Data exfiltration, also known as data theft, data exportation, or data extrusion, is the unauthorized transfer of data from a device or network. It can occur as part of an automated attack or can be performed manually. The illegitimate transfer of data often looks very similar to legitimate transfers, making it difficult to detect.

Common Techniques for Data Exfiltration

Data exfiltration can occur in various ways and through multiple attack methods. Here are some of the most commonly used techniques:

• Social Engineering and Phishing Attacks: These attacks trick victims into downloading malware and giving up their account credentials.

• Outbound Emails: Cyber criminals employees or intruders use email to exfiltrate any data that sits on organizations’ outbound email systems.

• Downloads to Insecure Devices: Data is transferred by users from secure, trusted systems to an insecure device. From there, the attacker can infiltrate the device and exfiltrate the data.

• Uploads to Cloud Storage: Data can be exfiltrated from cloud storage when data is uploaded to insecure or misconfigured resources.

Nightfall provides a highly revolutionised solution to data exfiltration. Nightfall AI's exfiltration prevention capabilities easily integrate with existing tools, thus catering to security teams and companies across industries. Nightfall's exfiltration solution is much more than just a tool; it proactively protects against data breaches, providing tangible benefits for organizations striving to secure their sensitive information.

Data exfiltration, also known as data theft, data exportation, or data extrusion, is the unauthorized transfer of data from a device or network. It can occur as part of an automated attack or can be performed manually. The illegitimate transfer of data often looks very similar to legitimate transfers, making it difficult to detect.

Data exfiltration can occur in various ways and through multiple attack methods. Here are some of the most commonly used techniques:

• Social Engineering and Phishing Attacks: These attacks trick victims into downloading malware and giving up their account credentials.

• Outbound Emails: Cyber criminals employees or intruders use email to exfiltrate any data that sits on organizations’ outbound email systems.

• Downloads to Insecure Devices: Data is transferred by users from secure, trusted systems to an insecure device. From there, the attacker can infiltrate the device and exfiltrate the data.

Nightfall provides a highly revolutionised solution to data exfiltration. Nightfall AI's exfiltration prevention capabilities easily integrate with existing tools, thus catering to security teams and companies across industries. Nightfall's exfiltration solution is much more than just a tool; it proactively protects against data breaches, providing tangible benefits for organizations striving to secure their sensitive information.

Exfiltration policies allow you to monitor download events across your Google Drive environment. Through real-time download monitoring, you can identify insider risk and anomalous behaviour before it escalates to large scale security incidents. You can monitor download activity for specific users or user groups, specific drives containing valuable sensitive assets, or downloads of any files containing sensitive data types as discovered and classified by Nightfall's ML/AI based detectors.

You can set up your policies to monitor only, to educate users in real-time about your download and data governance policies, or to automatically suspend user access to the Google Workspace to enforce zero tolerance policies.

The detailed steps to configure the Google Drive Exfiltration policy is explained in the following documents.

Google Drive App Selection

Trigger

Automated Actions

Creating Policy

Remediation for Google Drive Exfiltration

In this stage, you select the Integration for which the policy is created. In this case, Google Drive integration must be selected.

1. Click Policies from the left menu.

2. Click + New Policy.

3. Select Exfiltration.

4. Select Endpoint.

In this option, you can either choose to monitor uploads done to every cloud sync app or select specific cloud sync apps to which the uploads must be monitored.

1. Select the Cloud Syncing option.

2. Select one of the following options.

• Any Storage Apps: If you select this option, Nightfall monitors the uploads done to every cloud sync storage application.

• Specific Storage App(s): If you select this option, you must additionally select the storage apps. Nightfall monitors the uploads done to the selected storage apps.

Once you select a cloud storage application from the drop-down menu, the selected option is displayed on the screen and grayed out from the drop-down menu. You can use the drop-down menu to select additional cloud storage apps.

Intercepts documents sent to the print queue before they reach a physical or virtual printer. Nightfall evaluates the document at the OS print subsystem level (CUPS on macOS).

Domain collections are not used for this trigger. Monitoring scope is configured by printer selection directly on the policy.

Platform note: Printer monitoring is supported on macOS only. Windows support is not yet available.

Scope options

• All printers connected to the endpoint.

• Specific printers by name or type

Common use cases

• Prevent printing of customer records, payroll data, or legal documents on unmanaged or shared printers.

• Block printing to fax-to-email or cloud print services running on the endpoint.

Policy recommendations

• Always include virtual printers in scope.

• Scope block actions to all printers except approved print server destinations in environments with dedicated secure print rooms.

• Deploy alongside Removable Media policies for full physical exfiltration coverage.

• Note: Native "Save to PDF" or "Print to PDF" bypasses the print monitoring and blocking capability. However, if the PDF is subsequently exfiltrated, Nightfall does monitor and block this.

The advanced settings pages allows you to configure notifications for Nightfall admins and end-users. Additionally, you can also configure automated actions. The various configurations available in the advanced settings pages are described in the following sections.

• Admin Alerting

• Automated Actions

• End-User Notifications

In this final stage, you assign a name to the policy, verify your configurations, and create the policy.

1. Enter a name for the policy.

2. (Optional) Enter a description for the policy.

3. Click Next.

4. Verify if all the policy configurations are set up as per your requirements.

5. (Optional) Click back or click on any specific stage to modify any of the policy configurations.

6. Click Submit.

In this stage, you select the Integration for which the policy is created. In this case, Google Drive integration must be selected.

1. Click Policies from the left menu.

1. Click + New Policy.

1. Select Exfiltration.

1. Select the Google Drive integration.

In this final stage, you assign a name to the policy, verify your configurations, and create the policy.

1. Enter a name for the policy.

2. (Optional) Enter a description for the policy.

3. Click Next.

1. Verify if all the policy configurations are set up as per your requirements.

2. (Optional) Click back or click on any specific stage to modify any of the policy configurations.

