Exfiltration policies allow you to monitor download events across your Google Drive environment. Through real-time download monitoring, you can identify insider risk and anomalous behaviour before it escalates to large scale security incidents. You can monitor download activity for specific users or user groups, specific drives containing valuable sensitive assets, or downloads of any files containing sensitive data types as discovered and classified by Nightfall's ML/AI based detectors.

You can set up your policies to monitor only, to educate users in real-time about your download and data governance policies, or to automatically suspend user access to the Google Workspace to enforce zero tolerance policies.

The detailed steps to configure the Google Drive Exfiltration policy is explained in the following documents.

Integration

Trigger

Automated Actions

Creating Policy

Remediation for Google Drive Exfiltration

Data exfiltration, also known as data theft, data exportation, or data extrusion, is the unauthorized transfer of data from a device or network. It can occur as part of an automated attack or can be performed manually. The illegitimate transfer of data often looks very similar to legitimate transfers, making it difficult to detect.

Common Techniques for Data Exfiltration

Data exfiltration can occur in various ways and through multiple attack methods. Here are some of the most commonly used techniques:

• Social Engineering and Phishing Attacks: These attacks trick victims into downloading malware and giving up their account credentials.

• Outbound Emails: Cyber criminals employees or intruders use email to exfiltrate any data that sits on organizations’ outbound email systems.

• Downloads to Insecure Devices: Data is transferred by users from secure, trusted systems to an insecure device. From there, the attacker can infiltrate the device and exfiltrate the data.

• Uploads to Cloud Storage: Data can be exfiltrated from cloud storage when data is uploaded to insecure or misconfigured resources.

Nightfall Exfiltration Solution

Nightfall provides a highly revolutionised solution to data exfiltration. Nightfall AI's exfiltration prevention capabilities easily integrate with existing tools, thus catering to security teams and companies across industries. Nightfall's exfiltration solution is much more than just a tool; it proactively protects against data breaches, providing tangible benefits for organizations striving to secure their sensitive information.

Data exfiltration, also known as data theft, data exportation, or data extrusion, is the unauthorized transfer of data from a device or network. It can occur as part of an automated attack or can be performed manually. The illegitimate transfer of data often looks very similar to legitimate transfers, making it difficult to detect.

Common Techniques for Data Exfiltration

Data exfiltration can occur in various ways and through multiple attack methods. Here are some of the most commonly used techniques:

• Social Engineering and Phishing Attacks: These attacks trick victims into downloading malware and giving up their account credentials.

• Outbound Emails: Cyber criminals employees or intruders use email to exfiltrate any data that sits on organizations’ outbound email systems.

• Downloads to Insecure Devices: Data is transferred by users from secure, trusted systems to an insecure device. From there, the attacker can infiltrate the device and exfiltrate the data.

• Uploads to Cloud Storage: Data can be exfiltrated from cloud storage when data is uploaded to insecure or misconfigured resources.

Nightfall Exfiltration Solution

Nightfall provides a highly revolutionised solution to data exfiltration. Nightfall AI's exfiltration prevention capabilities easily integrate with existing tools, thus catering to security teams and companies across industries. Nightfall's exfiltration solution is much more than just a tool; it proactively protects against data breaches, providing tangible benefits for organizations striving to secure their sensitive information.

This document explains the steps to install the Nightfall for Google Drive.

Requirements

To install the Nightfall DLP for Google Drive integration, you must have the following:

• A Google Workspace account, preferably a service account.

• An admin user account of your organization's Google Workspace account (or any other Google Workspace account) on which you wish to install the integration.

Installation

To install Nightfall for Google Drive:

1. Log in to Nightfall.

2. Click Google Drive under the MY INTEGRATIONS section (click Show more if you are unable to view Google Drive)

3. Click Begin Setup. 

The access permission page is displayed as follows. Copy the client ID and Scopes ID generated.

1. Login to your Google Workspace with an admin account.

2. Click the menu icon.

3. Select Admin.

1. In the Admin console left pane, expand Security and then expand Access and data control.

2. Click API controls.

1. Click MANAGE DOMAIN WIDE DELEGATION under Domain wide delegation.

1. Click Add New.

1. Paste the Client ID copied from the Nightfall app, in the Client ID field.

2. Paste the Scopes ID copied from the Nightfall app, under OAuth Scope field. Use comma to add multiple scope IDs.

3. Click AUTHORIZE.

1. Return to the Nightfall app and click Next Step.

1. Click Connect.

Once the installation is completed, you can view the details of your Google Drive in the Nightfall app.

When there is a high volume of exfiltration (basically download) in your organization, the scoping capability enables you to reduce the noise from low risk events so that you can zero in on genuine exfiltration events and resolve them.

Exfiltration (Download monitoring) can be scoped to:

• Location: All or a specific set of drives

  • This allows you create flexible policies to monitor all or specific high-risk locations. This is a required scope for all policies.

• User or User Group (Actor): Any or a specific set of users or user groups

  • This allows you to create custom policies for specific high-risk individuals or user groups. As such, you can create policies to monitor download activity by a disgruntled employee or departing employees. This can be set in combination to other scoping capabilities.

• Permissions: Public, Organization or Restricted

  • This allows you to tailor your policies to drives or files with specific access restrictions. This can be set in combination to other scoping capabilities.

• Detection rules: Any or a specific set of sensitive data protection detection rules

  • You can reuse any of detection rules you've already created or create new ones. This helps focus your detection on files which have associated sensitive data violations identified by your sensitive data scanning product. This can be set in combination to other scoping capabilities.

The Scope stage consists of two main sections.

• Drive Selection: This section allows you to include various files and drives for monitoring. In this section, you can select the different types of drives to be monitored.

• Add Filters: This section allows you to scrutinize your policy scope at more granular levels. While the Drive selection section allows you to select the whole drive to be monitored, this section provides you more granular level filters. You can select specific files within the selected drives for monitoring.

Configuring the Drive Selection Section

The Drive Selection section allows you to select various drives for monitoring. You can select either User Drives or Shared Drives to be monitored by Nightfall for exfiltration.

Select Drives

This section allows you to select various drives in your Google Drive to be monitored. There are two options in this section. You can either choose to scan the User drives, Shared drives, or both.

• User Drives: The User Drives is the personal drive of the user. The files in this drive are visible only to the owner of the file and other users to whom the owner has granted access. User Drive is commonly known as My Drive in Google Drive. To monitor a User Drive, you must select the User drives check box as shown in the following image.

• Shared Drives: Shared drives are common storage locations accessed by all the users in your Workspace. To select this option, you must select the Shared drives check box.

The following image displays the scenarios when you select the Shared Drives check box.

If you select the All Drives, except for option, you must also select the shared drives which must be excluded from monitoring.

Similarly, if you select the Specific Drive(s) option, you must also select the specific shared drives which must be monitored.

Configuring Add Filter Section

The filters section provides you the flexibility to include and exclude users at a granular level.

For instance, in the previous section, irrespective of whether you selected Shared Drive, User Drive, or specific User Drives, you ended up selecting one or a set of Drives for monitoring.

Once you select the Drives to monitor, in this section, you can overlay additional filters to further scope your monitoring. Nightfall provides the following additional filters:

#internal-users

#external-users

#internal-groups

#external-groups

#permission

#detection-rules

Internal Users

• Monitor specific: Choose this option to monitor one or a specific set of internal users. Once you choose this option, Nightfall populates the list of users from the synced IdPs in Directory Sync. You must select the required users.

