Data exfiltration, also known as data theft, data exportation, or data extrusion, is the unauthorized transfer of data from a device or network. It can occur as part of an automated attack or can be performed manually. The illegitimate transfer of data often looks very similar to legitimate transfers, making it difficult to detect.

Common Techniques for Data Exfiltration

Data exfiltration can occur in various ways and through multiple attack methods. Here are some of the most commonly used techniques:

• Social Engineering and Phishing Attacks: These attacks trick victims into downloading malware and giving up their account credentials.

• Outbound Emails: Cyber criminals employees or intruders use email to exfiltrate any data that sits on organizations’ outbound email systems.

• Downloads to Insecure Devices: Data is transferred by users from secure, trusted systems to an insecure device. From there, the attacker can infiltrate the device and exfiltrate the data.

• Uploads to Cloud Storage: Data can be exfiltrated from cloud storage when data is uploaded to insecure or misconfigured resources.

Nightfall Exfiltration Solution

Nightfall provides a highly revolutionised solution to data exfiltration. Nightfall AI's exfiltration prevention capabilities easily integrate with existing tools, thus catering to security teams and companies across industries. Nightfall's exfiltration solution is much more than just a tool; it proactively protects against data breaches, providing tangible benefits for organizations striving to secure their sensitive information.

Data exfiltration, also known as data theft, data exportation, or data extrusion, is the unauthorized transfer of data from a device or network. It can occur as part of an automated attack or can be performed manually. The illegitimate transfer of data often looks very similar to legitimate transfers, making it difficult to detect.

Common Techniques for Data Exfiltration

Data exfiltration can occur in various ways and through multiple attack methods. Here are some of the most commonly used techniques:

• Social Engineering and Phishing Attacks: These attacks trick victims into downloading malware and giving up their account credentials.

• Outbound Emails: Cyber criminals employees or intruders use email to exfiltrate any data that sits on organizations’ outbound email systems.

• Downloads to Insecure Devices: Data is transferred by users from secure, trusted systems to an insecure device. From there, the attacker can infiltrate the device and exfiltrate the data.

Nightfall Exfiltration Solution

Nightfall provides a highly revolutionised solution to data exfiltration. Nightfall AI's exfiltration prevention capabilities easily integrate with existing tools, thus catering to security teams and companies across industries. Nightfall's exfiltration solution is much more than just a tool; it proactively protects against data breaches, providing tangible benefits for organizations striving to secure their sensitive information.

In this final stage, you assign a name to the policy, verify your configurations, and create the policy.

1. Enter a name for the policy.

2. (Optional) Enter a description for the policy.

3. Click Next.

1. Verify if all the policy configurations are set up as per your requirements.

2. (Optional) Click back or click on any specific stage to modify any of the policy configurations.

3. Click Submit.

Nightfall for Windows OS allows you to detect exfiltration events on your Windows OS devices. The Nightfall exfiltration feature can monitor any files being uploaded through supported cloud storage apps or browsers on Windows OS devices.

To use Nightfall for macOS, you must install the Nightfall AI agent. This agent monitors your Windows OS device continuously. You can install the agent either manually or through a Mobile device management (MDM) tool. You can request the Nightfall deployment bundle which contains the data required for your MDM deployment.

Exfiltration policies allow you to monitor download events across your Google Drive environment. Through real-time download monitoring, you can identify insider risk and anomalous behaviour before it escalates to large scale security incidents. You can monitor download activity for specific users or user groups, specific drives containing valuable sensitive assets, or downloads of any files containing sensitive data types as discovered and classified by Nightfall's ML/AI based detectors.

You can set up your policies to monitor only, to educate users in real-time about your download and data governance policies, or to automatically suspend user access to the Google Workspace to enforce zero tolerance policies.

The detailed steps to configure the Google Drive Exfiltration policy is explained in the following documents.

In this stage, you select the Integration for which the policy is created. In this case, Google Drive integration must be selected.

1. Click Policies from the left menu.

1. Click + New Policy.

Nightfall supports exfiltration prevention in endpoint devices. The exfiltration prevention in endpoint devices prevents your organization's employees from exfiltrating data out of your organization. This feature is available for devices running on the macOS and Windows OS.

To monitor each device for exfiltration, you must first install the Nightfall agent on the devices that require monitoring. You can install the Nightfall agent either manually on each device. Alternatively, you can also use an MDM to install the agent. Once you install the Nightfall agent, you must create policies to start the monitoring. Nightfall monitors the devices as per the policy rules set.

You can learn about how to install the Nightfall AI agent for macOS/Windows OS and the process to create policies from the following links.

In this stage, you select the Integration for which the policy is created. In this case, Google Drive integration must be selected.

1. Click Policies from the left menu.

2. Click + New Policy.

In this final stage, you assign a name to the policy, verify your configurations, and create the policy.

1. Enter a name for the policy.

2. (Optional) Enter a description for the policy.