3. Click Submit.

Nightfall supports exfiltration prevention in endpoint devices. The exfiltration prevention in endpoint devices prevents your organization's employees from exfiltrating data out of your organization. This feature is available for devices running on the macOS and Windows OS.

To monitor each device for exfiltration, you must first install the Nightfall agent on the devices that require monitoring. You can install the Nightfall agent either manually on each device. Alternatively, you can also use an MDM to install the agent. Once you install the Nightfall agent, you must create policies to start the monitoring. Nightfall monitors the devices as per the policy rules set.

You can learn about how to install the Nightfall AI agent for macOS/Windows OS and the process to create policies from the following links.

• Install Nightfall AI Agent for Mac

The Nightfall AI extension is commonly installed using MDM in one of two ways:

• macOS: Deployed with the Nightfall profile

• Windows: Deployed with the MSI

Some, however, utilize other methods of deployment. This section provides options available for those specific use-cases.

Ensure that you have configured domain collections before using the browser uploads option.

To monitor browser uploads:

1. Select the Browser uploads to option.

1. Select one of the following options.

• Any Domain: If you select this option, Nightfall monitors your uploads done to any domain on the Internet.

• Domain in: If you select this option, you must additionally also select the domain collections created in the section. Nightfall monitors the uploads done to all the domains that belong to the selected domain collections.

Once you select a domain collection, it is displayed on the screen and greyed out from the drop-down menu. You can use the drop-down menu to select additional domain collections.

• Domain Not in: If you select this option, you must additionally also select the domain collections created in the section. Nightfall does not monitor the uploads done to all the domains that belong to the selected domain collections.

Once you select a domain collection from the drop-down menu, it is displayed on the screen and grayed out from the drop-down menu. You can use the drop-down menu to select additional domain collections.

This stage allows you to select the notifications channels. If Nightfall detects sensitive data in any of the selected upload channels, the notifications are sent to the recipients configured in this section.

Admin Alerting

This section allows you to send notifications to Nightfall users. The various alert methods are as follows. You must first turn on the toggle switch to use an alert method.

The steps to configure alert channels for policy-level integration are the same as in the case of integration-level alerts. You can refer to this document for steps.

Exfiltration policies allow you to monitor download events across your Salesforce environment. Through real-time download monitoring, you can identify insider risk and anomalous behaviour before it escalates to large scale security incidents. The following are supported and monitored by Nightfall for exfiltration activities,

• Attachments & Files

• Reports

• Records & Objects

Download of any of the above information containers is an exfiltration activity for Nightfall, and if such activities breach a threshold set in one of the exfiltration policies in Nightfall, then Nightfall will flag it an exfiltration event. You can configure which users should receive notifications and what automatic actions must be taken when an exfiltration event is detected.

The detailed steps to configure the Salesforce Exfiltration policy is explained in the following documents.

In this stage, you select the Integration for which the policy is created. In this case, Salesforce integration must be selected.

1. Click Policies from the left menu.

1. Click + New Policy.

1. Select Exfiltration.

1. Select the Salesforce integration.

Nyx is Nightfall’s AI-powered DLP Copilot, designed to help you quickly investigate and understand exfiltration risks. She can surface patterns, summarize user activity, and suggest next steps — all through a simple natural-language conversation.

1. Click the Comet Icon: In the upper right corner of your Nightfall dashboard, click the comet icon to open Nyx.

2. Start Conversing: Type your question in plain English — no special syntax required.

The trigger section further enhances the unwanted noise reduction capabilities. With the trigger section, you can

• Set what download behavior can be termed as an exfiltration event.

• Exclude downloads by trusted apps from being termed as exfiltration events.

In the trigger section, you can set the download behavior, the download frequency to be precise, must be termed as an exfiltration event.

To configure the Trigger section:

• Mac with the Nightfall endpoint agent already installed

• Permission to install apps from the Mac App Store

1. Install from the Mac App Store. Open this link (the app is not searchable by name in the App Store):

Click through to the Mac App Store and install Nightfall DLP for Browsers.

2. Open Safari extension settings

1. Enroll devices in PDQ SimpleMDM

2. Create a Device Group with the respective macOS machines assigned to it

3. Download and unpack Nightfall's install package from the console:

Nightfall for Windows OS allows you to detect exfiltration events on your Windows OS devices. The Nightfall exfiltration feature can monitor any files being uploaded through supported cloud storage apps or browsers on Windows OS devices.

To use Nightfall for macOS, you must install the Nightfall AI agent. This agent monitors your Windows OS device continuously. You can install the agent either manually or through a Mobile device management (MDM) tool. You can request the Nightfall deployment bundle which contains the data required for your MDM deployment.

Nightfall supports the following agent installation methods for Windows:

1. You have the Device Administrator role in Rippling.

2. Target Windows devices have been onboarded into Rippling MDM.

3. On your Nightfall console, navigate to and click the Download Package button on the top right corner of the page. Click Download Package for Windows. A

1. Confirm that the Windows devices are enrolled and managed through Workspace ONE.

2. Confirm that a device group has been set up for deployment.

   • From UEM, navigate to Groups & Settings > Groups > Assignment Groups > click "+ Add Smart Group" and follow the prompts

In this option, you can choose to monitor the copy/paste actions performed by end-users. If end-users copy some data and paste it to unsanctioned locations.

Apart from text data, Nightfall can also detect non-text clipboard content, including images and screenshots. Clipboard Paste trigger uses the optical character recognition (OCR) technology in combination with Nightfall to prevent the exfiltration of sensitive data present in visuals like copied screenshots, scanned documents, or copied images from web browsers.

Use cases

• A typical example of this trigger can be a scenario in which an end-user copies an API key and pastes it in a prompt in ChatGPT/Deepseek or any other Gen AI apps while attempting to generate a piece of code.

