-4242 in the above image). The sensitive data is highlighted in yellow which indicates the Likelihood is Likely. Findings whose Likelihood are Very Likely are highlighted in red and Findings with Likelihood of Possible are highlighted in blue. For more information on Likelihood, see #working-on-eventsdocument.

6 - Number of Findings in the selected document. In the above case there is only one finding and it has a Likelihood is Possible.

Event Detail View Second Section

The contents of this section vary for each integration. You can view the complete list of fields available in the second section after you click the Expand Details button.

The following section contains tabs for each integration. Each tab represents an integration and contains an image of the second section followed by the description of each fields.

Event Detail View Third Section

The third section contains Event logs and comments. These sections are highlighted in the following image.

• Event logs - The event logs section contains a log of activities performed on the Event. By default, the first log activity recorded is the Event creation activity. The next set of activities generally provide information about Event notifications sent via various notification channels and actions taken on the Event.

• Comments - The comments section allows you to enter comments on the Event. The maximum character limit for the comment is 300.

Working on Events

If a single scanned entity (file or web page) violates multiple detector rules, Nightfall displays the list of all the detectors that the finding has violated. Such Events are displayed with a detector name, followed by a +1 (if two detectors are violated), +2 (if three detectors are violated), and so on, on the Event List view.

In the following image, you can see that the Finding has violated a detector called Credit card number and also another detector. Hence a +1 is displayed.

To view the list of detectors violated and the Likelihood (Possible, Likely, and Very Likely) of each finding discovered in the file, click the Event. This opens the Event detail view. You can view the names of the violated detectors and the number of findings on the Event detail view.

In the following image, a single file Automated upload 1728418320 has violated three detectors. The detectors are Person name, Tom Cruise with Exclusions and Phone number. The Person name detector has been violated 22 times and hence there are 22 findings for this detector. You can view each of these 22 instances of findings by clicking the 22 Person name tab and scrolling down. The findings that are highlighted in Blue are Possible findings, findings highlighted in Red are Most Likely findings, and the findings highlighted in yellow are Likely findings. There is a Showing field which displays the number of Findings and the likelihood of each finding. In the following image, the Showing field displays 22 in red. It implies that all 22 findings have the Most Likely likelihood.

The Tom Cruise with Exclusions detector has 3 findings. You can view the Likelihood of each of the 3 findings. You can view the findings that violated this detection rule by clicking the 3 tom cruise with exclusions tab.

Similarly, you can click the 3 Phone Number to view the details of the findings that violated the Phone number detector.

Annotating Findings

As learned above, a Event can have multiple findings. If you find that any of the findings discovered by Nightfall is not an actual case of data leak, you can use the Annotate feature to annotate the specific finding as a false positive. Furthermore, you can also annotate those findings, which surely are a case of data leak, as true positives. Each finding has the annotate option.

To annotate a finding:

1. Hover the mouse on the finding that you wish to annotate.

2. Click the annotation icon.

1. Select one of the following annotation options.

• Not a Credit card number: Select this option if you feel that the Credit card number discovered by Nightfall is not a credit card number but some other number. This marks the finding as a False positive.

• Not a violation: Select this option if you feel the finding discovered by Nightfall is not a violation (an imaginary credit card number shared publicly as an example). This marks the finding as a False positive.

• True Positive: Select this option if you feel that the finding discovered by Nightfall is an actual case of data leak. This marks the finding as True positive.

1. (Optional) Enter comments for annotation.

2. (Optional) Turn the Apply to all identical findings toggle switch to annotate all the similar findings. Click #bulk-annotate to learn more about this feature.

3. Click Apply.

When you annotate a finding as Not a credit card, Not an Address, and so on, or annotate a finding as Not a Violation, the Finding is displayed as False Positive on the Finding column. If you annotate a Finding as True Positive, it is displayed as True Positive on the Finding column.

In the following image, a Violation has 25 Very Likely Findings and 28 Possible Findings. We annotate a Very Likely Finding as True Positive and a Possible Finding as Not a Violation. You can see that the values are reflected accordingly. Findings annotated as True positive are displayed in green color and Findings annotated as False Positive are displayed in grey color.

The Finding column also reflects the latest data on each finding. You can view that Very Likely Findings has reduced to 24. This is because one of them is annotated as True Positive. Similarly, Likely findings have reduced to 27. This is because one of them is annotated as False Positive.

If you accidentally annotate a Finding or annotate a Finding incorrectly, Nightfall provides remediation measures too. For accidentally annotated Findings, you can revert the annotation to return to the original Likelihood (Possible, Likely, Very Likely). For incorrectly annotated findings, you can modify the annotation.

