[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8},"actionData","errors","root",{"_142":143,"_144":145,"_146":147,"_20":21,"_148":-7,"_149":150,"_151":152,"_153":154,"_155":-5,"_156":56,"_157":56,"_158":-5,"_159":-5,"_160":161,"_162":163,"_164":165,"_166":167},"docs-content",{"_9":10,"_10":11,"_12":13,"_14":15,"_16":17,"_18":19},"type","article",{"_90":122,"_112":121,"_123":124,"_125":126,"_127":-5,"_128":108,"_129":130,"_131":132,"_22":133,"_24":25,"_134":-5,"_135":136,"_137":-5,"_138":139,"_140":141},"breadcrumbData",{"_117":118,"_119":120},"prevArticle",{"_22":114,"_90":115,"_112":116},"nextArticle",{"_22":110,"_90":111,"_112":113},"context",{"_20":21},"portal",{"_22":23,"_24":25,"_26":27,"_28":20,"_29":27,"_30":31,"_32":33,"_34":31,"_35":-5,"_36":-5,"_37":38,"_39":40,"_41":42,"_43":44,"_45":46,"_47":48,"_49":50,"_51":52,"_53":54,"_55":56,"_57":56,"_58":59,"_60":61},"id","efd2194f-6705-4496-ab07-a49c2753313a","tenantId","u-nightfall-268wm","isExternal",true,"mode","isEnabled","customDomain","support-test.nightfall.ai","defaultDomain","nightfall.help.unthread.io","canonicalDomain","signInEmailSender","previewUrl","projectIds",[108,109],"customLinks",[],"featuredCollections",[],"ticketTypeSections",[101],"settings",{"_94":95,"_96":97,"_98":99,"_100":27},"identityPlatformTenantId","e-nightfall-a1hll","homepageMetadata",{"_90":91,"_92":93},"loginMethods",[84,85,86],"statusBanner",{"_76":27,"_77":78,"_79":80,"_81":82,"_83":27},"requireAuthentication",false,"restrictLoginToAccountDomains","embedAllowedOrigins",[],"tenant",{"_22":25,"_62":63,"_64":65,"_66":67,"_68":69},"name","Nightfall AI","subdomain","nightfall","allowedEmailDomains",[75],"allowedPriorities",{"_70":56,"_71":27,"_72":27,"_73":27,"_74":27},"1","3","5","7","9","nightfall.ai","enabled","message","Status: No Nightfall outages to be reported!","variant","success","linkText","Status","dismissible",{"_9":89,"_76":27},{"_9":88,"_76":56},{"_9":87,"_76":56},"sso","emailPassword","magicLink","title","Nightfall's Very Cool Definitely Not Fake Customer Portal","description","As a Nightfall customer, you can view all of your cases, KBs, and account info from a one-stop-shop area.","logoUrl","https://firebasestorage.googleapis.com/v0/b/trnout-co.appspot.com/o/u-nightfall-268wm%2Fslack%2Fnightfall-ai-agent-signed.png?alt=media","primaryColor","#5e14d4","darkThemeAccentColor","#16004d","allowDirectTicketCreation",{"_22":102,"_62":103,"_104":105},"f53680b9-f0f9-47e3-a405-53b35b9078b0","New Section","ticketTypeIds",[106,107],"810107f1-6890-4bf2-a414-63d07f94fbc4","2c9745f4-bf8a-45f3-8019-c695c9b85c9a","67158acb-8233-487f-bd1b-37ab3fd992b4","da679875-adf9-42f3-b616-d42e4735a1ba","c79d0c51-84f8-41d3-be93-37085c529cdb","How to Confirm that the Nightfall Endpoint Agent Process is Running on macOS | Nightfall AI Knowledge Base","slug","how-to-confirm-that-the-nightfall-endpoint-agent-process-is-running-on-macos-nightfall-ai-knowledge-","81a66ced-7c22-49c9-a1e3-36f231a6764f","Detection Rules | Nightfall AI Knowledge Base","detection-rules-nightfall-ai-knowledge-base","currentItem",{"_22":121,"_62":122,"_9":10},"breadcrumbs",[],"endpoint-nightfall-ai-knowledge-base","Endpoint | Nightfall AI Knowledge Base","url","https://kb.nightfall.ai/collections/8780305235-endpoint","content","Nightfall macOS Agent: How to Add the Nightfall Chrome ExtensionSettings to an Existing Non-Nightfall