• An employee attempting to capture a screenshot of dashboards, reports, or customer data from sensitive SaaS apps into unsanctioned destinations.

Intercepts data movement - file transfers, uploads, and paste events - within desktop applications. Nightfall monitors at the application layer, capturing events before they reach the network.

Supported applications

This section allows you to configure notifications to be sent to the end user whose actions triggered the violation.

Enter a custom message to be sent to the end user. This message is sent in an Email or a Slack message. You can modify the default message provided by Nightfall and draft your own. The total character length allowed is 1000 characters. You can also add hyperlinks in the custom message. The syntax is <link | text >. For example, to hyperlink https://www.nightfall.ai with the text Nightfall website, you must write < | Nightfall website>.

You can either select Email, Slack, or both as an automated notification method. You must turn the toggle switch to use this option. Based on the options selected, end-users receive notifications in their Email or Slack, based on the option(s) enabled.

End-User Remediation (also known as Human Firewall) allows you to configure remediation measures that end-users can take when an exfiltration event is triggered due to their actions. You must turn on the toggle switch to use this option. When you configure end-user remediation, the user whose actions triggered the exfiltration event receives a notification from Nightfall. This notification provides details of the user's actions that caused the exfiltration along with your custom message. End-users can take appropriate actions.

Nightfall supports the following remediation actions for end-users.

Nightfall Exfiltration for Salesforce helps you to keep tab of the exfiltration activities in your Salesforce orgs. Nightfall leverages Salesforce Shield Real Time Event Monitoring for exfiltration activities across your Salesforce orgs and identifies activities which are in violation to configured policies.

Download of attachments, files, reports and bulk download of objects are all exfiltration event recognised by Nightfall. You can configure policies to set appropriate thresholds for such events and identify them as unwarranted that may require scrutiny. You may configure the policy to alert the stakeholders who need to be notified and choose one of the available actions to be invoked automatically. You may also choose not to configure automated actions but only act after evaluating the specific exfiltration events.

Nightfall exfiltration leverages Salesforce Shield's Event Monitoring to identify exfiltration events. Salesforce Shield provides multiple security tools to safeguard your Salesforce orgs. Nightfall depends on in Salesforce Shield which is available as an independent module within . You must enable the following Event Monitoring settings for all the Salesforce orgs that you wish to monitor,

• Generate event log files - Generate an event log file when events occur in your org.

Prerequisites

Both of the following must be in place before AI Agent Security can function:

1. Nightfall endpoint agent v1.2.12.11+ installed and running on the endpoint. The hooks call the binary by name, so without the agent the hooks resolve to nothing.

2. MDM configuration profile v3+ deployed via your MDM provider (Jamf, Mosyle, Kandji, etc.)

3. MDM scope selected - the device group / Blueprint / Smart Group / assignment that will receive the deployment.

4. Claude Code is reasonably current on managed devices.

5. You have the three pieces from this package: the payload (payloads/nightfall-hooks.json) and the scripts for your platform (scripts/macos/ or scripts/windows/).

If the MDM profile has not been deployed, the agent will show a missing permissions error and you will not see any local or remote MCP servers across installed devices.

This stage allows you to select automated notification channels or actions if a policy violation occurs.

Admin Alerting

This section allows you to send notifications to Nightfall users. The various alert methods are as follows. You must first turn on the toggle switch to use an alert method.

The steps to configure alert channels for policy-level integration are the same as in the case of integration-level alerts. You can refer to this document for steps.

Automated Actions

Automated actions allow you to configure automated remediation actions when an exfiltration attempt is detected by Nightfall policy. Nightfall supports the following automated actions for Google Drive. You can choose to implement the automated action immediately after detecting a download attempt or after some time.

Suspend Account: This action suspends the user's account who tried to download files and triggered the exfiltration event.

To enable the automated action, you must turn on the respective toggle switch.

You must now select when exactly after detecting the event, the action must be triggered. if you select the Immediately option, the automated action is triggered immediately after the download attempt is made.

If you select the After option, you must select the time gap after which the automated action must be implemented.

This section allows you to configure notifications to be sent to the end user whose actions triggered the violation.

Enter a custom message to be sent to the end user. This message is sent in an Email. You can modify the default message provided by Nightfall and draft your message. The total character length allowed is 1000 characters. You can also add hyperlinks in the custom message. The syntax is <link | text >. For example, to hyperlink with the text Nightfall website, you must write <www.nightfall.ai|Nightfall website>.

The automation settings allow you to send notifications to end users. You can select one or both the notification methods. You must first turn on the toggle switch to use the automation option. The automation notification channels are as follows

• Email: This option sends an Email to the user who attempted the download.

• Slack: This option sends a Slack message to the user who attempted the download.

End-user remediation (also known as Human Firewall) allows you to configure remediation measures that end users can take, when a violation is detected on by their download attempt. You must turn on the toggle switch to use this option. End-users receive the remediation actions in an Email as an action item. The various available remediation actions for end-users are as follows.

• Report as False Positive with Business Justification: This option allows end users to report false positive alerts and provide a business justification as to why the alert is considered to be false positive.

When end-users report alerts as false positive, you can choose the resolution method to be either Automatic or manual.

If end-users do not take any remediation action, you can set the frequency at which they must receive the notifications to take action.

Nightfall for macOS allows you to detect exfiltration events on your macOS devices. The Nightfall exfiltration feature can monitor any files being uploaded through supported cloud storage apps or browsers on macOS devices.

To use Nightfall on macOS, you’ll need to install the Nightfall AI agent. You can install it manually for testing or evaluation purposes, or automate the install through MDM.

Nightfall supports the following agent installation methods for macOS:

• Manual Installation

• Nightfall macOS Agent Deployment: JAMF MDM

You can install the Nightfall AI macOS agent in stealth/hidden mode. Installing the agent in stealth mode allows you to hide visible UI elements once the Nightfall agent is installed. When you install the agent in silent mode, the Nightfall status bar icon. Additionally, the Nightfall application will not be visible in the Applications folder when viewed in Finder.