• Monitor all, except: Choose this option to exclude specific individuals from your monitoring policy. Once you choose this option, Nightfall populates the list of users from the synced IdPs in Directory Sync. You must select the required users.

External Users

• Monitor Specific: Choose this option to monitor one or a specific set of external users. Once you choose this option, you must manually enter the email ID(s) of the external users and hit the enter key.

• Monitor all, except: Choose this option to exclude specific external users, from being monitored. Once you choose this option, you must manually enter the email ID(s) of the external users and hit the enter key.

Internal Groups

• Monitor specific: Choose this option to monitor one specific or a set of internal groups. Once you choose this option, Nightfall populates the list of internal groups from the synced IdPs in Directory Sync. You must select at least one group.

• Monitor all, except: Choose this option to exclude one specific, or a set of, internal groups from being monitored. Once you choose this option, Nightfall populates the list of internal groups from the synced IdPs in Directory Sync. You must select the required users.

External Groups

• Monitor specific: Choose this option if you have external user groups defined in your IdP and would like to monitor one specific or a set of external groups. Once you choose this option, you must select at least one external user group to monitor then hit the enter key.

• Monitor all, except: Choose this option if you have external user groups defined in your IdP and would like to exclude one or more external groups from being monitored. Once you choose this option, you must select at least one external user group to monitor then hit the enter key.

Permission

Before understanding the Permission filters, we must understand Google's General Access feature.

General Access

The general access feature in Google Workspace consists of three types of access, which are as follows.

• Restricted: Files with this permission can only be accessed by users who have been granted access.

• Target Audience: Files with this permission can be accessed by the users of the selected target audience group. There is a default target audience that gets created when the Google workspace is provisioned. This target audience has the same name as provisioned in the Google Workspace and includes all members of the organization. You can refer to this Google document to learn more about the target audiences.

• Anyone with the Link: Files with this permission can be accessed by any user who has the file link.

Nightfall also provides inclusion and exclusion of files in policy scope that resembles the General Access sharing principle in Google Workspace. The Nightfall General Access permission options are as follows.

• Restricted: Choose this option to scope monitoring to files with restricted access.

• Shared with target audiences: Choose this option to scope monitoring to files shared with target audiences within your Google Workspace environment.

• Anyone with the link: Choose this option to scope monitoring to files shared with anyone with a link.

Detection Rules

The Nightfall Detection Rules consist of a single or multiple detectors. You can use this filter to either include all the detection rules or include only specific detection rules. Note that upon a download event, Nightfall will check if the downloaded file has been previously scanned, and results matched at least one of the selected detection rules (i.e. The file is not rescanned upon download).

• All: If you select this option, all the detection rules are included.

• Monitor Specific: If you select this option, you must also select the required detection rules. Nightfall scans your files only for the selected detection rules.

Nightfall for Google Drive allows you to configure alerts at the policy level and also at the integration level. Alerts can be sent in Google drive by using the following alert channels.

• Slack

• Email

• Webhook

• Jira Tickets

When you configure alert settings at the integration level, the alert settings apply to all the policies, created for the Google Drive integration. However, when you configure alert settings specifically for a policy, which is created in the Google Drive integration, the alert settings are applicable only for that specific policy.

This document explains how to configure alerts at the integration level. To learn about how to configure alerts at the policy level, read this document.

Prerequisites

• To use Slack as an alert platform, you must first perform the required Slack configurations. You can refer to this document to learn more about how to configure Slack as an Alert platform.

• To use Webhook as an alert platform, you must first perform the required Webhook configurations. You can refer to this document to learn more about how to configure Webhook as an Alert platform.

• To use JIRA as an alert platform, you must have the DLP for the JIRA app installed from the Atlassian Marketplace. You can read more about the DLP for JIRA integration here.

Configure Alerts at the Integration Level

You can configure alerts at the integration level once you have installed the Nightfall for Google Drive integration.

To configure alerts at the integration level:

1. Navigate to the Google Drive integration

2. Scroll down to the Alerting section.

3. You can configure one or multiple alert channels.

Configuring Slack as an Alert Channel

1. To configure Slack as an alert channel, click + Slack channel.

1. In the Slack alert channel field, enter the name of the Slack channel in which you wish to receive the alerts.

2. Click Save.

A confirmation pop-up box is displayed to confirm if the Slack channel (entered in the second step) must be used only for Google Drive integration or all the Nightfall integrations.

1. Select No, only integration level to use the Slack channel only for Google Drive, or select Yes, please to use the selected Slack channel for all the Nightfall integrations.

Configuring Email as an Alert Channel

1. Click + Email.

1. Enter the Email ID of the recipient who should receive the notifications.

2. Click Save.

A confirmation pop-up box is displayed to confirm if the Email ID (entered in the second step) must be used only for Google Drive integration or all the Nightfall integrations.

1. Select No, only integration level to use the Slack channel only for Google Drive, or select Yes, please to use the selected Slack channel for all the Nightfall integrations.

Configuring Webhook as an Alert Channel

1. Click + Webhook.

2. Enter the Webhook URL.

3. Click Test. If the test result is not successful, check the Webhook URL.

4. (Optional) Click Add Header to add headers.

5. Click Save.

{
  "service": "nightfall",
  "test": true,
  "timestamp": "2024-03-07T23:18:39Z"
}

Configuring JIRA as an Alert Channel

1. Click + Jira Ticket.

2. Select a JIRA project from the Jira Project drop-down menu.

3. Select an issue type from the Issue Type drop-down menu.

4. (Optional) Add comments to be added in the JIRA ticket.

5. Click Save changes.

A confirmation pop-up box is displayed to confirm if the JIRA settings configured for the Google Drive integration must be applied to all the other Nightfall integrations too.

1. Select No, only integration level to use the configurations only for Google Drive, or select Yes, please to use the selected JIRA configurations for all the Nightfall integrations.

Configure End-User Notification

When a Violation occurs, Nightfall sends a notification to the end-user whose actions triggered the violation. While notifying the end-user, Nightfall also sends a text message. You can draft the text message to be sent to the end-user. This message applies to all the policies. Click Save changes once done.

This stage allows you to select automated notification channels or actions if a policy violation occurs.

Admin Alerting

This section allows you to send notifications to Nightfall users. The various alert methods are as follows. You must first turn on the toggle switch to use an alert method.

The steps to configure alert channels for policy-level integration are the same as in the case of integration-level alerts. You can refer to for steps.

Automated Actions

Automated actions allow you to configure automated remediation actions when an exfiltration attempt is detected by Nightfall policy. Nightfall supports the following automated actions for Google Drive. You can choose to implement the automated action immediately after detecting a download attempt or after some time.

Suspend Account: This action suspends the user's account who tried to download files and triggered the exfiltration event.

To enable the automated action, you must turn on the respective toggle switch.

You must now select when exactly after detecting the event, the action must be triggered. if you select the Immediately option, the automated action is triggered immediately after the download attempt is made.

If you select the After option, you must select the time gap after which the automated action must be implemented.

End-User Notification

This section allows you to configure notifications to be sent to the end user whose actions triggered the violation.