3. Click Next

Prerequisites

1. You have the Device Administrator role in Rippling.

2. Target Windows devices have been onboarded into Rippling MDM.

3. On your Nightfall console, navigate to and click the Download Package button on the top right corner of the page. Click Download Package for Windows. A .msiextension file is downloaded.

1. Configure and Deploy Software Package

This stage allows you to select the notifications channels. If Nightfall detects sensitive data in any of the selected upload channels, the notifications are sent to the recipients configured in this section.

Admin Alerting

This section allows you to send notifications to Nightfall users. The various alert methods are as follows. You must first turn on the toggle switch to use an alert method.

The steps to configure alert channels for policy-level integration are the same as in the case of integration-level alerts. You can refer to for steps.

The trigger section further enhances the unwanted noise reduction capabilities. With the trigger section, you can

• Set what download behavior can be termed as an exfiltration event.

• Exclude downloads by trusted apps from being termed as exfiltration events.

Configuring Trigger Section

In the trigger section, you can set the download behavior, the download frequency to be precise, must be termed as an exfiltration event.

To configure the Trigger section:

1. Set the minimum number of downloads threshold that must be considered as an exfiltration event.

2. Set the required time period (frequency). If the minimum download threshold (set in the previous step) is reached or exceeded, within the set time period, an exfiltration event is generated.

In the following image, the configurations are set such that if an asset is downloaded 2 or more times within 10 minutes, an exfiltration event is triggered.

Exclude Apps

Depending on your environment, a significant number of downloads may be attributed to applications (i.e. backup apps). You may choose to ignore such download events to reduce the noise and focus your monitoring on unexpected application and user download events.

The Exclude apps section allows you to exclude specific applications from being monitored by your policy.

To configure the Exclude apps section, select the applications to exclude from the drop-down menu. Once saved, Nightfall will not alert on download events attributed to the excluded applications.

Nightfall Exfiltration for Salesforce helps you to keep tab of the exfiltration activities in your Salesforce orgs. Nightfall leverages Salesforce Shield Real Time Event Monitoring for exfiltration activities across your Salesforce orgs and identifies activities which are in violation to configured policies.

Download of attachments, files, reports and bulk download of objects are all exfiltration event recognised by Nightfall. You can configure policies to set appropriate thresholds for such events and identify them as unwarranted that may require scrutiny. You may configure the policy to alert the stakeholders who need to be notified and choose one of the available actions to be invoked automatically. You may also choose not to configure automated actions but only act after evaluating the specific exfiltration events.

Prerequisites

Nightfall exfiltration leverages Salesforce Shield's Event Monitoring to identify exfiltration events. Salesforce Shield provides multiple security tools to safeguard your Salesforce orgs. Nightfall depends on in Salesforce Shield which is available as an independent module within . You must enable the following Event Monitoring settings for all the Salesforce orgs that you wish to monitor,

• Generate event log files - Generate an event log file when events occur in your org.

• Enable Lightning Logger Events - Enable collection of Lightning Logger Events in custom components.

• Enable the following events for storage and streaming

You can learn more about Salesforce Shield and once enabled, advance to the next steps with

If you have already onboarded your Salesforce org to Nightfall platform, please ensure you have the latest Nightfall DLP package deployed in your Salesforce org. Follow the steps mentioned in to upgrade it to the latest version.

Installation Doc Links

The installation procedure remains the same as in case of Salesforce DLP for sensitive data. The links to the installation and upgradation documents are as follows.

Exfiltration policies allow you to monitor download events across your Salesforce environment. Through real-time download monitoring, you can identify insider risk and anomalous behaviour before it escalates to large scale security incidents. The following are supported and monitored by Nightfall for exfiltration activities,

• Attachments & Files

• Reports

• Records & Objects

Download of any of the above information containers is an exfiltration activity for Nightfall, and if such activities breach a threshold set in one of the exfiltration policies in Nightfall, then Nightfall will flag it an exfiltration event. You can configure which users should receive notifications and what automatic actions must be taken when an exfiltration event is detected.

The detailed steps to configure the Salesforce Exfiltration policy is explained in the following documents.

In this final stage, you assign a name to the policy, verify your configurations, and create the policy.

1. Enter a name for the policy.

2. (Optional) Enter a description for the policy.

3. Click Next.

1. Verify if all the policy configurations are set up as per your requirements.

2. (Optional) Click back or click on any specific stage to modify any of the policy configurations.

3. Click Submit.

The advanced settings pages allows you to configure notifications for Nightfall admins and end-users. Additionally, you can also configure automated actions. The various configurations available in the advanced settings pages are described in the following sections.

• Admin Alerting

• Automated Actions

In this stage, you select the Integration for which the policy is created. In this case, Salesforce integration must be selected.

