Links

Nightfall DLP Salesforce Webhook Alerts

Nightfall supports sending alerting information to webhooks, which allow for programmatic handling of the data contained within the alert. For more information about how web hooks work in Nightfall, see our developer documentation on web hooks.
To configure Nightfall Salesforce DLP to use a webhook, you must provide the webhook URL in the Settings section of the Salesforce integration.
Click on the “+ Webhook” button at the bottom of the alerting section and enter the address of your webhook into the modal window that appears.

Violation Notification

The following payload will be sent to the designated webhook when a violation has been detected.
It provides information about the Detection Rule that was violated (detectionRulesViolated) and where the violation was found (via the objectName and fields properties).
Remediation actions can be taken via the acknowledgeLink, redactFindingsLink, and the deleteRecordLink properties.
{
"detectionRulesLink": "https://app.nightfall.ai/?intendedRoute=detection-engine/detection-rules",
"detectionRulesViolated": "SSN DR",
"eventType": "violation",
"message": "Policy violation detected in Salesforce",
"policiesLink": "https://app.nightfall.ai/?intendedRoute=salesforce/?policyUUID%5B%5D=cfa52d83-76d4-4840-a260-15e535c740a6",
"policiesViolated": "Account",
"service": "Salesforce",
"timestamp": "2022-06-22T06:34:30Z",
"violationID": "CRY7XI",
"violationMetadata": {
"acknowledgeLink": "https://app.nightfall.ai/?intendedRoute=salesforce/remediation/082c0eb5-df1c-46cb-b8c2-f649747c9020/CRY7XI/acknowledge",
"deleteRecordLink": "https://app.nightfall.ai/?intendedRoute=salesforce/remediation/082c0eb5-df1c-46cb-b8c2-f649747c9020/CRY7XI/delete",
"event": "Record Updation",
"fields": "description",
"findingSnippets": [
"SSN: 55*********."
],
"findings": "US social security number (SSN) (1 Very Likely)",
"objectName": "Case",
"orgName": "NightfallProdDemo",
"orgType": "Sandbox",
"recordID": "5008K000000yP86QAE",
"recordLink": "https://prodnfdlpdemo--fullsandbo.sandbox.my.salesforce.com/5008K000000yP86QAE",
"redactFindingsLink": "https://app.nightfall.ai/?intendedRoute=salesforce/remediation/082c0eb5-df1c-46cb-b8c2-f649747c9020/CRY7XI/redact",
"who": "Mohit Mangnani",
"whoLink": "https://prodnfdlpdemo--fullsandbo.sandbox.my.salesforce.com/0058a00000KgiirAAB"
},
"violationTime": "22 Jun 2022 at 6:34AM UTC"
}

Manual Remediation Notification

The following payload will be sent to the designated webhook when a manual remediation is performed for a violation, which indicates which fields have been modified on a given object.
{
"eventType": "remediation",
"message": "[email protected] deleted finding(s).",
"remediationMetadata": {
"ActionUser": "[email protected]",
"actionType": "delete",
"fields": "description",
"objectName": "Case",
"remediationType": "manual",
"success": true,
"unchangedFields": ""
},
"remediationTime": "22 Jun 2022 at 6:38AM UTC",
"service": "Salesforce",
"timestamp": "2022-06-22T06:38:07Z",
"violationID": "CRY7XI"
}

Automated Remediation Notification

The following payload will be sent to the designated webhook when Nightfall automatically remediates a violation, which indicates which fields have been modified on a given object.
{
"eventType": "remediation",
"message": "Automatically remediated finding(s) via an automated action configured on your Nightfall dashboard.",
"remediationMetadata": {
"ActionUser": "",
"actionType": "",
"fields": "description",
"objectName": "Case",
"remediationType": "automated",
"success": true,
"unchangedFields": ""
},
"remediationTime": "22 Jun 2022 at 6:40AM UTC",
"service": "Salesforce",
"timestamp": "2022-06-22T06:40:04Z",
"violationID": "JVXIZS"
}