• Covert Monitoring: If an organization suspects an employee of exfiltrating sensitive data, they can install the agent in stealth mode to monitor the employee's asset without the employee's knowledge.

• Ensuring Bias-Free Compliance: An organization wishes to confirm if their employees are adhering to HIPAA/PCI compliances; they can install the agent in stealth mode without giving any indication to their employees (which can prompt a change in their behavior).

• Prevent User Distractions: Organizations that do not wish to distract their users about the agent presence and monitoring can depoy in stealth mode.

1. In the mdm_pre_installation_script.shfile, find the hide_status_iconflag.

2. Set the flag to true. By default, the flag is set to false⁣.

Nightfall employs the automatic endpoint update functionality. With this feature, Nightfall can deliver the majority of endpoint agent bug fixes and feature updates directly to endpoints.

Features:

• Stay Secure: Receive the latest security patches and updates promptly, reducing the risk of vulnerabilities being exploited.

• Remain Compatible: Keep your deployment compatible with the latest operating system updates and other software changes.

• Receive New Features: You get access to new features and improvements to exfiltration monitoring without manual intervention.

Overview

This document outlines the steps to manually deploy the Nightfall AI Agent on a Windows device.

Prerequisites

• Ensure that Windows endpoint has been enabled on your Nightfall tenant.

  • Download the Nightfall AI Agent NightfallAgent.msi file from Nightfall.

    • Download NightfallAgent.msi from to a local folder on the target machine

      • Integrations -> Endpoint Windows -> Manage -> Download Package -> Download Package For Windows

• Navigate to > Exfiltration > Endpoint - (optional)

1. Copy downloaded NightfallAgent.msi to a folder on a target machine.

2. Run the Installer:

   1. Launch CMD as an Administrator

b. Navigate to the folder where NightfallAgent.msi is downloaded to.

i. cd C:\\users\\<username>\\Downloads\\ update the above accordingly.

c. Copy the installation command from .

i. Note : this includes the necessary command line parameters for the agent to communicate with Nightfall

ii. Integrations -> Endpoint Windows -> Manage -> Download Package -> 'To install, run the command as admin.

d. Paste the msiexec installation command copied from the above step to cmd and press Enter key.

e. Installation should start in silent mode.

1. Verify Installation

   1. Once installation is complete, check if the agent is running:

      1. Open Task Manager (Ctrl + Shift + Esc).

b. Confirm the Nightfall agent is configured to your Nightfall tenant

i. On the windows machine:

1. Double-click the Nightfall agent icon in the status bar.

2. The displayed UUID should match your Nightfall tenant UUID located under

ii. On the Nightfall console:

1. The newly configured device should be listed under

The Nightfall AI Agent should now be successfully installed, running on your Windows machine, and connected to your Nightfall tenant. If you run into any issues, please contact Nightfall AI support.

A trigger defines the exfiltration medium - the specific channel or application through which data moves off a managed device. Each trigger represents a distinct interception point: a file upload in a browser, a sync client writing to disk, a document sent to the print queue, a file sent with AirDrop. Nightfall intercepts the event at that point, inspects the content against your detection rules if applicable, and applies the configured action.

You configure one trigger per policy. Each trigger is independently scoped - a browser upload policy and a thick app policy can cover the same domains without conflicting.

Domain Collections

A domain collection is a named, reusable set of domains used to scope trigger monitoring. Collections appear in two roles:

• Source collection - identifies domains associated with corporate account sessions or originating domains. Used to answer: did this data originate from a corporate account? Example: your company's Google Workspace domain (yourcompany.com on Google Drive).

• Destination collection - identifies domains associated with personal account sessions or destination domains. Used to answer: did this data go to a personal account? Example: gmail.com, dropbox.com, chatgpt.com accessed with a personal login.

Collections are created and managed separately from policies, then referenced when configuring data lineage and session detection on the Browser Upload and Clipboard Paste triggers. Not all domains in a collection support session detection - the policy UI shows coverage at configuration time (e.g., "3 of 12 domains across 2 collections support session detection"). Domains without session detection support are always monitored for all account types regardless of which collection they belong to.

You do not need to configure collections for Cloud Syncing, Removable Media, Printer, Thick App (desktop app), Git Push, CLI Transfer, AirDrop, or Bluetooth. Those triggers use application lists, tool lists, or no destination list.

Once you zero in on the policy to the required devices and originating domains, you must now define the trigger actions that can be termed as exfiltration events. Nightfall provides you with multiple types of triggers that you can set as exfiltration events.

Browser Uploads: If an asset is uploaded through a web browser or desktop app to any online destination (for example, a file attached to a ChatGPT prompt or uploaded to a personal Google Drive via the browser), you can define such events as file upload exfiltration events.

Cloud Syncing: If an asset is synced to a cloud storage application running on the endpoint (for example, a file written to a local Dropbox or OneDrive folder and automatically uploaded to the cloud), you can define such events as cloud sync exfiltration events.

Clipboard Paste: If data is copied from a source application and pasted into an external destination (for example, customer records copied from an internal tool and pasted into a personal email), you can define such events as clipboard paste exfiltration events.

Git Push: If source code is pushed from a managed endpoint to a non-approved remote repository (for example, a developer pushing proprietary code to a personal GitHub account), you can define such events as git push exfiltration events. This feature is designed to prevent accidental or intentional source-code exfiltration. Detection is based on source and destination metadata.

Removable Media: If an asset is transferred to a removable storage device connected to the endpoint (for example, a file copied to a USB flash drive or an external hard drive), you can define such events as external media transfer exfiltration events.

Printer: If a document is sent to the print queue on the endpoint (for example, a confidential report printed to a shared office printer or exported as a PDF using a virtual printer), you can define such events as print exfiltration events.