1. Click Policies from the left menu.

1. Click + New Policy.

1. Select Exfiltration.

1. Select the Salesforce integration.

Nyx is Nightfall’s AI-powered DLP Copilot, designed to help you quickly investigate and understand exfiltration risks. She can surface patterns, summarize user activity, and suggest next steps — all through a simple natural-language conversation.

Getting Started

1. Click the Comet Icon: In the upper right corner of your Nightfall dashboard, click the comet icon to open Nyx.

This stage allows you to select automated notification channels or actions if a policy violation occurs.

Admin Alerting

This section allows you to send notifications to Nightfall users. The various alert methods are as follows. You must first turn on the toggle switch to use an alert method.

This section describes the various actions that Nightfall takes automatically when an exfiltration attempt is detected. This automated action is triggered when the condition set in the section is violated.

The automated action supported by Nightfall is described as follows.

Block Transfer

This action automatically blocks the process of file transfer thus preventing an exfiltration attempt. You can use this action to prevent the upload of files with sensitive data, to web browsers or cloud storage apps. You must enable the toggle switch to activate the automated action.

The Scope section determines which areas of Nightfall needs to be monitored by Nightfall for Exfiltration. You can choose one or all of the following data types to be monitored.

• Attachments & Files

• Reports

Pre-Requisites

1. Target macOS devices are onboarded and managed through your MDM.

The Trigger section in Salesforce policies allows you to define the frequency of action that must be considered as an exfiltration event. In case of Salesforce policies, the download frequency is the trigger.

The download frequency can be defined as the number of downloads over a period to time. This allows you to set custom thresholds in terms of number of downloads over a specific period of time and can be useful to identify anomalous download patterns for specific locations, users or content type. This can be set in combination to other scoping capabilities.

Configuring Triggers

In the Actions section, you can define the download action that must be considered as a potential exfiltration attempt by Nightfall. Nightfall allows you to set the frequency of downloads as the action.

Pre-Requisites

1. Confirm that the Windows devices are enrolled and managed through Workspace ONE.

This section allows you to configure notifications to be sent to the end user whose actions triggered the violation.

Custom Message

Enter a custom message to be sent to the end user. This message is sent in an Email or a Slack message. You can modify the default message provided by Nightfall and draft your own. The total character length allowed is 1000 characters. You can also add hyperlinks in the custom message. The syntax is <link | text >. For example, to hyperlink https://www.nightfall.ai with the text Nightfall website, you must write < | Nightfall website>.

Nightfall for macOS allows you to detect exfiltration events on your macOS devices. The Nightfall exfiltration feature can monitor any files being uploaded through supported cloud storage apps or browsers on macOS devices.

To use Nightfall on macOS, you’ll need to install the Nightfall AI agent. You can install it manually for testing or evaluation purposes, or automate the install through MDM.

Nightfall supports the following agent installation methods for macOS:

Stealth Mode Installation

You can install the Nightfall AI macOS agent in stealth/hidden mode. Installing the agent in stealth mode allows you to hide visible UI elements once the Nightfall agent is installed. When you install the agent in silent mode, the Nightfall status bar icon. Additionally, the Nightfall application will not be visible in the Applications folder when viewed in Finder.

Use cases

• Covert Monitoring: If an organization suspects an employee of exfiltrating sensitive data, they can install the agent in stealth mode to monitor the employee's asset without the employee's knowledge.

• Ensuring Bias-Free Compliance: An organization wishes to confirm if their employees are adhering to HIPAA/PCI compliances; they can install the agent in stealth mode without giving any indication to their employees (which can prompt a change in their behavior).

• Prevent User Distractions: Organizations that do not wish to distract their users about the agent presence and monitoring can depoy in stealth mode.

Stealth Mode Installation Process

1. In the mdm_pre_installation_script.shfile, find the hide_status_iconflag.

2. Set the flag to true. By default, the flag is set to false⁣.

Nightfall Agent Auto Update

Nightfall employs the automatic endpoint update functionality. With this feature, Nightfall can deliver the majority of endpoint agent bug fixes and feature updates directly to endpoints.

Features:

• Stay Secure: Receive the latest security patches and updates promptly, reducing the risk of vulnerabilities being exploited.

• Remain Compatible: Keep your deployment compatible with the latest operating system updates and other software changes.

• Receive New Features: You get access to new features and improvements to exfiltration monitoring without manual intervention.

This document explains the steps to install the Nightfall for Google Drive.

Requirements

To install the Nightfall DLP for Google Drive integration, you must have the following:

• A Google Workspace account, preferably a service account.

• An admin user account of your organization's Google Workspace account (or any other Google Workspace account) on which you wish to install the integration.

Installation

To install Nightfall for Google Drive:

1. Log in to Nightfall.

2. Click Google Drive under the MY INTEGRATIONS section (click Show more if you are unable to view Google Drive)

3. Click Begin Setup. 

The access permission page is displayed as follows. Copy the client ID and Scopes ID generated.