Custom Message

Automation

The automation settings allow you to send notifications to end users. You can select one or both the notification methods. You must first turn on the toggle switch to use the automation option. The automation notification channels are as follows

• Email: This option sends an Email to the user who attempted the download.

• Slack: This option sends a Slack message to the user who attempted the download.

End-User Remediation

End-user remediation (also known as Human Firewall) allows you to configure remediation measures that end users can take, when a violation is detected on by their download attempt. You must turn on the toggle switch to use this option. End-users receive the remediation actions in an Email as an action item. The various available remediation actions for end-users are as follows.

• Report as False Positive with Business Justification: This option allows end users to report false positive alerts and provide a business justification as to why the alert is considered to be false positive.

When end-users report alerts as false positive, you can choose the resolution method to be either Automatic or manual.

If end-users do not take any remediation action, you can set the frequency at which they must receive the notifications to take action.

In this final stage, you assign a name to the policy, verify your configurations, and create the policy.

1. Enter a name for the policy.

2. (Optional) Enter a description for the policy.

3. Click Next.

1. Verify if all the policy configurations are set up as per your requirements.

2. (Optional) Click back or click on any specific stage to modify any of the policy configurations.

3. Click Submit.

This document explains the process of installing Nightfall AI agent using the Kandji MDM.

Prerequisites

• Ensure that the Kandji APN is set.

• Ensure that the target macOS devices are onboarded.

• Ensure that you have received and unpacked the Nightfall Endpoint payload.

Create a Blueprint

1. Navigate to

2. Click New Blueprint on the top right corner.

3. Click New Blueprint on the pop up menu.

4. Enter a name for the blueprint in the Blueprint name field.

5. Enter a description for the blueprint in the Blueprint description field.

6. Click Create Blueprint.

Create Custom Profiles

In this section, we create a custom profile for each of the profiles provided in the Nightfall endpoint payload and assign them to the blueprint you have created in the previous section.

1. Locate the following .mobileconfig files in your Nightfall Endpoint payload package.

1. a. Click Add new.

b. Select Custom Profile and click Add & Configure on the pop-up window.

c. Add Title, Select Blueprint, and finally drag and drop the .mobileconfig file.

d. Click Save.

1. Repeat the above steps for each of the .mobileconfig files provided.

Create a Custom App

In this section, we will create a custom app item for Nightfall Endpoint Agent.

2. Click Add New.

1. Click Custom App

2. Click Add & Configure on the pop-up window.

a. Add Title, Select the Blueprint you previously created.

b. Select the Audit and enforce option.

c. Paste the content of mdm_kandji_audit_script into the Audit Script text box.

d. Choose the Installer Package option.

e. Add Preinstall Script & Upload the installer package.

I. Paste the content of mdm_pre_install_script into the Pre-install Script text box.

II. Upload the installer package

i. Drag and drop or click to upload the provided nightfall-ai-agent_v*.*.*.pkg file

1. Save the change and wait for the changes to get deployed on the node machine.

This document explains what admins and end-users can do once a policy is violated.

Admin Notification and Remediation

When end-users violate a policy, the Nightfall admin is notified about the incident. The notification channel used to notify the Nightfall admin depends on the settings configured in the section. If you have not enabled any notification channels in the Admin alerting section, Nightfall admins are not notified.

If you have enabled the email notification in the Admin alerts section, Nightfall admins receive an email. The email is as shown in the following image.

The Email consists of the following data.

• Event: The event that caused the violation. For Google Drive, the event is always a download of assets.

• Actor: The Email ID of the user who downloaded the file.

• When: The date and time when the email was downloaded.

• Where: The name of the file that was downloaded.

• Policies Violated: The name of the policy that was violated.

• Violation Dashboard: The link to the Events screen to view the violation in detail.

• Actions: The list of actions that the Nightfall admin can take.

Also, a Slack message is sent if you have enabled the Slack alerts for the Nightfall admin. The Slack message looks as shown in the following image.

End-User Notification and Remediation

If you have configured the Email notification for end-users and enabled the end-user remediation, end-users can take remediation actions from the Email itself. The end-user Email is shown in the following image.

If you have configured Slack notifications for end-user and enabled end-user remediation, end-users can view the Slack message as follows.

Managing Events in Nightfall

Nightfall admins can manage violations from within the Nightfall console. The Events page in Nightfall lists all the violations under the Exfiltration tab. End-users can get a detailed view of each exfiltration Event triggered.

To view violations in Nightfall

1. Navigate to the Exfiltration Prevention page.

The Exfiltration Events page lists all the exfiltration events. To view events with specific statuses, you can click the respective tabs.

To view the past events, click the Time filter and select the required time period. By default, the time period displays Events for the Last 7 Days.

You can click an event to view the details. The detail view window is as follows.

The detail view window consists of the following tabs.

• Summary: The Summary tab displays highlights of the event like the name of the downloaded asset, the name of the violated policy, the email ID of the user who violated the policy, and so on.

• Asset: The asset window displays the details of the asset and the history of the asset. You can also choose to view historic asset data. If there are multiple assets in a single violation, you can choose which asset's details must be displayed.

• Actor: The actor tab displays the details and history of the user who downloaded the asset. You can choose to view historical data of the user. You can also add which can serve as metadata for the violation.

Taking Actions on the Events Page

The events list view displays an ellipsis menu at the extreme right corner. Admins can click this menu to take appropriate action on an exfiltration event.

The various available actions are explained as follows.

• Acknowledge: This action can be taken when you just wish to acknowledge that you have viewed the violation.

• Notify Email: This action sends an email notification to the end-user who caused the violation.

• Notify Slack: This action sends a Slack notification to the end-user who caused the violation.

• Suspend Account: This action suspends the account of the user who caused the violation.

• Ignore: This action ignored the violation. You can take this action when an event is false positive.

• Copy Link: This action is only available on the Asset detail view. You can copy the direct link to the Event with this action.

Once the action is implemented, the status of the event changes respectively. By default, an event can have one of the following two statuses.

• Active: The event has been generated but no action has been taken.

• Input Requested: A notification has been sent to the end-user requesting their response.

This document explains the process of installing the Nightfall agent manually.

Prerequisites

1. Ensure that you have root level access to the target macOS device.

2. Ensure that you have received and unpacked the Nightfall payload containing .pkg package file and the pre installation script files. If not, contact your Nightfall CSM.

3. Install the following profiles. You can find these files in the Profiles folder that was created after unpacking the .pkg package file.

   "ai.nightfall.endpoint.automation" "ai.nightfall.endpoint.notification" "ai.nightfall.endpoint.pppc"

4. Run the MDM pre installation check script.

1. Create a default policy for web browser uploads and cloud storage application sync.

Installing the Package

1. Locate the mdm_pre_installation_script.sh in the payload provided by Nightfall.

2. Open a Terminal window.

3. Run the mdm_pre_installation_script.sh script on your local machine as a root user, by executing the following command.

1. Double click the nightfall-ai-agent_<version>.pkg.

1. Click Continue.

1. Click Install.

1. Click Use Password to enter your device password and start the installation process.

Once the installation is completed, you get a completion message as shown in the following image.

1. Click Close.

At the top right corner of your screen, you can view the Nightfall AI agent icon which looks as follows.

When you click this icon, you can view the details of the agent.