Desktop App: If data is transferred, uploaded, or pasted within a desktop application (for example, a file attached in WhatsApp or sensitive content pasted into a ChatGPT desktop app), you can define such events as exfiltration events.

CLI Transfer: If a file is uploaded or downloaded by a selected command-line tool on the endpoint (for example, scp of an export to a home machine, or curl / aws s3 of a secrets file), you can define that as a CLI Transfer exfiltration event. You choose the tools on the policy. This is not Git Push.

AirDrop: If a file is sent through Apple AirDrop from a managed Mac (for example, a spreadsheet sent to a personal iPhone), you can define that as an AirDrop exfiltration event. There is no recipient picker. Data Source and Data Destination do not apply.

Bluetooth: If a file is sent over Bluetooth from a managed endpoint (for example, a document sent to a personal phone), you can define that as a Bluetooth file-transfer exfiltration event. This is not pairing or audio. Nearby device details appear on the event, not as policy filters.

The steps to use the above triggers are elaborated in the following sections.

This section describes the various actions that Nightfall takes automatically when an exfiltration attempt is detected. This automated action is triggered when the condition set in the section is violated.

The automated actions supported by Nightfall are described as follows.

• Block Transfer

• Record Before & After (Session Replay)

Block Transfer

This action automatically blocks the process of file transfer thus preventing an exfiltration attempt. You can use this action to prevent the upload of files with sensitive data, to web browsers or cloud storage apps. You must enable the toggle switch to activate the automated action.

You can configure the section and the section such that you can leverage this feature to:

• Block transfer based on file origin: Block the upload of files downloaded from highly sensitive SaaS applications.

• Block transfer based on destination: Allow uploads only to sanctioned destinations.

• Combine origin and destination: Create powerful DLP policies that factor in both where files came from and where they are headed.

Some use cases scenarios in which you can use the automatic Block action, are as follows.

Employees access confidential reports from an internal data repository and attempt to upload them to personal iCloud or unsanctioned personal email service.

Solution

Configure the filters in the section to scope the policy to include domains to be monitored (for instance your organization *.drive.google.com or *.force.com). Now, any file(s) downloaded from the configured domain(s) are monitored. Configure the section to trigger an exfiltration action when an attempt is made to upload the downloaded file to an unsanctioned destination (for instance to personal iCloud or a non corporate sanctioned domain). Finally, enable the Block automated action.

In this scenario, if a user downloads a file from an organization's Google Drive or Salesforce and attempts to upload it to their personal iCloud, the action is blocked and user gets the following error message.

Also, other similar scenarios could be

• A health department which prevents employees from uploading customer health data, downloaded from organization's domain, to employees' personal Google Drive, OneDrive, or any supported cloud storage app.

• An employee working on code repository of an organization, attempting to upload a file to developer forums, LLM services, or generative AI apps like ChatGPT.

An organization allows employees to store work documents only in corporate-managed OneDrive or Google Drive but wants to prevent uploads to personal accounts.

Solution

Configure the filters in the section to scope the policy to include domains to be monitored (for instance your organization Google Drive or OneDrive). Now, any file(s) downloaded from the configured domain(s) are monitored. Configure the section to monitor only unsanctioned domains. Finally, enable the Block automated action. Now any attempt to upload a file to sanctioned domains is allowed.

This action captures a session recording before and after an endpoint exfiltration event and stores it in the destination you select. Use it to review what happened around the event.

To enable recordings, store them in your own bucket, and play them back from an event, see .

The Scope section determines which areas of Nightfall needs to be monitored by Nightfall for Exfiltration. You can choose one or all of the following data types to be monitored.

• Attachments & Files

• Reports

• Records & Objects

After you make the required selection, you can also add filters to monitor specific Salesforce users or Salesforce profiles.

Data Types

In the Data Types section, you must select the Salesforce data types to be monitored. By default, all the three data types are selected. You can choose to either retain all the three data types or clear any of the data types.

The Filters section allows you to add additional filters, on top of the selected data types, to narrow down the monitoring scope. Nightfall provides the following two types of filters.

You can choose specific Salesforce users whose activities need to be monitored or excluded from being monitored. Nightfall populates the list of all your users from Salesforce. You need to select either the users whose activities need to be monitored or the users whose activities need to be excluded from monitoring.

To add Users filter, click Add Filter and select Internal Users.

To monitor specific users, select the Monitor specific option. To exclude specific users from being monitored, select the Monitor all, except option.

Nightfall populates the list of Salesforce users in the Search users field. You can select the all the required users.

You can choose specific Salesforce profiles whose activities need to be monitored or excluded from being monitored. Nightfall populates the list of all your Salesforce profiles. You need to select either the profiles whose activities need to be monitored or the profiles whose activities need to be excluded from monitoring.

To monitor specific Salesforce profiles, select the Monitor specific option. To exclude specific Salesforce profiles from being monitored, select the Monitor all, except option.

Nightfall populates the list of Salesforce profiles in the Search profiles field. You can select the all the required users.

Contoso Ltd. uses Salesforce to host their applications. They have three users Steve, Rick, and Matt in their Salesforce org. These users are not Contoso employees. They are employees of Acme corp. which is a prospective customer of Contoso Ltd. Steve, Rick, and Matt are evaluating Constoso's app so that they can check if it meets Acme corp's requirements. Contoso has created a Salesforce profile called Prospective customers and added these three users to this profile

Contoso Ltd. uses Nightfall Salesforce exfiltration and wishes to check if any files with sensitive data is downloaded by any of these three users. They create a Salesforce exfiltration policy to monitor all the data types. They can choose one of the following filter.

• They can use the filter and add these three users.

• They can select the filter and add the Prospective customers profile to it. So, in future if any other prospective customers added, they are also automatically monitored.