1. Login to your Google Workspace with an admin account.

2. Click the menu icon.

3. Select Admin.

1. In the Admin console left pane, expand Security and then expand Access and data control.

2. Click API controls.

1. Click MANAGE DOMAIN WIDE DELEGATION under Domain wide delegation.

1. Click Add New.

1. Paste the Client ID copied from the Nightfall app, in the Client ID field.

2. Paste the Scopes ID copied from the Nightfall app, under OAuth Scope field. Use comma to add multiple scope IDs.

3. Click AUTHORIZE.

1. Return to the Nightfall app and click Next Step.

1. Click Connect.

Once the installation is completed, you can view the details of your Google Drive in the Nightfall app.

Pre-Requisites

1. Enroll devices in PDQ SimpleMDM

2. Create a Device Group with the respective macOS machines assigned to it

3. Download and unpack Nightfall's install package from the console:

   • Integrations > Manage (Endpoint Windows) > Download Package > click "Download Package"

Step 1: Deploy the Script

1. From within SimpleMDM, navigate to Scripts > click “Scripts” > click “Create Script”

2. Name: Nightfall Pre-Installation Script

3. Click “Choose File”

Step 2: Deploy the Profile

1. Navigate to Configs > click “Profiles” > click “Create Profile”

2. Select “Custom Configuration Profile”

   1. Name: Nightfall Profile

Step 3: Deploy the Agent

1. Navigate to Apps & Media > click “Catalog” > click “Add App” > select “Custom App”

2. From the mac_bundle folder, locate the “nightfall-ai-agent-signed.pkg” > click “Open”

3. Click the “Groups” tab > click “Assign Groups”

Pre-Requisites

1. Confirm that the macOS devices are enrolled and managed through your MDM.

Overview

This document outlines the steps to manually deploy the Nightfall AI Agent on a Windows device.

Overview

This guide provides instructions for deploying the Nightfall AI Endpoint Agent to macOS devices via JumpCloud MDM. It highlights Software Management (Private Repository) as the preferred method, while also documenting an alternative method using Commands + hosted**.pkg**.

Prerequisites

• macOS devices enrolled in JumpCloud MDM.

• Deployment assets:

  • Configuration profile (default, recommended): NightfallAI_Profile_with_Browser_Extensions.mobileconfig

Step 1 — Deploy the Configuration Profile

Always use the default profile with browser extensions:

1. In JumpCloud Admin Portal → Device Management → Policy Management → Configuration Profiles.

2. Create a new macOS Custom Configuration Profile.

3. Upload NightfallAI_Profile_with_Browser_Extensions.mobileconfig.

Step 2 — Distribute the Agent

Preferred Method: Software Management (Private Repository)

1. First, run the pre-install script as a Command:

   • In JumpCloud Admin Console → Device Management → Commands → + Command (macOS).

   • Attach both scripts:

Alternative Method: Commands + Hosted nightfall-ai-agent-signed.pkg

Use this method if you want scripts and installation tightly coupledIn JumpCloud Admin Console → Device Management → Commands → + Command (macOS).

1. Attach both scripts:

   • mdm_pre_installation_script.sh

2. Paste the following command (update PKG_URL):

Step 3 — Monitor & Verify

• Software Management: Check JumpCloud’s app inventory to confirm installation.

• Commands: View Commands → Results for logs and exit codes.

• On-device: check /var/log/nightfall_install.log.

Recommendation

• Default: Use Software Management (Private Repository) with a script Command run first for environment prep.

• Alternative: Use Commands + hosted .pkg only if you need script-driven installs inline or cannot use the Private Repository.

Nightfall for Google Drive allows you to configure alerts at the policy level and also at the integration level. Alerts can be sent in Google drive by using the following alert channels.

• Slack

• Email

• Webhook

• Jira Tickets

When you configure alert settings at the integration level, the alert settings apply to all the policies, created for the Google Drive integration. However, when you configure alert settings specifically for a policy, which is created in the Google Drive integration, the alert settings are applicable only for that specific policy.

This document explains how to configure alerts at the integration level. To learn about how to configure alerts at the policy level, read .

Prerequisites

• To use Slack as an alert platform, you must first perform the required Slack configurations. You can refer to to learn more about how to configure Slack as an Alert platform.

• To use Webhook as an alert platform, you must first perform the required Webhook configurations. You can refer to to learn more about how to configure Webhook as an Alert platform.

• To use JIRA as an alert platform, you must have the DLP for the JIRA app installed from the . You can read more about the DLP for JIRA integration .

Configure Alerts at the Integration Level

You can configure alerts at the integration level once you have installed the Nightfall for Google Drive integration.

To configure alerts at the integration level:

1. Navigate to the Google Drive integration

2. Scroll down to the Alerting section.

3. You can configure one or multiple alert channels.

Configuring Slack as an Alert Channel

1. To configure Slack as an alert channel, click + Slack channel.

1. In the Slack alert channel field, enter the name of the Slack channel in which you wish to receive the alerts.

2. Click Save.

A confirmation pop-up box is displayed to confirm if the Slack channel (entered in the second step) must be used only for Google Drive integration or all the Nightfall integrations.