Grant Full Disk Access

To monitor your MAC device, you must grant access to the hard disk. This section explains the process of granting disk access.

1. Navigate to System Settings > Privacy & Security > Full Disk Access.

1. Click the + icon at the bottom of the list (you may be prompted to enter your macOS password)

1. Select NightfallAIAgent (under Applications) and click Open.

1. Click Quit & Reopen.

On the Full Disk Access page, ensure that the toggle switch is turned on for the NightfallAIAgent. This ensures that the full disk access is granted.

Grant Permission to Monitor Uploads

Apart from the disk access, you must also grant permission to the Nightfall AI agent to monitor browser uploads. This section explains the process.

To grant access to browser uploads:

1. Open a browser instance and upload a test file.

2. When prompted, grant the Nightfall AI agent permissions.

Uninstalling the Nightfall AI Agent

To uninstall the Nightfall AI agent, you must execute the following command on your MAC device, as a root user.

Verify Profiles

When you install the Nightfall agent manually, you must check your system profiles to ensure that all the Nightfall agent profiles are successfully integrated.

To check the system profiles:

1. Navigate to Privacy & Security > Profiles.

1. Ensure that the following profiles are present.

• Nightfall Notification Profile

• Nightfall PPPC Profile

• Nightfall System Event Access

This document explains the process of installing Nightfall AI agent using JAMF.

The JAMF installation consists of the following steps.

1. Upload Device Profiles to Jamf Pro

2. Upload and Add the Pre-Installation Check Script

3. Upload and Add the Pre-Installation Script

4. Upload the Nightfall App Package

5. Create a Policy and Add scripts and package

Prerequisites

• Target macOS devices are onboarded.

• You have received and unpacked the Nightfall Endpoint Agent payload.

This document explains the process of installing Nightfall AI agent using the Rippling MDM.

Pre-requisites

1. Target macOS devices are onboarded.

2. You have received and unpacked the Nightfall Endpoint payload.

Step 1 - Create & Deploy Profiles

In this step, you will create a custom profile for each of the profiles provided in your Nightfall endpoint payload.

1. Locate the following .mobileconfig files in your Nightfall Endpoint payload package

   • NightfallAI_ApplicationSystemEvents.mobileconfig

   • NightfallAI_Notification.mobileconfig

   • NightfallAI_PPPC.mobileconfig

2. Navigate to https://app.rippling.com/hardware/configurations and click “Add configurations”.

3. Upload and save provided config profiles.

   • Drop or select NightfallAI_PPPC.mobileconfig .

   • Configuration name: “Nightfall AI PPPC”

   • Configuration description: “Nightfall AI PPPC profile”

   • Platform: “macOS”

   • Click Save & continue.

   • Repeat the above for all remaining .mobileconfig profiles provided.

4. Select Deploy from the three-dot context menu located on the far right of the first profile.

   • Select all employees or specific target devices.

   • Click Save.

5. Repeat step 4 for each remaining profiles.

Step 2 - Configure & Deploy Software Package

Step 2.1 - Create & Configure the Software Package

1. Navigate to: https://app.rippling.com/hardware/software

2. Click Upload Software on the right of the page.

   • Name: “Nightfall Endpoint DLP Agent <version>”

     • <version> is the version of the package your received from Nightfall.

   • Operating System: “macOS”

   • Category: “My Uploads” (Default)

   • Description: “Nightfall Endpoint DLP Agent”.

   • Upload Icon: use the .png icon file provided.

   • Upload Installer File: drop or select the provided nightfall-ai-agent-signed.pkg file.

   • Install-check script: provided in your package as mdm_pre_install_check_script.sh

   • Pre-install script: provided in your package as mdm_pre_installation_script.sh

   • Click Submit.

   • Click Add on the newly created Software Item.

   • Click Finished Selecting.

Step 2.2 - Deploy the Nightfall Endpoint DLP Agent

1. Search or scroll to the newly added item matching the name you used in the previous step.

   a. Click Edit.

   i. Select all employees or specific target devices.

ii. Click Save.

The Nightfall Endpoint DLP Agent will now deploy to all selected target devices. This may take up to 72 hours and is dependent on the endpoint devices being turned on, connected, and pre-requisite profiles deployed.

Upgrading to a New Version

The below describes the steps to upgrade endpoints with a new version of the agent:

1. Search or scroll to the old version of the Nightfall Endpoint DLP Agent and click “Edit”.

   a. Remove all devices from the installation list and click “Save”.

2. Follow the steps to configure the new software package for the new version

3. Follow these steps to deploy the new version.

The Nightfall Endpoint DLP Agent will now deploy to all selected target endpoints. Installation may take up to 48 hours and is dependent on the endpoint devices being turned on and connected.

Nightfall for macOS allows you to detect exfiltration events on your macOS devices. The Nightfall exfiltration feature can monitor any files being uploaded through supported cloud storage apps or browsers on macOS devices.

To use Nightfall for macOS, you must install the Nightfall AI agent. This agent monitors your macOS device continuously. You can install the agent either manually or through a Mobile device management (MDM) tool. You can request the Nightfall deployment bundle which contains the .pkg and other pre-installation scripts required for your MDM deployment. Here are the manual installation instructions along with example installation steps for MDM deployments.

• Manual Installation

• Installation using the Kandji MDM

• Installation using the Rippling MDM

• Installation using the JAMF MDM

Nightfall Agent Auto Update

Nightfall employs the automatic endpoint update functionality. With this feature, Nightfall can deliver the majority of endpoint agent bug fixes and feature updates directly to endpoints.

Features:

• Stay Secure: Receive the latest security patches and updates promptly, reducing the risk of vulnerabilities being exploited.

• Remain Compatible: Keep your deployment compatible with the latest operating system updates and other software changes.

• Receive New Features: You get access to new features and improvements to exfiltration monitoring without manual intervention.

• Minimize Administrative Overhead: IT administrators don't need to manually deploy updates to each endpoint, saving time and resources.

In this stage, you select the Integration for which the policy is created. In this case, Google Drive integration must be selected.

1. Click Policies from the left menu.

1. Click + New Policy.

2. Select Exfiltration.

1. Select macOS.

The Scope section enables you to create an asset lineage based policy in which you can track the journey of an asset from source to destination.

Key Features of Lineage Based Policies

• Security administrators can set precise exfiltration policies to protect sensitive files that originate from high-value SaaS locations from being exfiltrated to unsanctioned destinations

• High performance security teams can focus their energy and resources on monitoring assets from high value SaaS domains.

• By combining content download origin to upload destination, organizations can extend their monitoring to cover any cloud application accessed through the browser, even those without direct API integration.

• Allows security teams to monitor and prevent data exfiltration not just through direct browser uploads but also through cloud storage sync applications, providing a multi-layered defense against data leaks.

• With lineage-based policies, organizations can proactively identify and manage risks associated with sensitive content movement, ensuring compliance with data security standards and preventing potential breaches before they occur.

Configuring the Scope Page

The Scope page consists of two sections.

Device

By default, Nightfall monitors all the macOS devices configured in your org. However, you can choose to exclude specific macOS devices from being monitored.

Asset Origin

The Asset Origin filter allows you to limit the scope of the policy to only those assets which originated from a specific source. To use the asset origin filter, you must click Add Filter and select Asset Origin.