Profile\n\n›\n","collectionId","projectId","createdAt","2026-08-03T17:22:49.920Z","updatedAt","2026-08-03T17:22:49.948Z","5f1ffde2-f84d-436c-9d4f-1c8ec0a05ef4","collection","collectionPath",[],"hostedUrl","userGroups",[],"channels",[],"cspNonce","b9dad3a5f07198178e85d14442deec3880f33ffe1c370609c7eb9bd380162bf3","firebaseConfig",{"_757":758,"_759":31,"_128":760},"session",{"_752":753,"_754":27},"inAppChat","mixpanelToken","cc23843c498db1553f595eae3fae57d7","sentryDsn","https://cd638f7e7e056e6e02d1d91f09ba2fa9@o563911.ingest.us.sentry.io/4510302612946944","environment","prd","theme","isMac","isEmbed","embedConfig","userProfile","projects",[739,740],"articles",[583,584,585,586,587,588,589,590,591,592,593,594,595,596,597,598,599,600,601,602,603,604,605,606,607,608,609,610,611,612,613,614,615,616,617,618,619,620,621],"collections",[],"uncategorizedArticles",[168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206],{"_90":573,"_112":574,"_123":575,"_125":576,"_127":-5,"_128":108,"_129":577,"_131":578,"_22":579,"_24":25,"_134":-5,"_135":580,"_137":-5,"_138":581,"_140":582},{"_90":563,"_112":564,"_123":565,"_125":566,"_127":-5,"_128":108,"_129":567,"_131":568,"_22":569,"_24":25,"_134":-5,"_135":570,"_137":-5,"_138":571,"_140":572},{"_90":553,"_112":554,"_123":555,"_125":556,"_127":-5,"_128":108,"_129":557,"_131":558,"_22":559,"_24":25,"_134":-5,"_135":560,"_137":-5,"_138":561,"_140":562},{"_90":543,"_112":544,"_123":545,"_125":546,"_127":-5,"_128":108,"_129":547,"_131":548,"_22":549,"_24":25,"_134":-5,"_135":550,"_137":-5,"_138":551,"_140":552},{"_90":115,"_112":116,"_123":536,"_125":537,"_127":-5,"_128":108,"_129":538,"_131":539,"_22":114,"_24":25,"_134":-5,"_135":540,"_137":-5,"_138":541,"_140":542},{"_90":122,"_112":121,"_123":124,"_125":126,"_127":-5,"_128":108,"_129":130,"_131":132,"_22":133,"_24":25,"_134":-5,"_135":533,"_137":-5,"_138":534,"_140":535},{"_90":111,"_112":113,"_123":526,"_125":527,"_127":-5,"_128":108,"_129":528,"_131":529,"_22":110,"_24":25,"_134":-5,"_135":530,"_137":-5,"_138":531,"_140":532},{"_90":516,"_112":517,"_123":518,"_125":519,"_127":-5,"_128":108,"_129":520,"_131":521,"_22":522,"_24":25,"_134":-5,"_135":523,"_137":-5,"_138":524,"_140":525},{"_90":506,"_112":507,"_123":508,"_125":509,"_127":-5,"_128":108,"_129":510,"_131":511,"_22":512,"_24":25,"_134":-5,"_135":513,"_137":-5,"_138":514,"_140":515},{"_90":496,"_112":497,"_123":498,"_125":499,"_127":-5,"_128":108,"_129":500,"_131":501,"_22":502,"_24":25,"_134":-5,"_135":503,"_137":-5,"_138":504,"_140":505},{"_90":486,"_112":487,"_123":488,"_125":489,"_127":-5,"_128":108,"_129":490,"_131":491,"_22":492,"_24":25,"_134":-5,"_135":493,"_137":-5,"_138":494,"_140":495},{"_90":476,"_112":477,"_123":478,"_125":479,"_127":-5,"_128":108,"_129":480,"_131":481,"_22":482,"_24":25,"_134":-5,"_135":483,"_137":-5,"_138":484,"_140":485},{"_90":466,"_112":467,"_123":468,"_125":469,"_127":-5,"_128":108,"_129":470,"_131":471,"_22":472,"_24":25,"_134":-5,"_135":473,"_137":-5,"_138":474,"_140":475},{"_90":457,"_112":65,"_123":458,"_125":459,"_127":-5,"_128":108,"_129":460,"_131":461,"_22":462,"_24":25,"_134":-5,"_135":463,"_137":-5,"_138":464,"_140":465},{"_90":447,"_112":448,"_123":449,"_125":450,"_127":-5,"_128":108,"_129":451,"_131":452,"_22":453,"_24":25,"_134":-5,"_135":454,"_137":-5,"_138":455,"_140":456},{"_90":437,"_112":438,"_123":439,"_125":440,"_127":-5,"_128":108,"_129":441,"_131":442,"_22":443,"_24":25,"_134":-5,"_135":444,"_137":-5,"_138":445,"_140":446},{"_90":427,"_112":428,"_123":429,"_125":430,"_127":-5,"_128":108,"_129":431,"_131":432,"_22":433,"_24":25,"_134":-5,"_135":434,"_137":-5,"_138":435,"_140":436},{"_90":417,"_112":418,"_123":419,"_125":420,"_127":-5,"_128":108,"_129":421,"_131":422,"_22":423,"_24":25,"_134":-5,"_135":424,"_137":-5,"_138":425,"_140":426},{"_90":407,"_112":408,"_123":409,"_125":410,"_127":-5,"_128":108,"_129":411,"_131":412,"_22":413,"_24":25,"_134":-5,"_135":414,"_137":-5,"_138":415,"_140":416},{"_90":397,"_112":398,"_123":399,"_125":400,"_127":-5,"_128":108,"_129":401,"_131":402,"_22":403,"_24":25,"_134":-5,"_135":404,"_137":-5,"_138":405,"_140":406},{"_90":387,"_112":388,"_123":389,"_125":390,"_127":-5,"_128":108,"_129":391,"_131":392,"_22":393,"_24":25,"_134":-5,"_135":394,"_137":-5,"_138":395,"_140":396},{"_90":377,"_112":378,"_123":379,"_125":380,"_127":-5,"_128":108,"_129":381,"_131":382,"_22":383,"_24":25,"_134":-5,"_135":384,"_137":-5,"_138":385,"_140":386},{"_90":367