1. Select No, only integration level to use the Slack channel only for Google Drive, or select Yes, please to use the selected Slack channel for all the Nightfall integrations.

Configuring Email as an Alert Channel

1. Click + Email.

1. Enter the Email ID of the recipient who should receive the notifications.

2. Click Save.

A confirmation pop-up box is displayed to confirm if the Email ID (entered in the second step) must be used only for Google Drive integration or all the Nightfall integrations.

1. Select No, only integration level to use the Slack channel only for Google Drive, or select Yes, please to use the selected Slack channel for all the Nightfall integrations.

Configuring Webhook as an Alert Channel

1. Click + Webhook.

2. Enter the Webhook URL.

3. Click Test. If the test result is not successful, check the Webhook URL.

Configuring JIRA as an Alert Channel

1. Click + Jira Ticket.

2. Select a JIRA project from the Jira Project drop-down menu.

3. Select an issue type from the Issue Type drop-down menu.

A confirmation pop-up box is displayed to confirm if the JIRA settings configured for the Google Drive integration must be applied to all the other Nightfall integrations too.

1. Select No, only integration level to use the configurations only for Google Drive, or select Yes, please to use the selected JIRA configurations for all the Nightfall integrations.

Configure End-User Notification

When a Violation occurs, Nightfall sends a notification to the end-user whose actions triggered the violation. While notifying the end-user, Nightfall also sends a text message. You can draft the text message to be sent to the end-user. This message applies to all the policies. Click Save changes once done.

This document explains what admins and end-users can do once a policy is violated.

Admin Notification and Remediation

When end-users violate a policy, the Nightfall admin is notified about the incident. The notification channel used to notify the Nightfall admin depends on the settings configured in the Admin Alerting section. If you have not enabled any notification channels in the Admin alerting section, Nightfall admins are not notified.

If you have enabled the email notification in the Admin alerts section, Nightfall admins receive an email. The email is as shown in the following image.

The Email consists of the following data.

• Event: The event that caused the violation. For Google Drive, the event is always a download of assets.

• Actor: The Email ID of the user who downloaded the file.

• When: The date and time when the email was downloaded.

Also, a Slack message is sent if you have enabled the Slack alerts for the Nightfall admin. The Slack message looks as shown in the following image.

End-User Notification and Remediation

End-users receive notifications and remediation actions if the Nightfall admin has enabled these settings. The notifications are based on the settings configured in the section. The end-user remediation actions are based on the settings configured in the section.

If you have configured the Email notification for end-users and enabled the end-user remediation, end-users can take remediation actions from the Email itself.

If you have configured Slack notifications for end-user and enabled end-user remediation, end-users can view the Slack message.

Managing Events in Nightfall

Nightfall admins can manage violations from within the Nightfall console. The Events page in Nightfall lists all the violations under the Exfiltration tab. End-users can get a detailed view of each exfiltration Event triggered.

To view violations in Nightfall navigate to the Exfiltration Prevention page from the left menu.

The Exfiltration Events page lists all the exfiltration events. To view events with specific statuses, you can click the respective tabs.

To view the past events, click the Time filter and select the required time period. By default, the time period displays Events for the Last 7 Days.

Event List View

The Event list view consists of the following columns.

Event Detail View

You can click an event to view the details. The detail view window consists of the following tabs.

• Summary: The Summary tab displays highlights of the event like the name of the downloaded asset, the name of the violated policy, the email ID of the user who violated the policy, and so on.

• Asset: The asset window displays the details of the asset and the history of the asset. You can also choose to view historic asset data. If there are multiple assets in a single violation, you can choose which asset's details must be displayed.

• Actor: The actor tab displays the details and history of the user who downloaded the asset. You can choose to view historical data of the user. You can also add which can serve as metadata for the violation.

Taking Actions on the Events Page

The events list view displays an ellipsis menu at the extreme right corner. Admins can click this menu to take appropriate action on an exfiltration event.

The various available actions are explained as follows.

• Acknowledge: This action can be taken when you just wish to acknowledge that you have viewed the violation.

• Notify Email: This action sends an email notification to the end-user who caused the violation.

• Notify Slack: This action sends a Slack notification to the end-user who caused the violation.

Once the action is implemented, the status of the event changes respectively. By default, an event can have one of the following two statuses.

• Active: The event has been generated but no action has been taken.

• Input Requested: A notification has been sent to the end-user requesting their response.

This document explains what admins and end-users can do once a policy is violated.

Admin Notification and Remediation

When end-users violate a policy, the Nightfall admin is notified about the incident. The notification channel used to notify the Nightfall admin depends on the settings configured in the Admin Alerting section. If you have not enabled any notification channels in the Admin alerting section, Nightfall admins are not notified.

