Automated Actions

This section describes the various actions that Nightfall takes automatically when a violation is detected. You must turn on the toggle switch to enable an action. You can also set the timeline as to when an action must be taken (immediately after detecting a violation or after some time).

Currently, Nightfall supports the Delete, Quarantine, and Redact automated actions for the Slack enterprise edition. The three actions are mutually exclusive. You can only configure one of the three actions in a policy.

You must first turn on the toggle switch to enable any of the automated actions.

Once you enable the toggle switch, you can configure when the action must be applied.

If you select immediately, the action is implemented automatically after the sensitive data is detected.

If you select After, you must also set the time frame as to when exactly the action must be applied, after detecting the sensitive data.

The available actions are described as follows.

Delete

The delete action automatically deletes the message or attachment that has sensitive data. This is a permanent action and cannot be reverted.

Redact

The Redact action replaces the sensitive data with an asterisk, except for the first two characters. This is a permanent action and cannot be reverted.

Quarantine

The Quarantine action temporarily removes files or messages from the original Slack channel and places them in a quarantined Nightfall Slack channel for further review. When a Slack message is Quarantined, Slack Workspace administrator can take one review the Quarantined messages and take one of the following actions:

• Accept: If the Slack Workspace administrator is confident that the quarantined message does not contain any sensitive data, they can Accept the message. Accepted messages are sent to the intended recipients.

• Reject: If the Slack Workspace administrator is confident that the quarantined message contains sensitive data, they can Reject the message. Rejectected Slack messages are not sent to the intended recipients.