,"_112":368,"_123":369,"_125":370,"_127":-5,"_128":108,"_129":371,"_131":372,"_22":373,"_24":25,"_134":-5,"_135":374,"_137":-5,"_138":375,"_140":376},{"_90":357,"_112":358,"_123":359,"_125":360,"_127":-5,"_128":108,"_129":361,"_131":362,"_22":363,"_24":25,"_134":-5,"_135":364,"_137":-5,"_138":365,"_140":366},{"_90":347,"_112":348,"_123":349,"_125":350,"_127":-5,"_128":108,"_129":351,"_131":352,"_22":353,"_24":25,"_134":-5,"_135":354,"_137":-5,"_138":355,"_140":356},{"_90":337,"_112":338,"_123":339,"_125":340,"_127":-5,"_128":108,"_129":341,"_131":342,"_22":343,"_24":25,"_134":-5,"_135":344,"_137":-5,"_138":345,"_140":346},{"_90":327,"_112":328,"_123":329,"_125":330,"_127":-5,"_128":108,"_129":331,"_131":332,"_22":333,"_24":25,"_134":-5,"_135":334,"_137":-5,"_138":335,"_140":336},{"_90":317,"_112":318,"_123":319,"_125":320,"_127":-5,"_128":108,"_129":321,"_131":322,"_22":323,"_24":25,"_134":-5,"_135":324,"_137":-5,"_138":325,"_140":326},{"_90":307,"_112":308,"_123":309,"_125":310,"_127":-5,"_128":108,"_129":311,"_131":312,"_22":313,"_24":25,"_134":-5,"_135":314,"_137":-5,"_138":315,"_140":316},{"_90":297,"_112":298,"_123":299,"_125":300,"_127":-5,"_128":108,"_129":301,"_131":302,"_22":303,"_24":25,"_134":-5,"_135":304,"_137":-5,"_138":305,"_140":306},{"_90":287,"_112":288,"_123":289,"_125":290,"_127":-5,"_128":108,"_129":291,"_131":292,"_22":293,"_24":25,"_134":-5,"_135":294,"_137":-5,"_138":295,"_140":296},{"_90":277,"_112":278,"_123":279,"_125":280,"_127":-5,"_128":108,"_129":281,"_131":282,"_22":283,"_24":25,"_134":-5,"_135":284,"_137":-5,"_138":285,"_140":286},{"_90":267,"_112":268,"_123":269,"_125":270,"_127":-5,"_128":108,"_129":271,"_131":272,"_22":273,"_24":25,"_134":-5,"_135":274,"_137":-5,"_138":275,"_140":276},{"_90":257,"_112":258,"_123":259,"_125":260,"_127":-5,"_128":108,"_129":261,"_131":262,"_22":263,"_24":25,"_134":-5,"_135":264,"_137":-5,"_138":265,"_140":266},{"_90":247,"_112":248,"_123":249,"_125":250,"_127":-5,"_128":108,"_129":251,"_131":252,"_22":253,"_24":25,"_134":-5,"_135":254,"_137":-5,"_138":255,"_140":256},{"_90":237,"_112":238,"_123":239,"_125":240,"_127":-5,"_128":108,"_129":241,"_131":242,"_22":243,"_24":25,"_134":-5,"_135":244,"_137":-5,"_138":245,"_140":246},{"_90":227,"_112":228,"_123":229,"_125":230,"_127":-5,"_128":108,"_129":231,"_131":232,"_22":233,"_24":25,"_134":-5,"_135":234,"_137":-5,"_138":235,"_140":236},{"_90":217,"_112":218,"_123":219,"_125":220,"_127":-5,"_128":108,"_129":221,"_131":222,"_22":223,"_24":25,"_134":-5,"_135":224,"_137":-5,"_138":225,"_140":226},{"_90":207,"_112":208,"_123":209,"_125":210,"_127":-5,"_128":108,"_129":211,"_131":212,"_22":213,"_24":25,"_134":-5,"_135":214,"_137":-5,"_138":215,"_140":216},"Why a Password Was Not Detected | Nightfall AI Knowledge Base","why-a-password-was-not-detected-nightfall-ai-knowledge-base","https://kb.nightfall.ai/articles/1540998476-why-a-password-was-not-detected","# Why a Password Was Not Detected\n\n**Data type:** Passwords and user credentials\n\n## Issue\n\nA password-like value was present in scanned content but produced no finding, or scored **Possible** and never rose higher. Frequently reported during secrets-and-credentials validation testing.\n\n## Environment\n\nAll content integrations and endpoint scan paths. Describes the native Password detector. Does not apply to custom regex detectors, which match purely on pattern.\n\n## Before troubleshooting: test the sample in the Nightfall Playground\n\nThe Playground returns the model's confidence score for any text you paste, independent of your policies and detection rules.