If you have enabled the email notification in the Admin alerts section, Nightfall admins receive an email. The email is as shown in the following image.

The Email consists of the following data.

• Event: The event that caused the violation. For Salesforce, the event is always download of assets.

• Who: The Email ID of the user who downloaded the file.

• When: The date and time when the email was downloaded.

Also, a Slack message is sent if you have enabled the Slack alerts for the Nightfall admin.

End-User Notification and Remediation

End-users receive notifications and remediation actions if the Nightfall admin has enabled these settings. The notifications are based on the settings configured in the section. The end-user remediation actions are based on the settings configured in the section.

If you have configured the Email notification for end-users and enabled the end-user remediation, end-users can take remediation actions from the Email itself. The end-user Email is shown in the following image.

If you have configured Slack notifications for end-user and enabled end-user remediation, end-users also get a message in the respective Slack channel configured.

Manage Violations in Nightfall

To manage violations in the Nightfall console:

1. Click Events from the left menu.

1. Click the Exfiltration tab.

The Exfiltration Events page lists all the exfiltration events. To view events specific to the Salesforce integration:

1. Click Filters and select + Add Filter.

1. Select Integration in the Select a filter field.

1. Select the Salesforce check box in the Select an option field.

1. Click Apply.

Now, only the Salesforce events are displayed.

1. To view events with specific statuses, you can click the respective tabs.

To view historic events, click the Time filter and select the required time period.

You can click an event to view the details. The detail view window is as follows.

The detail view window consists of the following tabs.

• Summary: The Summary tab displays highlights of the event like the name of the downloaded asset, the name of the violated policy, and the email ID of the user who violated the policy.

• Asset: The asset tab displays the details of the asset. You can view details like name of the downloaded asset, size of the downloaded asset, exfiltration action (download), owner's Salesforce ID and IP address. If there are multiple assets in a single violation, you can choose which asset's details must be displayed.

• Actor: The actor tab displays the email ID of the Salesforce user who downloaded the asset. You can add notes on this tab which is displayed in the Admin notes section.

Taking Actions on the Events Page

The events list view displays an ellipsis menu at the extreme right corner. Admins can click this menu to take appropriate action on an exfiltration event.

The various available actions are explained as follows.

• Acknowledge: This action can be taken when you just wish to acknowledge that you have viewed the violation.

• Notify Email: This action sends an email notification to the end-user who caused the violation.

• Notify Slack: This action sends a Slack notification to the end-user who caused the violation.

Once the action is implemented, the status of the event changes respectively. By default, an event can have one of the following two statuses.

• Active: The event has been generated but no action has been taken.

• Input Requested: A notification has been sent to the end-user requesting their response.

This stage allows you to select automated notification channels or actions if a policy violation occurs.

Admin Alerting

This section allows you to send notifications to Nightfall users. The various alert methods are as follows. You must first turn on the toggle switch to use an alert method.

The steps to configure alert channels for policy-level integration are the same as in the case of integration-level alerts. You can refer to the document.

Automated Actions

Automated actions allow you to configure automated remediation actions when an exfiltration attempt is detected by Nightfall policy. Nightfall supports the following automated actions for Salesforce. You can choose to implement the automated action immediately after detecting a download attempt or after some time.

To enable the automated action, you must turn on the respective toggle switch.

Freeze Salesforce User Account

This action logs out the user from the Salesforce account. They cannot login until a Salesforce admin revokes the freeze on the account.

You must now select when exactly after detecting the event, the action must be triggered. if you select the Immediately option, the automated action is triggered immediately after the download attempt is made.

If you select the After option, you must select the time gap after which the automated action must be implemented.

Revoke User Permissions

This action revokes the permissions of the user. The user can now only view data across al Salesforce pages. They cannot download any data. This action assigns the user Salesforce's minimum access profile. You can learn more about this profile from this .

You must now select when exactly after detecting the event, the action must be triggered. if you select the Immediately option, the automated action is triggered immediately after the download attempt is made.

If you select the After option, you must select the time gap after which the automated action must be implemented.

End-User Notification

This section allows you to configure notifications to be sent to the end user whose actions triggered the violation.

Custom Message

Enter a custom message to be sent to the end user. This message is sent in an Email. You can modify the default message provided by Nightfall and draft your message. The total character length allowed is 1000 characters. You can also add hyperlinks in the custom message. The syntax is <link | text >. For example, to hyperlink with the text Nightfall website, you must write <www.nightfall.ai|Nightfall website>.

Automation

The automation settings allow you to send notifications to end users. You can select one or both the notification methods. You must first turn on the toggle switch to use the automation option. The automation notification channels are as follows

• Email: This option sends an Email to the user who attempted the download.

• Slack: This option sends a Slack message to the user who attempted the download.