In this final stage, you assign a name to the policy, verify your configurations, and create the policy.

1. Enter a name for the policy.

2. (Optional) Enter a description for the policy.

3. Click Next.

1. Verify if all the policy configurations are set up as per your requirements.

2. (Optional) Click back or click on any specific stage to modify any of the policy configurations.

3. Click Submit.

This document explains the steps to install the Nightfall for Google Drive.

To install the Nightfall DLP for Google Drive integration, you must have the following:

• A Google Workspace account, preferably a service account.

• An admin user account of your organization's Google Workspace account (or any other Google Workspace account) on which you wish to install the integration.

To install Nightfall for Google Drive:

When a company has deployed another profile that controls the Chrome browser ExtensionSettings and it clashes with Nightfall's Profile, the administrator can add the Nightfall ExtensionSettings within the currently present profile to allow the Nightfall extension to connect.

Simply add this code block to the custom, common MDM profile within the <array> brackets:

An example of it is found below:

Before you begin, ensure you have:

• Mosyle Business or Mosyle Manager with admin access

• Nightfall API Key and Company ID - available at app.nightfall.ai/endpoint under Agent Configuration

1. Confirm that the macOS devices are enrolled and managed through your MDM.

2. Confirm that a device group has been set up for deployment.

   • From UEM, navigate to Groups & Settings > Groups > Assignment Groups > click "+ Add Smart Group" and follow the prompts

Nightfall monitors the following signals during a Git push operation:

• The endpoint where the push originates

• The user performing the push

• The Git protocol (HTTPS / SSH)

AirDrop watches files sent through Apple AirDrop on a managed Mac. Nightfall records the transfer as an AirDrop / AirDrop Transfer event and can monitor or block it when the file matches the policy.

This is a file-transfer trigger. It is not the same as Removable Media (USB) or Bluetooth. The wizard label is AirDrop.

Domain collections are not used. Data Source and Data Destination are shown as disabled placeholders: Not applicable for AirDrop action. There is no recipient or nearby-device picker. The policy applies to AirDrop file transfers on devices in the policy scope.

If you do not see AirDrop in the For dropdown, ask your Nightfall account team to enable it.

What you configure

Bluetooth watches file transfers over Bluetooth on a managed endpoint. Nightfall records the transfer as a Bluetooth / Bluetooth Transfer event and can monitor or block it when the file matches the policy.

This is not all Bluetooth activity. Pairing, audio, keyboards, and mice are not this trigger. The wizard label is Bluetooth.

Domain collections are not used. Data Source and Data Destination are disabled placeholders: Not applicable for Bluetooth action. There is no device-type picker on the policy. The policy applies to Bluetooth file transfers on devices in the policy scope. Device type and name show up on the event, not as policy filters.

If you do not see Bluetooth in the For dropdown, ask your Nightfall account team to enable it.

What you configure

All AI agent violations appear in the unified Incidents > Exfiltration Prevention view - there is no separate incident queue. This page explains how to identify, review, and respond to AI agent incidents.

Navigate to Incidents > Exfiltration Prevention. AI agent incidents are identified by the "AI Prompt" event type label in the incident list.

The Trigger section in Salesforce policies allows you to define the frequency of action that must be considered as an exfiltration event. In case of Salesforce policies, the download frequency is the trigger.

The download frequency can be defined as the number of downloads over a period to time. This allows you to set custom thresholds in terms of number of downloads over a specific period of time and can be useful to identify anomalous download patterns for specific locations, users or content type. This can be set in combination to other scoping capabilities.

In the Actions section, you can define the download action that must be considered as a potential exfiltration attempt by Nightfall. Nightfall allows you to set the frequency of downloads as the action.

To configure Actions:

1. Click the minimum number of files that must be the download threshold.

As employees adopt AI coding assistants like Claude Code, Cursor, and GitHub Copilot, those assistants increasingly reach beyond the editor, connecting to external tools and data sources through the Model Context Protocol (MCP), running shell commands, and reading from your codebase and filesystem. Each of these actions is a potential path for sensitive data to leave your environment, often invisibly to traditional DLP. Nightfall's AI Agent Governance gives security teams visibility into what AI agents are doing and the ability to apply data protection policies to that activity in real time.

This section covers three surfaces in the Nightfall console under AI Governance:

• MCP Server Visibility (Inventory, Collections, Users & Devices, Settings): what is already running on endpoints

Nightfall uses two complementary mechanisms to protect AI agent activity:

Hooks intercept AI agent actions before they execute. When a developer submits a prompt, calls a tool, or runs a shell command, Nightfall scans the content against your policies and can block the action if a violation is detected.

• Supported agents: Claude Code, Cursor, VS Code

• Enforcement: Block or Monitor

OpenTelemetry (OTel) captures a complete telemetry stream of AI agent activity after actions complete. This provides full session audit trails including cost tracking, model information, and tool activity.

Nightfall for Google Drive allows you to configure alerts at the policy level and also at the integration level. Alerts can be sent in Google drive by using the following alert channels.

• Slack

• Email

• Webhook

• Jira Tickets

When you configure alert settings at the integration level, the alert settings apply to all the policies, created for the Google Drive integration. However, when you configure alert settings specifically for a policy, which is created in the Google Drive integration, the alert settings are applicable only for that specific policy.

This document explains how to configure alerts at the integration level. To learn about how to configure alerts at the policy level, read .

• To use Slack as an alert platform, you must first perform the required Slack configurations. You can refer to to learn more about how to configure Slack as an Alert platform.

• To use Webhook as an alert platform, you must first perform the required Webhook configurations. You can refer to to learn more about how to configure Webhook as an Alert platform.

• To use JIRA as an alert platform, you must have the DLP for the JIRA app installed from the . You can read more about the DLP for JIRA integration .

You can configure alerts at the integration level once you have installed the Nightfall for Google Drive integration.