\n\n**→** [**playground.nightfall.ai**](http://playground.nightfall.ai/)\n\nFor passwords, the Playground result splits three ways and each points somewhere different:\n\n| | | |\n| -------------------------------------------- | -------------------------------------------------- | ---------------------------------------------- |\n| Playground result | What it means | Where to look next |\n| Scores above Possible | The detector works. Your policy did not act on it. | Configuration — cause 9 |\n| **Scores exactly Possible and never higher** | Everything matched, then the test-data cap applied | Cause 7 — your test value looks like test data |\n| No finding at all | One of the match criteria wasn't met | Causes 1–6 |\n\nThe middle row is the one people misread. Possible is not a weak signal here; it is frequently a **hard cap** applied to values that look like test data.\n\n## How password detection works\n\nPasswords are the hardest credential category. Modern datasets are full of high-entropy strings that are not passwords — API keys, hashes, internal IDs, UUIDs, tokens, encoded blobs. Entropy alone cannot classify a value as a password at usable precision. The detector therefore requires several conditions to hold together rather than scoring a value on its own merits.\n\n**Match criteria — all must be true, or there is no finding at all:**\n\n1. A **password keyword** sits beside the value\n\n2. The value is **6–40 characters**\n\n3. The value contains **no spaces**\n\n4. The content is **not** a meeting or conferencing context\n\n5. The value is not an **environment variable reference, placeholder, redaction, or money amount**\n\n**Then a confidence cap may apply.** Even when everything matches, confidence is **capped at Possible** if the value looks like test data — see cause 7 for the four triggers.\n\nThe practical consequence: a real credential in an unusual layout produces _nothing_, while a realistic-looking test password in a perfect layout produces _Possible and no more_. Those are different problems with different fixes, and the Playground result tells you which one you have.\n\n## Cause and resolution\n\n### 1. No password keyword near the value\n\nThe detector needs a password keyword in proximity to the high-entropy value. The _relationship_ between the two is flexible — assignment, put/set, email, natural language, and list layouts all qualify. What matters is that a keyword is nearby.\n\nAll of these are evaluated:\n\n```\npassword: Xk7#mQp2vLz9 → assignment\npassword = Xk7#mQp2vLz9 → assignment\nset_password(\"Xk7#mQp2vLz9\") → put/set\nThe password I use for that account is Xk7#mQp2vLz9 → natural language\nSaving my streaming passwords:\n • ServiceA — Xk7#mQp2vLz9 → list\n```\n\nWhat fails is a high-entropy value with no keyword near it at all:\n\n```\nXk7#mQp2vLz9 → no keyword, not evaluated\nHere you go: Xk7#mQp2vLz9 → no password keyword, not evaluated\n```\n\nThis is a deliberate precision mechanism rather than a defect. A random-looking string on its own is indistinguishable from an API key, a hash, a UUID, a build identifier, or a generated token. The keyword is what makes it a password rather than one of those.\n\n**Resolution:** Add a password keyword near the value and re-test. If your production data genuinely contains bare credentials with no nearby label, that is an expected limitation — capture samples and send them to us rather than treating it as a tuning problem.\n\n### 2. The value was shorter than 6 or longer than 40 characters\n\nValues outside the 6–40 character range are not evaluated.\n\n| | |\n| ------------------------- | ------------------------ |\n| Value | Result |\n| `Ab3!x` (5 chars) | Too short, not evaluated |\n| `Xk7#mQp2vLz9` (12 chars) | In range |\n| A 45-character passphrase | Too long, not evaluated |\n\nThe upper bound matters more than it used to. Long passphrases are increasingly recommended by security teams and password managers, and a 41-character passphrase will not be detected.\n\n**Resolution:** Keep test values inside the range. If your organization's password policy encourages passphrases longer than 40 characters, flag it to us — that is a coverage gap worth tracking, not a configuration issue.