End-User Remediation

End-user remediation (also known as Human Firewall) allows you to configure remediation measures that end users can take, when a violation is detected on by their download attempt. You must turn on the toggle switch to use this option. End-users receive the remediation actions in an Email as an action item. The various available remediation actions for end-users are as follows.

• Report as False Positive with Business Justification: This option allows end users to report false positive alerts and provide a business justification as to why the alert is considered to be false positive.

When end-users report alerts as false positive, you can choose the resolution method to be either Automatic or manual.

If end-users do not take any remediation action, you can set the frequency at which they must receive the notifications to take action.

Managing Violations in Nightfall

Nightfall admins can manage violations from within the Nightfall console. The Events page in Nightfall lists all the violations under the Exfiltration tab. End-users can get a detailed view of each exfiltration violation recorded.

To view violations in Nightfall

1. Navigate to Exfiltration Prevention from the left menu.

Steps 2-6 help you filter the events to only view the alerts generated by Windows OS.

1. Click Filter.

2. Click + Add Filter.

3. Select Integration.

4. Select the Windows check box.

5. Click Apply.

You can click an event to view the details. The detail view window consists of the following tabs.

Summary Tab

The Summary tab consists of the following details.

• Assets: The name of the uploaded asset(s) that was exfiltrated.

• Policy: The name of the policy violated.

• Device ID: The device ID of the device from which the file upload was performed.

The Summary tab also displays a log of activities that occured on the Event. The first log entry is always the asset creation date. The subsequent logs display the actions applied on the event. You can also add comments on the Summary tab. The comments added by you can be viewed by other users as well.

Assets Tab

This tab displays the details of the asset (with sensitive data) that was uploaded to a domain or cloud storage app. The asset tab also displays a number in brackets. This number indicates the number of assets that were uploaded as part of the event.

In the following image, there were two assets which were uploaded, and these four uploads together triggered the event. In such cases when there are multiple assets involved, you can use the drop-down menu to switch between assets and view the asset details.

The Assets tab displays the following details.

• Name: The name of the asset uploaded.

• Where: The location of the asset in the device.

• Medium: The medium used to upload the asset.

Asset History

The Assets tab also contains the Asset History section. This section displays the source or origin from where the asset was downloaded. Additionally, it also displays the destinations to which the asset was uploaded. If the source and destination details are not available, this section does not display any information. Users can use the time filter to view historic data.

Device Tab

The device tab displays the details of the device used to upload the asset. You can view the following details on this tab.

• Device ID: The device ID of the device from which the asset was uploaded.

• Device Name: The name of the device from which the asset was uploaded.

• Connection Status: The current status of the device. This can either be Connected or Disconnected. If the device is not in contact with the Nightfall agent for more than 6 hours, the connection status changes to disconnected.

This document explains what admins can do when a macOS policy is violated.

Managing Violations in Nightfall

Nightfall admins can manage violations from within the Nightfall console. The Events page in Nightfall lists all the violations under the Exfiltration tab. End-users can get a detailed view of each exfiltration violation recorded.

To view violations in Nightfall

Please note there are two parts to this process:

1. Deploy the "mobileconfig" that pushes the profile and permissions.

The Exfiltration policies for MAC and Windows OS allow you to monitor if there are any uploads via browser or cloud storage apps. You can configure the domains in Internet that needs to be monitored and also the cloud storage apps which need to be monitored.

When there are any uploads to the configured domain or cloud storage apps, the Nightfall AI agent notifies this action. You can configure the notification channels through which you wish to receive notifications when there is an attempt to upload files/folders.

Verify Connection

Once you have completed the installation of the Nightfall agent, you must ensure that the connection is live. If the Nightfall agent cannot connect to the macOS or the Windows OS device for more than 6 hours, the connection is lost. When the connection is live, a

This document explains the process of installing the Nightfall agent manually.

Prerequisites

1. Ensure that you have root level access to the target macOS device.

2. On your Nightfall console, navigate to and click the Download Package button on the top right corner of the page. Click Download Package for macOS and unpack the contents of the downloaded file.

3. Create a default policy for web browser uploads and cloud storage application sync.

Installing the Package

1. Locate the mdm_pre_installation_script.sh in the payload downloaded from Nightfall.

2. Open a Terminal window.

3. Run the mdm_pre_installation_script.shscript on your local machine as a root user, by executing the following command.

1. Double click the provided nightfall-ai-agent_<version>.pkg.

2. Click Continue.

1. Click Install.

1. Click Use Password to enter your device password and start the installation process.

Once the installation is completed, you get a completion message as shown in the following image.

1. Click Close.

At the top right corner of your screen, you can view the Nightfall AI agent icon which looks as follows.

When you click this icon, you can view the details of the agent.

Grant System Permissions

These system permissions and handled automatically through MDM profiles. For manual install, enabling these permissions manually is required.

Grant Full Disk Access

To monitor your MAC device, you must grant access to the hard disk. This section explains the process of granting disk access.