The Asset origin filter provides the following options:

Once you select a domain collection, it is displayed on the screen and greyed out from the drop-down menu. You can use the drop-down menu to select additional domain collections.

Once you select a domain collection, it is displayed on the screen and greyed out from the drop-down menu. You can use the drop-down menu to select additional domain collections.

The trigger section further enhances the unwanted noise reduction capabilities. With the trigger section, you can

• Set what download behavior can be termed as an exfiltration event.

• Exclude downloads by trusted apps from being termed as exfiltration events.

Configuring Trigger Section

In the trigger section, you can set the download behavior, the download frequency to be precise, must be termed as an exfiltration event.

To configure the Trigger section:

1. Set the minimum number of downloads threshold that must be considered as an exfiltration event.

2. Set the required time period (frequency). If the minimum download threshold (set in the previous step) is reached or exceeded, within the set time period, an exfiltration event is generated.

In the following image, the configurations are set such that if an asset is downloaded 2 or more times within 10 minutes, an exfiltration event is triggered.

Exclude Apps

Depending on your environment, a significant number of downloads may be attributed to applications (i.e. backup apps). You may choose to ignore such download events to reduce the noise and focus your monitoring on unexpected application and user download events.

The Exclude apps section allows you to exclude specific applications from being monitored by your policy.

To configure the Exclude apps section, select the applications to exclude from the drop-down menu. Once saved, Nightfall will not alert on download events attributed to the excluded applications.

This document explains what admins and end-users can do once a policy is violated.

Managing Violations in Nightfall

Nightfall admins can manage violations from within the Nightfall console. The Events page in Nightfall lists all the violations under the Exfiltration tab. End-users can get a detailed view of each exfiltration violation recorded.

To view violations in Nightfall

1. Navigate to Exfiltration Prevention from the left menu.

Steps 2-6 help you filter the events to only view the alerts generated by macOS.

1. Click Filter.

2. Click + Add Filter.

1. Select Integration.

2. Select the macOS check box.

1. Click Apply.

The filtered list of events only for macOS are displayed as follows.

You can click an event to view the details. The detail view window is as follows.

As you can view in the above image, the detail view window consists of the following tabs.

Summary Tab

The Summary tab consists of the following details.

• Assets: The name of the uploaded asset that contains sensitive data.

• Policy: The name of the policy violated.

• Device ID: The device ID of the device from which the asset was uploaded.

• Machine Name: The physical name of the device from which the asset was uploaded.

• Browser Name: The name of the browser from which the asset was uploaded. This field is applicable only for browser uploads.

• App Name: Then name of the cloud storage app to which the asset containing sensitive data was uploaded. This field is applicable only for uploads done to cloud storage apps.

• Account Type: The nature of the cloud storage app to which the asset was uploaded. The account type is generally either Personal account or Business account. his field is applicable only for uploads done to cloud storage apps.

• Upload Start Time: The start date and start time of the upload.

• Upload End Time: The end date and end time of the upload.

The Summary tab for a Browser upload action is as follows.

The Summary tab for a Cloud storage app event is as follows.

The Summary tab also displays the timeline when the event was created. You can also add comments on the Summary tab. The comments added by you can be viewed by other users as well.

The comment is displayed as follows.

Assets Tab

This tab displays the details of the asset (with sensitive data) that was uploaded to a domain or cloud storage app. The asset tab also displays a number in brackets. This number indicates the number of assets that were uploaded as part of the event.

In the following image, there is a single asset that was uploaded and it triggered the event.

In the following image, there were two assets which were uploaded and these four uplaods together triggered the event.

In such cases when there are multiple assets involved, you can use the drop-down menu to switch between assets and view the asset details.

The Assets tab displays the following details.

• Name: The name of the asset uploaded.

• Where: The location of the asset in the device.

• Medium: The medium used to upload the asset. This can be browser or cloud storage app.

Asset History

The Assets tab also contains the Asset History section. This section displays the source or origin from where the asset was downloaded. Additionally, it also displays the destinations to which the asset was uploaded. If the source and destination details are not available, this section does not display any information. Users can use the time filter to view historic data.

Device Tab

The device tab displays the details of the device used to upload the asset. You can view the following details on this tab.

• Device ID: The device ID of the device from which the asset was uploaded.

• Device Name: The name of the device from which the asset was uploaded.

• Connection Status: The current status of the device. This can either be Connected or Disconnected. If the device is not in contact with the Nightfall agent for more than 6 hours, the connection status changes to disconnected.

• OS: The operating system used on the device.

• MAC Address: The physical MAC address of the device.

• Last Connection: The date and time when the device was last connected.

• Agent Version: The Nightfall agent version installed on the device.

• OS Version: The MAC OS version used on the device.

Actions

You can perform the following actions on all the three tabs. These actions are present at the bottom.

• Copy Event Link: This action copies the link of the event to the clipboard.

• Acknowledge: This action modifies the status of the event to Acknowledged.

• Resolve: This action resolves the event and modifies the status to resolved.

• Ignore: This action ignores the event and modifies the status to ignored.

• Asset: The asset window displays the details of the asset and the history of the asset. You can also choose to view historic asset data. If there are multiple assets in a single violation, you can choose which asset's details must be displayed.

The Exfiltration policies for MAC allow you to monitor if there are any uploads via browser or cloud storage apps. You can configure the domains in Internet that needs to be monitored and also the cloud storage apps which need to be monitored.

When there are any uploads to the configured domain or cloud storage apps, the Nightfall AI agent notifies this action. You can configure the notification channels through which you wish to receive notifications when there is an attempt to upload files/folders.

Verify Connection

Once you have completed the installation of Nightfall agent, you must ensure that the connection is live. If the Nightfall agent cannot connect to the macOS device for more than 6 hours, the connection is closed. When the connection is live, a Connected message is displayed. If the connection is lost, Disconnected message is displayed.

Create Domain Collections

Collections help you refine you monitoring to reduce noise from sanctioned upload destinations as well as closely monitor exfiltration of files originating from high value SaaS applications accessed through the browser. You can also define specific domain collections to closely monitor upload activity to specific categories of upload destinations. For instance, to track files uploaded to social media, you can create a domain collection called social media and add domains like Facebook, Instagram, Twitter, and so on. Similarly, you create a collection for known and sanctioned upload destinations that are safe to upload to so you can ignore from your monitoring policies or monitor upload of items originating from such domains. While creating a policy, you can directly add the collection to be monitored. All the domains in the collection will be monitored.

You can create a domain by either manually entering all the domain URLs manually or by uploading a comma delimited list of domains in a text file.

To group domains:

1. Log in to the Nightfall app.

2. Navigate to Integrations from the left menu.

1. Click Manage on the macOS integration.

1. Click the Domains tab.

1. Click + New Collection.

You can either add the domains manually or upload a text file containing the list of domains. The following section has two tabs. The first explains the process of manually adding domains and the second tab explains adding domains by uploading a file.

Creating Policy

The detailed steps to configure the MAC device Exfiltration policy is explained in the following documents.

This stage allows you to select the notifications channels. If Nightfall detects sensitive data in any of the selected upload channels, the notifications are sent to the recipients configured in this section.

Admin Alerting

This section allows you to send notifications to Nightfall users. The various alert methods are as follows. You must first turn on the toggle switch to use an alert method.