Bulk Annotate

When the Apply to all identical findings toggle switch is enabled, the following events occur.

• annotation is applied to all exact matches of the finding in all the existing Events.

• annotation is applied to all exact matches of the findings in new Events.

Furthermore, the Nightfall AI Smart Auto-Ignore feature performs the following tasks.

• Events whose 100% of findings are annotated as false positives are automatically ignored.

• When auto-ignored, an entry is added to the Event activity log for visibility

• Auto-ignored Events are updated to "Ignored" status and moved to the "Resolved" tab for visibility, analysts' review, or audit.

View Event Details

You can also find more details about the Event from the Event detail view. By default, only a few details are displayed on the Event detail view. You must click the Expand details button to view all the details of the Event. You can also view the chronological order of events (annotations applied, reverted, Event resolved, and so on) on the Event. The events start from the date on which the Event was created. You can also add comments on the Event.

Apply Actions on Events

You can also apply various actions on the Events. The actions menu displays a list of actions that you can perform on an Event.

To learn more about Event actions, you can view the Applying Actions on Events document.

Bulk Actions

When you wish to implement an action on multiple Events simultaneously, you can use the bulk action feature. To learn more about how to use this feature, refer to the Applying Bulk Actions on Events document.

Filtering Data

Nightfall provides you with various filters to view Events specific to an integration, User, or Status. This ensures that you view data that is specific to your requirements. The various filters are described as follows.

Historic Data Filter

This filter allows you to view historical data. You can choose to view data for the last 7, 30, 90, 120, or 180 days. You can also select a custom date range by entering the date in the MM/DD/YY format. When you apply a specific period, all the data on the Event management page is fetched from the selected period till the current date. For instance, assume that the current date is 1 December 2023. If you select the time filter as Last 7 days, the data is displayed from 25 Nov 2023 to 1 December 2023. Similarly, if you select the time filter as last 30 days, the data is displayed from November 2, 2023, to December 1, 2023. By default, this filter displays the data for the Last 7 days. You can click the Last 7 Days button to edit the date.

Miscellaneous Filters

The miscellaneous filters allow you to apply filters on various Nightfall entities. The entities are described as follows.

Detector

This filter facilitates you to view Event data specific to a Detecter.

Integration

This filter facilitates you to view Event data specific to an Integration

Likelihood

This filter facilitates you to view Event data specific to the Likelihood of sensitive data being detected.

Status

This filter facilitates you to view data specific to the status of Event

User

This filter facilitates you to view data specific to users who triggered Events.

To apply a filter:

1. Click the Filter button.

2. In the When drop-down menu select a filter.

Note: The Select an Option drop-down menu is activated once you select a filter. The options in the drop-down menu vary for each filter selected.

1. Select a filter value from the Select an Option drop-down menu. For some filters (like integration filter), you can select multiple values.

1. (Optional) Click Add Filter to add multiple filters.

2. (Optional) Repeat steps 2-3 to add multiple filters.

3. Click Apply.

Automated Event Duplication Management

If an Event is reported multiple times, Nightfall updates the Event to the new instance, instead of creating new Events. However, it maintains a trail of the Events to ensure no reporting is lost.

Filtering duplicates reduces alerts. It also saves you the time spent on analyzing each finding.

Nightfall filters duplicate findings in multiple ways. New Events are not created when:

• You remove a previously reported finding. The existing Event is updated. You can view the update in the Event metadata.

• a duplicate of a finding previously reported is added. The existing Event is updated.

Note: Filtering duplicate Events is currently available for Jira and Confluence.

An Event is auto-resolved:

• When you remove all reported findings.

• When you delete a resource (ex. ticket, comment, or page).

Examples

Consider the case of JIRA integration. If Nightfall detects a data Event in either your JIRA ticket description or JIRA ticket comments an Event is created. This Event has a single finding which was detected in the JIRA ticket. You can view the history of this Event as highlighted in the following image.

Now, consider that you add more sensitive data in the ticket. When Nightfall scans the ticket again the following events occur

• A new Event is created with a single finding. This finding refers to the new sensitive data detected during the second scan.

• The previous Event record is updated. It now has two findings (even more than two if multiple findings are detected on the same ticket).

You can now find the duplicate ticket information in the ticket history section.

Searching Events

The search bar in Events allows you to search Events in two ways as described in the following sections.

Keyword Based Search

You can search for Events using a keyword. The search returns all Events that contain all the keywords submitted.