1. Navigate to System Settings > Privacy & Security > Full Disk Access.

1. If Nightfall is listed, make sure to toggle the permission to ON

2. [Optional] Should Nightfall not be listed in the primary list

   1. Click the + icon at the bottom of the list (you may be prompted to enter your macOS password)

1. Select NightfallAIAgent (under Applications) and click Open.

1. Click Quit & Reopen.

On the Full Disk Access page, ensure that the toggle switch is turned on for the NightfallAIAgent. This ensures that the full disk access is granted.

Grant Accessibility Permissions

For clipboard monitoring, you must grant the Nightfall agent accessibility permissions. This section explains the process.

1. Navigate to System Settings > Privacy & Security > Accessibility.

1. If Nightfall is listed, make sure to toggle the permission to ON

1. [Optional] If Nightfall is not listed in the primary list

   1. Click the + icon at the bottom of the list (you may be prompted to enter your macOS password)

b. Select NightfallAIAgent (under Applications) and click Open.

c. On the Accessibility settings page, ensure that the toggle switch is turned on for the NightfallAIAgent. This ensures that the full disk access is granted.

Reboot The Agent

To ensure changes are picked up by the agent:

1. Open Activity Monitor > Search of Nightfall > you should see two Nightfall processes running

   1. If you do not see two Nightfall processes, make sure to expand your view to all processes

Grant Browser Permissions

Apart from the disk access and accessibility permissions, you must also grant permission to the Nightfall AI agent to monitor browser uploads. This section explains the process.

To grant access to browser uploads:

1. Open a browser instance and upload a test file to any destination.

2. When prompted, grant the Nightfall AI agent permissions.

Nightfall delivers broad browser coverage with full data exfiltration protection across modern AI browsers and traditional browsers. Customers can confidently deploy Nightfall across supported environments without compromising on security or feature depth.

Supported Browsers

AI Browsers

• Perplexity Comet (macOS only)

• ChatGPT Atlas (macOS only)

Chromium-Based Browsers

• Google Chrome

• Microsoft Edge

• Arc

• Brave

Other Browsers

• Firefox

Operating System Support

1. macOS - The following browsers are supported on macOS:

   1. Chrome

   2. Edge

Uninstalling the Nightfall AI Agent

To uninstall the Nightfall AI agent, locate the uninstallation script provided as part of the deployment bundle. You must execute the following command on your MAC device, as a root user.

Nightfall for macOS and Nightfall for Windows OS allow you to configure alerts at the policy level and also at the integration level.

You can navigate to the alerts page by executing the following steps:

1. Click Integrations in the left pane.

2. Click Manage for either Endpoint macOS or Endpoint Windows widget.

3. Click the Alerting tab.

Alerts can be sent in macOS and windows OS policies by using the following alert channels.

• Slack

• Email

• Webhook

• Jira Tickets

When you configure alert settings at the integration level, the alert settings apply to all the policies, created for the macOS/Windows OS integration. However, when you configure alert settings specifically for a policy, which is created in the macOS/Windows OS integration, the alert settings are applicable only for that specific policy.

This document explains how to configure alerts at the integration level. To learn about how to configure alerts at the policy level, read .

Prerequisites

• To use Slack as an alert platform, you must first perform the required Slack configurations. You can refer to to learn more about how to configure Slack as an Alert platform.

• To use Webhook as an alert platform, you must first perform the required Webhook configurations. You can refer to to learn more about how to configure Webhook as an Alert platform.

• To use JIRA as an alert platform, you must have the DLP for the JIRA app installed from the . You can read more about the DLP for JIRA integration .

Configure Alerts at the Integration Level

You can configure alerts at the integration level once you have installed the Nightfall for macOS/ Nightfall for Windows OS integration.

To configure alerts at the integration level:

1. Navigate to the macOS integration

2. Scroll down to the Alerting section.

3. You can configure one or multiple alert channels.

Configuring Slack as an Alert Channel

1. To configure Slack as an alert channel, click + Slack channel.

1. In the Slack alert channel field, enter the name of the Slack channel in which you wish to receive the alerts.

2. Click Save.

A confirmation pop-up box is displayed to confirm if the Slack channel (entered in the second step) must be used only for macOS integration or all the Nightfall integrations.

1. Select No, only integration level to use the Slack channel only for macOS, or select Yes, please to use the selected Slack channel for all the Nightfall integrations.

Configuring Email as an Alert Channel

1. Click + Email.

1. Enter the Email ID of the recipient who should receive the notifications.

2. Click Save.

A confirmation pop-up box is displayed to confirm if the Email ID (entered in the second step) must be used only for macOS integration or all the Nightfall integrations.

1. Select No, only integration level to use the Slack channel only for macOS, or select Yes, please to use the selected email address for all the Nightfall integrations.

Configuring Webhook as an Alert Channel

1. Click + Webhook.

2. Enter the Webhook URL.

3. Click Test. If the test result is not successful, check the Webhook URL.