The steps to configure alert channels for policy-level integration are the same as in the case of integration-level alerts. You can refer to this document for steps.

In this stage, you select the Integration for which the policy is created. In this case, Google Drive integration must be selected.

1. Click Policies from the left menu.

1. Click + New Policy.

1. Select Exfiltration.

1. Select the Google Drive integration.

Nightfall Exfiltration prevention for Salesforce allows you to configure alerts at the policy level and also at the integration level. Alerts can be sent in Salesforce by using the following alert channels.

• Slack

• Email

• Webhook

• Jira Tickets

When you configure alert settings at the integration level, the alert settings apply to all the policies, created for the Salesforce integration. However, when you configure alert settings specifically for a policy, which is created in the Salesforce integration, the alert settings are applicable only for that specific policy.

This document explains how to configure alerts at the integration level. To learn about how to configure alerts at the policy level, read this document.

Prerequisites

• To use Slack as an alert platform, you must first perform the required Slack configurations. You can refer to this document to learn more about how to configure Slack as an Alert platform.

• To use Webhook as an alert platform, you must first perform the required Webhook configurations. You can refer to this document to learn more about how to configure Webhook as an Alert platform.

• To use JIRA as an alert platform, you must have the DLP for the JIRA app installed from the Atlassian Marketplace. You can read more about the DLP for JIRA integration here.

Configure Alerts at the Integration Level

You can configure alerts at the integration level once you have installed the Nightfall for Salesforce integration.

To configure alerts at the integration level:

1. Navigate to the Salesforce integration

2. Scroll down to the Alerting section.

3. You can configure one or multiple alert channels.

Configuring Slack as an Alert Channel

1. To configure Slack as an alert channel, click + Slack channel.

1. In the Slack alert channel field, enter the name of the Slack channel in which you wish to receive the alerts.

2. Click Save.

A confirmation pop-up box is displayed to confirm if the Slack channel (entered in the second step) must be used only for Salesforce integration or all the Nightfall integrations.

1. Select No, only integration level to use the Slack channel only for Salesforce, or select Yes, please to use the selected Slack channel for all the Nightfall integrations.

Configuring Email as an Alert Channel

1. Click + Email.

1. Enter the Email ID of the recipient who should receive the notifications.

2. Click Save.

A confirmation pop-up box is displayed to confirm if the Email ID (entered in the second step) must be used only for Salesforce integration or all the Nightfall integrations.

1. Select No, only integration level to use the Slack channel only for Salesforce, or select Yes, please to use the selected Slack channel for all the Nightfall integrations.

Configuring Webhook as an Alert Channel

1. Click + Webhook.

2. Enter the Webhook URL.

3. Click Test. If the test result is not successful, check the Webhook URL.

4. (Optional) Click Add Header to add headers.

5. Click Save.

{
  "service": "nightfall",
  "test": true,
  "timestamp": "2024-03-07T23:18:39Z"
}

Configuring JIRA as an Alert Channel

1. Click + Jira Ticket.

2. Select a JIRA project from the Jira Project drop-down menu.

3. Select an issue type from the Issue Type drop-down menu.

4. (Optional) Add comments to be added in the JIRA ticket.

5. Click Save changes.

A confirmation pop-up box is displayed to confirm if the JIRA settings configured for the Salesforce integration must be applied to all the other Nightfall integrations too.

1. Select No, only integration level to use the configurations only for Salesforce, or select Yes, please to use the selected JIRA configurations for all the Nightfall integrations.

Configure End-User Notification

When a Violation occurs, Nightfall sends a notification to the end-user whose actions triggered the violation. While notifying the end-user, Nightfall also sends a text message. You can draft the text message to be sent to the end-user. This message applies to all the policies. Click Save changes once done.

Once you zero down the policy Scope to the required devices and originating domains, you must now define the trigger actions that can be termed as exfiltration events.

Nightfall provides you two types of triggers that you can set as exfiltration events.

• Browser Uploads: In this section, if an asset is uploaded through a browser to an online portal (for example social media website), you can define such events as exfiltration events.

• Cloud Syncing: In this section, if an asset is uploaded to an online cloud store application (for example Google Drive), you can define such events as exfiltration events.

The steps to use the above triggers are elaborated in the following sections.

Browser Uploads

Ensure that you have configured domain collections before using the use the browser uploads option.

To monitor browser uploads:

1. Select the Browser uploads to option.

1. Select one of the following options.

• Any Domain: If you select this option, Nightfall monitors your uploads done to any domain on the Internet.

• Domain in: If you select this option, you must additionally also select the domain collections, created in the domain collections section. Nightfall monitors the uploads done to all the domains that belong to the selected domain collections.

Once you select a domain collection, it is displayed on the screen and greyed out from the drop-down menu. You can use the drop-down menu to select additional domain collections.

• Domain Not in: If you select this option, you must additionally also select the domain collections, created in the domain collections section. Nightfall does not monitor the uploads done to all the domains that belong to the selected domain collections.

Once you select a domain collection, it is displayed on the screen and greyed out from the drop-down menu. You can use the drop-down menu to select additional domain collections.

Cloud Sync app Uploads

In this option, you can either choose to monitor uploads done to every cloud sync app or select specific cloud sync apps to which the uploads must be monitored.

1. Select the Cloud Syncing to option.

1. Select one of the following options.

• Any Storage Apps: If you select this option, Nightfall monitors the uploads done to every cloud sync storage applications.

• Specific Storage App(s): If you select this option, you must additionally select the storage apps. Nightfall monitors the uploads done to the selected storage apps.

Once you select a cloud storage application, it is displayed on the screen and greyed out from the drop-down menu. You can use the drop-down menu to select additional cloud storage apps.

Nightfall for macOS allows you to configure alerts at the policy level and also at the integration level. Alerts can be sent in macOS policies by using the following alert channels.

• Slack

• Email

• Webhook

• Jira Tickets

When you configure alert settings at the integration level, the alert settings apply to all the policies, created for the macOS integration. However, when you configure alert settings specifically for a policy, which is created in the macOS integration, the alert settings are applicable only for that specific policy.

This document explains how to configure alerts at the integration level. To learn about how to configure alerts at the policy level, read this document.

Prerequisites

• To use Slack as an alert platform, you must first perform the required Slack configurations. You can refer to this document to learn more about how to configure Slack as an Alert platform.

• To use Webhook as an alert platform, you must first perform the required Webhook configurations. You can refer to this document to learn more about how to configure Webhook as an Alert platform.

• To use JIRA as an alert platform, you must have the DLP for the JIRA app installed from the Atlassian Marketplace. You can read more about the DLP for JIRA integration here.

Configure Alerts at the Integration Level

You can configure alerts at the integration level once you have installed the Nightfall for macOS integration.

To configure alerts at the integration level:

1. Navigate to the macOS integration

2. Scroll down to the Alerting section.

3. You can configure one or multiple alert channels.

Configuring Slack as an Alert Channel

1. To configure Slack as an alert channel, click + Slack channel.

1. In the Slack alert channel field, enter the name of the Slack channel in which you wish to receive the alerts.

2. Click Save.

A confirmation pop-up box is displayed to confirm if the Slack channel (entered in the second step) must be used only for macOS integration or all the Nightfall integrations.

1. Select No, only integration level to use the Slack channel only for macOS, or select Yes, please to use the selected Slack channel for all the Nightfall integrations.