• For instance, searching for a Credit Card returns all Events that contain Credit AND Card in any of the indexed Event properties.

• You can search for an exact phrase. Use double quotes around the phrase (ex."Credit Card Number").

• Use the AND to search for Credit Card Number Events by John Doe (ex. "Credit Card Number" AND "John Doe")

• Use the Not operator to exclude Events from your search query (ex."Credit Card Number" AND "John Doe" NOT Confluence)

Operator Based Search

Nightfall provides you with search operators to search for the exact Event required. A search operator is an entity that you can use as a filtering factor. For instance, Detector_name is an operator that you can use to view Events specific to a detector. Similarly, Confidence is an operator that you can use to filter Events based on confidence levels (Very Likely, Likely, Possible).

You can use an operator as shown in the following image.

You can see that when you search for Events with Likely Confidence, the search returns all the Events in which at least one instance of Likely Finding. Similarly, when you search for Possible Confidence, the search returns all the Events that have at least one instance of Possible finding.

Nightfall also displays the last five search terms for each user. These values are stored in the user's browser cache.

Nightfall provides two types of search operators.

• General Search Operators: These operators are based on Nightfall entities. These can be confidence level, Nightfall actions, Event status, and so on. To view the complete list of general search operators, see #general-operators.

• Integration Search Operators: These are the search operators based on specific integrations. These operators vary for each integration. To view the complete list of integration-based search operators, see #integration-operators.

You can use multiple operators to refine your search. When you use multiple operators, Nightfall applies the AND logic between the operators. So, if you wish to view all the active Events in the Zendesk integration, you can accomplish it as shown in the following image.

You can also use a single operator to filter multiple values. For instance, to view all the Events of Zendesk and Salesforce integrations, you can use the search as shown below.

integration_name:"Zendesk" OR "Salesforce"

Special Characters

While : is a special character that is an operator seperator for search actions, there are other special characters that cannot be used directly in the search bar. The complete list of special characters that cannot be searched directly, are as follows.

+ - && || ! ( ) { } [ ] ^ " ~ * ? \

So, if your policy name contains reserved characters like && {}, you cannot use these characters directly in the search bar. You must make some changes to your search query before using them. To search any of the above special characters, you must perform any one of the following tasks:

• Use an escape character \ before the special character (this will work with all special characters but not with : )

• Replace the special character with the wildcard (*).

• Replace the special character with a question mark (?).

Some of the examples are as follows.

• To search the policy name Google Drive! Critical_Document, you must use one of the following search terms.

policy_name:"Google Drive? Critical_Document"

policy_name:"Google Drive* Critical_Document"

policy_name:"Google Drive\! Critical_Document"

• To search the policy name H&&M, you must use one of the following search terms.

policy_name:"H?&&M"

policy_name:"H*&&M"

policy_name:H\&\&M"

• To search the policy name Google !, you must use one of the following search terms.

  Copy

  policy_name:"Google *"
  
  policy_name:"Google ?"
  
  policy_name:Google \!"

Export and Share Event Data

Nightfall allows you to share and download the Event data. The Share option creates a link to the current view with all the filters applied. When you click this link,the Events page opens with all the filters applied.

The Export option, creates a CSV file with all the event data. The CSV file is mailed to the logged in user's Email ID. The CSV file contains all the filters which were applied before initiating the download process. Click Export to CSV to start the export process.

Once you click the Export to CSV button, a pop up window comes up. Click Download and Send to Email.

You receive an Email from Nightfall with the subject line Nightfall - Report <Download date>. You must click the Download Report button in the email. The link to the report expires 7 days after you receive the email.

The CSV table contains the same columns as in case of the Event list view. The file looks as follows.

Nightfall allows you to perform actions on a large set of Events. The Violations page displays a maximum of 50 Events. With Bulk actions, you can choose to implement an action either on the 50 Events which are currently displayed on the screen or on all the Events including the 50 displayed on the Events page.

For example, you can apply filter to display on Events reported by the Salesforce integration. Once you apply the filter to view only Salesforce integrations, you can then apply bulk action on all the Salesforce Events.

To use the Bulk actions feature:

1. Navigate to the Sensitive data Events page in Nightfall.

2. Apply an integration filter to view the list of Events which belong to a specific integration. You must select only a single integration. If you select multiple integrations, you cannot use the Bulk actions feature.

3. Select the Finding check box. The 50 violations displayed on the screen are selected.

1. (Optional) You can also choose to select all of the violations that belong to the filtered integration.