\n\n### 3. The value contained spaces\n\nValues containing spaces are not recognized. A multi-word passphrase is not evaluated as a password, regardless of how it is labelled or how strong it is.\n\n```\npassword: Xk7#mQp2vLz9 → no spaces, evaluated\npassword: correct horse battery → contains spaces, not evaluated\n```\n\nThis is the second constraint that works against modern passphrase guidance. Combined with the 40-character limit in cause 2, the two properties security teams most actively encourage — long, and multi-word — are both outside what the detector evaluates.\n\n**Resolution:** Do not use spaces in test values. Use punctuation as separators instead. If your organization's password policy encourages spaced passphrases, raise it with us — that is a coverage gap, not a tuning problem.\n\n### 4. The content looked like a meeting invitation\n\nMeeting and conferencing context is excluded deliberately. Meeting passcodes are shared constantly, are low-sensitivity, and would otherwise dominate alert volume.\n\n```\nZoom meeting password: 847592 → excluded by design\n```\n\n**Resolution:** Do not use meeting-style content as a test case. If a genuine credential is being shared inside a meeting invitation, capture the sample — that is a legitimate edge case for Detection.\n\n### 5. The value matched an environment variable, placeholder, redaction, or money shape\n\nThese shapes are excluded before scoring — no finding at all, as distinct from the Possible cap in cause 7.\n\n```\npassword = ${DB_PASSWORD} → environment variable reference\npassword = → redaction\npassword = {{PASSWORD}} → placeholder\npassword = $1,250.00 → money shape\n```\n\n**Resolution:** Confirm your test value is a literal credential, not a reference to one. This is a frequent self-inflicted miss in config files and code samples, where the surrounding material is full of exactly these patterns.\n\n### 6. The model did not classify the value as a credential\n\nThe final match criterion is the ML model itself. A value can satisfy every structural requirement and still not be classified as a password if it does not resemble one.\n\n**Resolution:** Test with values that resemble credentials your users would actually create — see the guidance under cause 7. If a realistic credential with a nearby keyword is not classified, that is the most valuable escalation you can send us, because it is a genuine model gap rather than a structural one.\n\n### 7. It scored Possible and stopped there — the test-data cap\n\nIf the Playground returns Possible and never more, everything matched and then the cap applied. Four triggers apply it, and any one is enough.\n\n**a. The value contains a giveaway substring.** Case-insensitive, matched anywhere inside the value:\n\n| | |\n| ---------- | ----------------------------------------- |\n| Substring | Catches |\n| `pass` | `mypassword1`, `Passw0rd!`, `passphrase9` |\n| `secret` | `MySecret99`, `secret_key1` |\n| `test` | `test_credential`, `Testing123` |\n| `example` | `example_pw1` |\n| `abc` | `abc12345`, `Xabc999!` |\n| `123` | `Password123!`, `a1234567` |\n| `contrase` | `contrasena1`, `micontraseña` |\n\n`pass` and `secret` are the two that surprise people, because they are exactly what someone reaches for when inventing a test credential. `MySecretPass99!` trips both.\n\n**b. The value is on the known-placeholder list.** A curated list of placeholder passwords, matched exactly — not a language dictionary. Common vendor defaults and well-known sample credentials live here.\n\n**c. The value is mostly one or two characters.** If at least 75% of the value is made up of one or two distinct characters, it reads as filler: `aaaaaa1111`, `abababab`.\n\nThis is the mechanism behind the most commonly reported \"misses,\" which are not misses at all:\n\n| | | |\n| -------------------------------------------------- | ------------------ | ------------------------------ |\n| Sample | Outcome | Why |\n| `Bill's password is: FluffyPancakesarethebest123!