Configuring Email as an Alert Channel

1. Click + Email.

1. Enter the Email ID of the recipient who should receive the notifications.

2. Click Save.

A confirmation pop-up box is displayed to confirm if the Email ID (entered in the second step) must be used only for macOS integration or all the Nightfall integrations.

1. Select No, only integration level to use the Slack channel only for macOS, or select Yes, please to use the selected Slack channel for all the Nightfall integrations.

Configuring Webhook as an Alert Channel

1. Click + Webhook.

2. Enter the Webhook URL.

3. Click Test. If the test result is not successful, check the Webhook URL.

4. (Optional) Click Add Header to add headers.

5. Click Save.

{
  "service": "nightfall",
  "test": true,
  "timestamp": "2024-03-07T23:18:39Z"
}

Configuring JIRA as an Alert Channel

1. Click + Jira Ticket.

2. Select a JIRA project from the Jira Project drop-down menu.

3. Select an issue type from the Issue Type drop-down menu.

4. (Optional) Add comments to be added in the JIRA ticket.

5. Click Save changes.

A confirmation pop-up box is displayed to confirm if the JIRA settings configured for the macOS integration must be applied to all the other Nightfall integrations too.

1. Select No, only integration level to use the configurations only for macOS, or select Yes, please to use the selected JIRA configurations for all the Nightfall integrations.

Configure End-User Notifications

When a Violation occurs, Nightfall sends a notification to the end-user whose actions triggered the violation. While notifying the end-user, Nightfall also sends a text message. You can draft the text message to be sent to the end-user. This message applies to all the policies. Click Save changes once done.

This stage allows you to select automated notification channels or actions if a policy violation occurs.

Admin Alerting

This section allows you to send notifications to Nightfall users. The various alert methods are as follows. You must first turn on the toggle switch to use an alert method.

The steps to configure alert channels for policy-level integration are the same as in the case of integration-level alerts. You can refer to the #configure-alerts-at-the-integration-level document.

Automated Actions

Automated actions allow you to configure automated remediation actions when an exfiltration attempt is detected by Nightfall policy. Nightfall supports the following automated actions for Salesforce. You can choose to implement the automated action immediately after detecting a download attempt or after some time.

To enable the automated action, you must turn on the respective toggle switch.

Freeze Salesforce User Account

This action logs out the user from the Salesforce account. They cannot login until a Salesforce admin revokes the freeze on the account.

You must now select when exactly after detecting the event, the action must be triggered. if you select the Immediately option, the automated action is triggered immediately after the download attempt is made.

If you select the After option, you must select the time gap after which the automated action must be implemented.

Revoke User Permissions

This action revokes the permissions of the user. The user can now only view data across al Salesforce pages. They cannot download any data. This action assigns the user Salesforce's minimum access profile. You can learn more about this profile from this Salesforce document.

You must now select when exactly after detecting the event, the action must be triggered. if you select the Immediately option, the automated action is triggered immediately after the download attempt is made.

If you select the After option, you must select the time gap after which the automated action must be implemented.

End-User Notification

This section allows you to configure notifications to be sent to the end user whose actions triggered the violation.

Custom Message

Enter a custom message to be sent to the end user. This message is sent in an Email. You can modify the default message provided by Nightfall and draft your message. The total character length allowed is 1000 characters. You can also add hyperlinks in the custom message. The syntax is <link | text >. For example, to hyperlink www.nightfall.ai with the text Nightfall website, you must write <www.nightfall.ai|Nightfall website>.

Automation

The automation settings allow you to send notifications to end users. You can select one or both the notification methods. You must first turn on the toggle switch to use the automation option. The automation notification channels are as follows

• Email: This option sends an Email to the user who attempted the download.

• Slack: This option sends a Slack message to the user who attempted the download.

End-User Remediation

End-user remediation (also known as Human Firewall) allows you to configure remediation measures that end users can take, when a violation is detected on by their download attempt. You must turn on the toggle switch to use this option. End-users receive the remediation actions in an Email as an action item. The various available remediation actions for end-users are as follows.

• Report as False Positive with Business Justification: This option allows end users to report false positive alerts and provide a business justification as to why the alert is considered to be false positive.

When end-users report alerts as false positive, you can choose the resolution method to be either Automatic or manual.

If end-users do not take any remediation action, you can set the frequency at which they must receive the notifications to take action.

The Trigger section in Salesforce policies allows you to define the frequency of action that must be considered as an exfiltration event. In case of Salesforce policies, the download frequency is the trigger.

The download frequency can be defined as the number of downloads over a period to time. This allows you to set custom thresholds in terms of number of downloads over a specific period of time and can be useful to identify anomalous download patterns for specific locations, users or content type. This can be set in combination to other scoping capabilities.

Configuring Triggers

In the Actions section, you can define the download action that must be considered as a potential exfiltration attempt by Nightfall. Nightfall allows you to set the frequency of downloads as the action.

To configure Actions:

1. Click the minimum number of files that must be the download threshold.

1. Set the time period within which the minimum no. of downloads must be considered as exfiltration event.

In the following case, an exfiltration event is created if, there are 2 or more downloads within a minute.

In this stage, you select the Integration for which the policy is created. In this case, Salesforce integration must be selected.

1. Click Policies from the left menu.

1. Click + New Policy.

1. Select Exfiltration.

1. Select the Salesforce integration.

Exfiltration policies allow you to monitor download events across your Salesforce environment. Through real-time download monitoring, you can identify insider risk and anomalous behaviour before it escalates to large scale security incidents. The following are supported and monitored by Nightfall for exfiltration activities,

• Attachments & Files

• Reports

• Records & Objects

Download of any of the above information containers is an exfiltration activity for Nightfall, and if such activities breach a threshold set in one of the exfiltration policies in Nightfall, then Nightfall will flag it an exfiltration event. You can configure which users should receive notifications and what automatic actions must be taken when an exfiltration event is detected.

The detailed steps to configure the Salesforce Exfiltration policy is explained in the following documents.

Integration

Scope

Trigger

Advanced Settings

Creating Policy

Remediation for Salesforce Exfiltration

In this final stage, you assign a name to the policy, verify your configurations, and create the policy.

1. Enter a name for the policy.

2. (Optional) Enter a description for the policy.

3. Click Next.

1. Verify if all the policy configurations are set up as per your requirements.

2. (Optional) Click back or click on any specific stage to modify any of the policy configurations.

3. Click Submit.

In this final stage, you assign a name to the policy, verify your configurations, and create the policy.

1. Enter a name for the policy.

2. (Optional) Enter a description for the policy.

3. Click Next.

1. Verify if all the policy configurations are set up as per your requirements.

2. (Optional) Click back or click on any specific stage to modify any of the policy configurations.

3. Click Submit.

This document explains what admins and end-users can do once a policy is violated.

Admin Notification and Remediation

When end-users violate a policy, the Nightfall admin is notified about the incident. The notification channel used to notify the Nightfall admin depends on the settings configured in the #admin-alerting section. If you have not enabled any notification channels in the Admin alerting section, Nightfall admins are not notified.

If you have enabled the email notification in the Admin alerts section, Nightfall admins receive an email. The email is as shown in the following image.

The Email consists of the following data.

• Event: The event that caused the violation. For Salesforce, the event is always download of assets.