To configure alerts at the integration level:

1. Navigate to the Google Drive integration

2. Scroll down to the Alerting section.

3. You can configure one or multiple alert channels.

1. To configure Slack as an alert channel, click + Slack channel.

1. In the Slack alert channel field, enter the name of the Slack channel in which you wish to receive the alerts.

2. Click Save.

A confirmation pop-up box is displayed to confirm if the Slack channel (entered in the second step) must be used only for Google Drive integration or all the Nightfall integrations.

1. Select No, only integration level to use the Slack channel only for Google Drive, or select Yes, please to use the selected Slack channel for all the Nightfall integrations.

1. Click + Email.

1. Enter the Email ID of the recipient who should receive the notifications.

2. Click Save.

A confirmation pop-up box is displayed to confirm if the Email ID (entered in the second step) must be used only for Google Drive integration or all the Nightfall integrations.

1. Select No, only integration level to use the Slack channel only for Google Drive, or select Yes, please to use the selected Slack channel for all the Nightfall integrations.

1. Click + Webhook.

2. Enter the Webhook URL.

3. Click Test. If the test result is not successful, check the Webhook URL.

4. (Optional) Click Add Header to add headers.

1. Click + Jira Ticket.

2. Select a JIRA project from the Jira Project drop-down menu.

3. Select an issue type from the Issue Type drop-down menu.

4. (Optional) Add comments to be added in the JIRA ticket.

A confirmation pop-up box is displayed to confirm if the JIRA settings configured for the Google Drive integration must be applied to all the other Nightfall integrations too.

1. Select No, only integration level to use the configurations only for Google Drive, or select Yes, please to use the selected JIRA configurations for all the Nightfall integrations.

When a Violation occurs, Nightfall sends a notification to the end-user whose actions triggered the violation. While notifying the end-user, Nightfall also sends a text message. You can draft the text message to be sent to the end-user. This message applies to all the policies. Click Save changes once done.

This document explains what admins and end-users can do once a policy is violated.

Admin Notification and Remediation

When end-users violate a policy, the Nightfall admin is notified about the incident. The notification channel used to notify the Nightfall admin depends on the settings configured in the Admin Alerting section. If you have not enabled any notification channels in the Admin alerting section, Nightfall admins are not notified.

If you have enabled the email notification in the Admin alerts section, Nightfall admins receive an email. The email is as shown in the following image.

The Email consists of the following data.

• Event: The event that caused the violation. For Google Drive, the event is always a download of assets.

• Actor: The Email ID of the user who downloaded the file.

• When: The date and time when the email was downloaded.

• Where: The name of the file that was downloaded.

• Policies Violated: The name of the policy that was violated.

• Violation Dashboard: The link to the Events screen to view the violation in detail.

• Actions: The list of actions that the Nightfall admin can take.

Also, a Slack message is sent if you have enabled the Slack alerts for the Nightfall admin. The Slack message looks as shown in the following image.

End-users receive notifications and remediation actions if the Nightfall admin has enabled these settings. The notifications are based on the settings configured in the section. The end-user remediation actions are based on the settings configured in the section.

If you have configured the Email notification for end-users and enabled the end-user remediation, end-users can take remediation actions from the Email itself.

If you have configured Slack notifications for end-user and enabled end-user remediation, end-users can view the Slack message.

Nightfall admins can manage violations from within the Nightfall console. The Events page in Nightfall lists all the violations under the Exfiltration tab. End-users can get a detailed view of each exfiltration Event triggered.

To view violations in Nightfall navigate to the Exfiltration Prevention page from the left menu.

The Exfiltration Events page lists all the exfiltration events. To view events with specific statuses, you can click the respective tabs.

To view the past events, click the Time filter and select the required time period. By default, the time period displays Events for the Last 7 Days.

The Event list view consists of the following columns.

You can click an event to view the details. The detail view window consists of the following tabs.

• Summary: The Summary tab displays highlights of the event like the name of the downloaded asset, the name of the violated policy, the email ID of the user who violated the policy, and so on.

• Asset: The asset window displays the details of the asset and the history of the asset. You can also choose to view historic asset data. If there are multiple assets in a single violation, you can choose which asset's details must be displayed.

• Actor: The actor tab displays the details and history of the user who downloaded the asset. You can choose to view historical data of the user. You can also add which can serve as metadata for the violation.

The events list view displays an ellipsis menu at the extreme right corner. Admins can click this menu to take appropriate action on an exfiltration event.

The various available actions are explained as follows.

• Acknowledge: This action can be taken when you just wish to acknowledge that you have viewed the violation.

• Notify Email: This action sends an email notification to the end-user who caused the violation.

• Notify Slack: This action sends a Slack notification to the end-user who caused the violation.

• Suspend Account: This action suspends the account of the user who caused the violation.

Once the action is implemented, the status of the event changes respectively. By default, an event can have one of the following two statuses.

• Active: The event has been generated but no action has been taken.

• Input Requested: A notification has been sent to the end-user requesting their response.

1. Prerequisites

• Client: SCCM Current Branch; SCCM client installed and healthy on target devices; a reachable Distribution Point (DP).

• Operating System: Windows 10(22H2 and above)/11 x64 targets (ARM not supported).

• Package: From the Endpoint page → navigate to Download package button →

  • Download NightfallAgent.msi

  • Copy API Key and Company ID

• The agent self-updates (every few hours) — SCCM’s job is a one-time install; don’t manage the version in SCCM (hence the version-agnostic detection in §3).

• Claude Code shows a one-time security-consent dialog the first time it loads managed hooks — communicate this to developers. (On some 2.1.x builds /hooks may show “0” even when hooks are active — verify via the Nightfall console or claude --debug, not that count.)

• Always "Run as Administrator".

Put the installers on a UNC share the site server and DP can read.