` | Capped at Possible | Contains `123` |\n| `Here is my password: Password123!@#445` | Capped at Possible | Contains both `pass` and `123` |\n\n**Resolution:** Re-test with a value that avoids all four triggers. A working recipe:\n\n| | |\n| --------------------------------------------------------------------- | ----------- |\n| Requirement | Avoids |\n| 6–40 characters | Cause 2 |\n| No spaces | Cause 3 |\n| None of `pass`, `secret`, `test`, `example`, `abc`, `123`, `contrase` | Trigger (a) |\n| Not a common placeholder or vendor default | Trigger (b) |\n| No long runs of one or two repeated characters | Trigger (c) |\n\n```\npassword: Xk7#mQp2^vLz9 → satisfies all six\npassword: MySecretPass99! → contains \"secret\" and \"pass\", capped\npassword: Sunflower1 → single token, capped\npassword: correct horse jump → spaces, not evaluated at all\n```\n\n**Worth confirming with Detection:** the exact token-splitting rule — whether digits or case changes count as boundaries alongside punctuation — and the contents of the known-placeholder list.\n\n### 8. The test data was not representative of production content\n\nSynthetic strings behave differently from real credentials in real containers. Credentials in realistic account notes, config files, login records, or onboarding documents are far better representations of how the detector performs.\n\n**Resolution:** Ask for sanitized examples that resemble the actual environment. These are the most valuable test cases and the most valuable escalation artifacts.\n\n### 9. Coverage or configuration gap\n\nVerify the detector ran at all: is it deployed on that integration, is rule scope set to Content, and are minimum confidence and minimum findings filtering the result out? Note that a policy set to **Likely** or higher will suppress every Possible-capped finding from cause 7 — which is the correct behavior, but it means those findings exist and are simply never surfaced.\n\n### 10. A custom password detector is interfering\n\nCustom \"Password\" detectors frequently fire on the literal word `password` rather than on a credential value, generating heavy noise. The inverse also occurs — an over-tightened custom detector misses real credentials the native detector would have caught.\n\n**Resolution:** Where a custom detector exists, test the same samples against the native detector before tuning either one.\n\n## Recommended configuration\n\nStart with the native Password detector at **Very Likely** for chat and collaboration surfaces. In most deployments this gives the best balance of coverage and manageable noise.\n\nThen run a feedback loop:\n\n- Report false positives — they directly refine model precision\n\n- Share sanitized examples of credentials that were **missed** — the only way misses get addressed\n\n- Adjust based on observed results rather than changing thresholds preemptively\n\nNote that lowering the threshold to **Possible** will surface every capped value from cause 7. That is usually the opposite of what a customer wants, since those values are test data by definition.\n\n## Reporting a missed detection to Nightfall Support\n\n**Non-findings are not retained.** A missed password cannot be reconstructed after the fact.\n\nContact Nightfall Support and include these three items at minimum:\n\n| | |\n| -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |\n| Required | Detail |\n| **Sanitized sample** | The value **and its surrounding text, exactly as it appeared** — including the nearby keyword and the layout. Substitute the credential characters, but preserve length and character classes. A value sent on its own cannot be tested, because keyword proximity is itself one of the match criteria. |\n| **Time of the test** | Date and time including time zone, so Support can correlate against scan and policy logs. |\n| **Environment** | Where the test ran — Slack, endpoint (specify copy/paste, file upload, or screenshot), Google Drive, Outlook, Teams, OneDrive, Jira, Zendesk, or the specific integration. |\n\nAlso helpful, in rough order of value:\n\n1. Your Playground result — and specifically whether it returned **Possible** or **nothing at all**. These are different problems with different fixes.