• Who: The Email ID of the user who downloaded the file.

• When: The date and time when the email was downloaded.

• What: The name of the file that was downloaded.

• Policies Violated: The name of the policy that was violated.

• Violation Dashboard: The link to the Events screen to view the violation in detail.

• Actions: The list of actions that the Nightfall admin can take.

Also, a Slack message is sent if you have enabled the Slack alerts for the Nightfall admin.

End-User Notification and Remediation

End-users receive notifications and remediation actions if the Nightfall admin has enabled these settings. The notifications are based on the settings configured in the #automation section. The end-user remediation actions are based on the settings configured in the #end-user-remediation section.

If you have configured the Email notification for end-users and enabled the end-user remediation, end-users can take remediation actions from the Email itself. The end-user Email is shown in the following image.

If you have configured Slack notifications for end-user and enabled end-user remediation, end-users also get a message in the respective Slack channel configured.

Manage Violations in Nightfall

To manage violations in the Nightfall console:

1. Click Events from the left menu.

1. Click the Exfiltration tab.

The Exfiltration Events page lists all the exfiltration events. To view events specific to the Salesforce integration:

1. Click Filters and select + Add Filter.

1. Select Integration in the Select a filter field.

1. Select the Salesforce check box in the Select an option field.

1. Click Apply.

Now, only the Salesforce events are displayed.

1. To view events with specific statuses, you can click the respective tabs.

To view historic events, click the Time filter and select the required time period.

You can click an event to view the details. The detail view window is as follows.

The detail view window consists of the following tabs.

• Summary: The Summary tab displays highlights of the event like the name of the downloaded asset, the name of the violated policy, and the email ID of the user who violated the policy.

• Asset: The asset tab displays the details of the asset. You can view details like name of the downloaded asset, size of the downloaded asset, exfiltration action (download), owner's Salesforce ID and IP address. If there are multiple assets in a single violation, you can choose which asset's details must be displayed.

• Actor: The actor tab displays the email ID of the Salesforce user who downloaded the asset. You can add notes on this tab which is displayed in the Admin notes section.

Taking Actions on the Events Page

The events list view displays an ellipsis menu at the extreme right corner. Admins can click this menu to take appropriate action on an exfiltration event.

The various available actions are explained as follows.

• Acknowledge: This action can be taken when you just wish to acknowledge that you have viewed the violation.

• Notify Email: This action sends an email notification to the end-user who caused the violation.

• Notify Slack: This action sends a Slack notification to the end-user who caused the violation.

• Ignore: This action ignored the violation. You can take this action when an event is false positive.

• Freeze User: This action freezes the user account and logs them out of Salesforce. Users cannot login until admin unfreezes their account.

• Revoke User Permission: This permission revokes the user's download privileges. Users can only view data in Salesforce. This action assigns the Salesforce's Minimum access profile to the user. You can learn more about this profile from this Salesforce document.

• Unfreeze User: Once you freeze a user, this action is active. You can unfreeze a freezed user with this action.

Once the action is implemented, the status of the event changes respectively. By default, an event can have one of the following two statuses.

• Active: The event has been generated but no action has been taken.

• Input Requested: A notification has been sent to the end-user requesting their response.

The Scope section determines which areas of Nightfall needs to be monitored by Nightfall for Exfiltration. You can choose one or all of the following data types to be monitored.

• Attachments & Files

• Reports

• Records & Objects

After you make the required selection, you can also add filters to monitor specific Salesforce users or Salesforce profiles.

Data Types

In the Data Types section, you must select the Salesforce data types to be monitored. By default, all the three data types are selected. You can choose to either retain all the three data types or clear any of the data types.

Filters

The Filters section allows you to add additional filters, on top of the selected data types, to narrow down the monitoring scope. Nightfall provides the following two types of filters.

Internal Users

You can choose specific Salesforce users whose activities need to be monitored or excluded from being monitored. Nightfall populates the list of all your users from Salesforce. You need to select either the users whose activities need to be monitored or the users whose activities need to be excluded from monitoring.

To add Users filter, click Add Filter and select Internal Users.

To monitor specific users, select the Monitor specific option. To exclude specific users from being monitored, select the Monitor all, except option.

Nightfall populates the list of Salesforce users in the Search users field. You can select the all the required users.

Salesforce Profiles

You can choose specific Salesforce profiles whose activities need to be monitored or excluded from being monitored. Nightfall populates the list of all your Salesforce profiles. You need to select either the profiles whose activities need to be monitored or the profiles whose activities need to be excluded from monitoring.

To monitor specific Salesforce profiles, select the Monitor specific option. To exclude specific Salesforce profiles from being monitored, select the Monitor all, except option.

Nightfall populates the list of Salesforce profiles in the Search profiles field. You can select the all the required users.

Example Scenario

Contoso Ltd. uses Salesforce to host their applications. They have three users Steve, Rick, and Matt in their Salesforce org. These users are not Contoso employees. They are employees of Acme corp. which is a prospective customer of Contoso Ltd. Steve, Rick, and Matt are evaluating Constoso's app so that they can check if it meets Acme corp's requirements. Contoso has created a Salesforce profile called Prospective customers and added these three users to this profile

Contoso Ltd. uses Nightfall Salesforce exfiltration and wishes to check if any files with sensitive data is downloaded by any of these three users. They create a Salesforce exfiltration policy to monitor all the data types. They can choose one of the following filter.

Nightfall Exfiltration for Salesforce helps you to keep tab of the exfiltration activities in your Salesforce orgs. Nightfall leverages Salesforce Shield Real Time Event Monitoring for exfiltration activities across your Salesforce orgs and identifies activities which are in violation to configured policies.

Download of attachments, files, reports and bulk download of objects are all exfiltration event recognised by Nightfall. You can configure policies to set appropriate thresholds for such events and identify them as unwarranted that may require scrutiny. You may configure the policy to alert the stakeholders who need to be notified and choose one of the available actions to be invoked automatically. You may also choose not to configure automated actions but only act after evaluating the specific exfiltration events.

Prerequisites

Nightfall exfiltration leverages Salesforce Shield's Event Monitoring to identify exfiltration events. Salesforce Shield provides multiple security tools to safeguard your Salesforce orgs. Nightfall depends on in Salesforce Shield which is available as an independent module within . You must enable the following Event Monitoring settings for all the Salesforce orgs that you wish to monitor,

• Generate event log files - Generate an event log file when events occur in your org.

• Enable Lightning Logger Events - Enable collection of Lightning Logger Events in custom components.

• Enable the following events for storage and streaming

  • Bulk API Result Event - Track when a user downloads the results of a Bulk API request

  • File Event - Track file activity. For example, track when a user downloads or previews a file

  • Report Event - Track when a user accesses or exports data with reports

  • SessionHijacking Event - Track when an unauthorised user gains ownership of a Salesforce user’s session with a stolen session identifier

You can learn more about Salesforce Shield and once enabled, advance to the next steps with

If you have already onboarded your Salesforce org to Nightfall platform, please ensure you have the latest Nightfall DLP package deployed in your Salesforce org. Follow the steps mentioned in to upgrade it to the latest version.

Installation Doc Links

The installation procedure remains the same as in case of Salesforce DLP for sensitive data. The links to the installation and upgradation documents are as follows.