⚠️ Share permissions matter. SCCM’s distribution service reads the source as the site server’s computer account, not your user. Grant Read to Domain Computers (or the site server’s machine account) on both the share and NTFS — otherwise Distribute Content fails with “cannot access … Win32 error 5 (Access Denied).”

1. Within SCCM, navigate to: Software Library → Application Management → Applications → Create Application → Manually specify → add a Script Installer deployment type.

• Content location: \\<fileserver>\NightfallDeploy\Agent

• Installation program:

• Install behavior: Install for system · Whether or not a user is logged on · Hidden

• Detection method — use a

1. Then Distribute Content → your DP

2. Deploy the app Required to your target device collection.

• Create one Script Installer application per IDE (VS Code needs two — see below).

  • Common settings: Install for system · Whether or not a user is logged on · Hidden · Required.

• Content location: \\<fileserver>\NightfallDeploy\ClaudeCode

• Installation program:

• Detection — File System: C:\Program Files\ClaudeCode\managed-settings.d\nightfall-hooks.json exists

• Content location: \\<fileserver>\NightfallDeploy\Cursor

• Installation program:

• Detection — custom PowerShell (Cursor’s hooks.json is shared with other vendors, so existence isn’t enough):

App 1 — hook file:

• Content: \\<fileserver>\NightfallDeploy\VSCode

• Install:

• Detection — File System: C:\ProgramData\Copilot\hooks\nightfall.json exists

App 2 — enterprise policy (Copilot ignores hook files at paths not registered in policy):

• Content: \\<fileserver>\NightfallDeploy\VSCode

• Install: powershell.exe -NoProfile -ExecutionPolicy Bypass -File .\scripts\windows\install-policy.ps1

• Detection — Registry: HKLM\SOFTWARE\Policies\Microsoft\VSCode value chat.hookFilesLocations

On a target device:

1. Run Machine Policy Retrieval

2. Navigate to Application Deployment Evaluation (Control Panel → Configuration Manager → Actions), then check:

1. Confirm the device and per-IDE hook status appear healthy on the Devices page in the Nightfall console.

Nightfall for macOS and Nightfall for Windows OS allow you to configure alerts at the policy level and also at the integration level.

You can navigate to the alerts page by executing the following steps:

1. Click Integrations in the left pane.

2. Click Manage for either Endpoint macOS or Endpoint Windows widget.

The Exfiltration policies for MAC and Windows OS allow you to monitor if there are any uploads via browser or cloud storage apps. You can configure the domains in Internet that needs to be monitored and also the cloud storage apps which need to be monitored.

When there are any uploads to the configured domain or cloud storage apps, the Nightfall AI agent notifies this action. You can configure the notification channels through which you wish to receive notifications when there is an attempt to upload files/folders.

Once you have completed the installation of the Nightfall agent, you must ensure that the connection is live. If the Nightfall agent cannot connect to the macOS or the Windows OS device for more than 6 hours, the connection is lost. When the connection is live, a Connected message is displayed. If the connection is lost, a Disconnected message is displayed under the Agent Status column.

When a macOS or Windows OS device is disconnected, you can remove the device from the monitored list (Devices tab). To remove a disconnected device from the monitored list, click the delete icon for the respective device.

Clicking the delete icon displays a warning pop-up window as shown in the following image. Click

Nightfall’s removable media controls allow you to monitor or block sensitive data exfiltration to external storage devices such as USB drives and external HDD/SSD. Policies are evaluated at the endpoint and can be scoped with device type, vendor, and serial number filters for precise enforcement.

Out of the box, Nightfall supports ~1,200 removable media vendors, enabling immediate coverage without manual vendor onboarding.

Nightfall detects and can block the following removable media categories:

• USB storage devices (thumb drives, external HDD/SSD)

These are internally represented as removable media types and can be included or excluded in the policy configuration.

How Removable Media Policies Work

A removable media policy is evaluated using three layers of filters:

CLI Transfer watches file movement started by selected command-line tools on a managed endpoint. The agent intercepts the process (for example scp or curl) when it uploads or downloads a file. You pick the tools on the policy. Nightfall does not treat every shell command as this trigger.

This is not Git Push. git push is a separate trigger (Git Push to). CLI Transfer is for the tools listed below.

Domain collections are not used as a destination list for this trigger. You do not pick domains or apps. You pick CLI tools. Data Source (asset origin) is still available, the same as on Browser Upload.

If you do not see CLI Transfer in the For dropdown, ask your Nightfall account team to enable it.

What you configure

This stage allows you to select automated notification channels or actions if a policy violation occurs.

This section allows you to send notifications to Nightfall users. The various alert methods are as follows. You must first turn on the toggle switch to use an alert method.

The steps to configure alert channels for policy-level integration are the same as in the case of integration-level alerts. You can refer to the document.

Automated actions allow you to configure automated remediation actions when an exfiltration attempt is detected by Nightfall policy. Nightfall supports the following automated actions for Salesforce. You can choose to implement the automated action immediately after detecting a download attempt or after some time.

To enable the automated action, you must turn on the respective toggle switch.

This action logs out the user from the Salesforce account. They cannot login until a Salesforce admin revokes the freeze on the account.

You must now select when exactly after detecting the event, the action must be triggered. if you select the Immediately option, the automated action is triggered immediately after the download attempt is made.

Claude Cowork can't run Nightfall hooks, so it's monitored through Anthropic's built-in OpenTelemetry (OTel) integration instead. You configure it once from the Anthropic admin console — not per device or per user — and it captures prompts, tool calls, file access, and session metadata across every Team / Enterprise seat.

OTel is monitor-only: it reports on activity after it happens and cannot block. For how it compares to hooks, see Hooks vs. OpenTelemetry.

1. Copy your OTLP values from Nightfall

In the Nightfall console, open AI Agent Security → AI Agent Security Setup and select the OpenTelemetry tab. Nightfall generates three values scoped to your organization — use Copy all values to grab them together: