Configuring Policies
The Exfiltration policies for MAC allow you to monitor if there are any uploads via browser or cloud storage apps. You can configure the domains in Internet that needs to be monitored and also the cloud storage apps which need to be monitored.
When there are any uploads to the configured domain or cloud storage apps, the Nightfall AI agent notifies this action. You can configure the notification channels through which you wish to receive notifications when there is an attempt to upload files/folders.
Verify Connection
Once you have completed the installation of Nightfall agent, you must ensure that the connection is live. If the Nightfall agent cannot connect to the macOS device for more than 6 hours, the connection is closed. When the connection is live, a Connected message is displayed. If the connection is lost, Disconnected message is displayed.
Create Domain Collections
Before configuring domains in policies, you must create a domain collection. A domain. collection is a group of similar domains that need to be monitored. For instance, to track files uploaded to social media, you can create a domain collection called social media and add domains like Facebook, Instagram, Twitter, and so on. While creating a policy, you can directly add the social media collection to be monitored. All the domains in the collection are selected for monitoring.
To group domains:
Log in to the Nightfall app.
Navigate to My Integrations > Endpoint.
Click the Domains tab.
Click + New Collection.
Enter a name for the collection in the Collection Name field.
Click + Add Domain.
Enter a domain and hit the enter key.
(Optional) Click + Add Domain to add multiple domains to the collection.
(Optional) Click the delete icon to delete a domain
Click Save Changes.
Creating Policy
The detailed steps to configure the MAC device Exfiltration policy is explained in the following documents.
Last updated
