Nightfall supports both manual and automated remediation on policy violations. However, you cannot view policy violations on the Nightfall dashboard or violations monitoring page.

The following table displays the remediation actions that are supported for Nightfall for Salesforce:

Legend:

NOTE: The Redact and delete action is not supported on "picklist" field types.

Remediating Policy Violations

You can view policy violation alerts on the channel that you configured - Slack or Email. Within the channel, you can perform remediation action on the alert sent by Nightfall.

Automating Remediation

You can automate remediation actions from Nightfall console.

Under Automated Actions, check any or all of the options.

• Delete

• Redact

You are set up for Nightfall to work with your Salesforce instance.

Remediation Notifications

You can configure the remediation notifications:

• Manual Remediate

• Automatic Remediation

Manual Remediation

The following payload is sent to the designated webhook when a manual remediation is performed for a violation, which indicates which fields have been modified on a given object.

{
 "eventType": "remediation",
 "message": "mohit+prod@nightfall.ai deleted finding(s).",
 "remediationMetadata": {
   "ActionUser": "mohit+prod@nightfall.ai",
   "actionType": "delete",
   "fields": "description",
   "objectName": "Case",
   "remediationType": "manual",
   "success": true,
   "unchangedFields": ""
 },
 "remediationTime": "22 Jun 2022 at 6:38AM UTC",
 "service": "Salesforce",
 "timestamp": "2022-06-22T06:38:07Z",
 "violationID": "CRY7XI"
}

Automated Remediation

The following payload will be sent to the designated webhook when Nightfall automatically remediates a violation, which indicates which fields have been modified on a given object.

{
 "eventType": "remediation",
 "message": "Automatically remediated finding(s) via an automated action configured on your Nightfall dashboard.",
 "remediationMetadata": {
   "ActionUser": "",
   "actionType": "",
   "fields": "description",
   "objectName": "Case",
   "remediationType": "automated",
   "success": true,
   "unchangedFields": ""
 },
 "remediationTime": "22 Jun 2022 at 6:40AM UTC",
 "service": "Salesforce",
 "timestamp": "2022-06-22T06:40:04Z",
 "violationID": "JVXIZS"
}

You should now be all set to start using the Salesforce integration, as well as to manage your alerts as they start to come in.

For any support questions, please feel free to continue to explore the Help Center, specifically the Salesforce FAQs section below, or to reach out to support@nightfall.ai:

When Nightfall detects a violation in your Salesforce instance, and you have configured it to redact the violation, the sensitive information within the field is masked. All characters in the message, except the first two, are masked.

Nightfall can delete the entire message that violates a configured policy. This remediation action is very useful for serious policy violations that risk data exposure and non-compliance.

Each time Nightfall detects a policy violation in an object or fields in Salesforce instances that it is monitoring, the sensitive information is deleted automatically if it is configured as an automated action.

Deleted data cannot be retrieved.