\n\n2. The value's character count\n\n3. The container type — chat message, code file, config file, document, credential list\n\n4. Detection rule configuration: scope, minimum confidence, minimum findings\n\n5. Whether a custom password detector is deployed alongside the native one\n\n## Triage sequence\n\n1. Paste the sample into the Playground, with its surrounding text intact, and record the result.\n\n2. **Possible and no higher** → test-data cap; work cause 7. Re-test with a value that avoids all four triggers.\n\n3. **Nothing at all** → one of the match criteria wasn't met. Check in this order: adjacent keyword (cause 1), length (cause 2), spaces (cause 3), meeting context (cause 4), env/placeholder/money shape (cause 5).\n\n4. **Scored above Possible in the Playground but the policy did not fire** → configuration; work causes 9 and 10.\n\n5. If a realistic credential with a nearby keyword still returns nothing, that is a model gap — escalate; it is the highest-value report you can send.\n\n6. Still unexplained → contact Nightfall Support with a sanitized sample, the time of the test, and the environment.\n","2026-08-03T17:22:59.301Z","2026-08-03T17:22:59.530Z","c2e56104-f8ca-44d3-be8d-41c434d40f9e",[],[],[],"Why an API Key or Secret Was Not Detected | Nightfall AI Knowledge Base","why-an-api-key-or-secret-was-not-detected-nightfall-ai-knowledge-base","https://kb.nightfall.ai/articles/6561685277-why-an-api-key-or-secret-was-not-detected","# Why an API Key or Secret Was Not Detected\n\n**Data type:** API keys, tokens, and secrets **Article type:** Known behavior / troubleshooting\n\n## Issue\n\nAn API key, token, or secret was present in scanned content but produced no finding, or scored lower than expected. Also covers the frequent report that key detection is \"inconsistent\" — working for some keys and not others.\n\n## Environment\n\nAll content integrations and endpoint scan paths.\n\n## Before troubleshooting: test the sample in the Nightfall Playground\n\nThe Playground returns the model's confidence score for any text you paste, independent of your policies and detection rules.\n\n**→** [**playground.nightfall.ai**](http://playground.nightfall.ai/)\n\n| | | |\n| ---------------------------------------- | ------------------------------------------------------------ | ------------------------------------------------- |\n| Playground result | What it means | Where to look next |\n| Scores at or above your policy threshold | The detector works. Your policy did not act on it. | Configuration — cause 4 |\n| Scores below your policy threshold | The key was recognized, but the surrounding context was weak | Cause 1, or cause 2 if it came from a table |\n| No finding at all | The key pattern did not match | Cause 3, or cause 4 if the format is one of yours |\n\n**Test the key in isolation and then with context**, and compare. That single comparison separates a context problem from a pattern problem faster than anything else in this article.\n\n## Cause and resolution\n\n### 1. The key was recognized but had no context around it\n\nA bare key with nothing around it **cannot reach Very Likely**. Because the final score averages the pattern match with the context score, an isolated key is capped by the weak half of that average no matter how perfect the pattern is.\n\n```\nAWS_ACCESS_KEY_ID=AKIA… → key pattern plus strong context\napi_key: AKIA… → key pattern plus strong context\nAKIA… (alone in a message) → pattern matches, no context, cannot reach Very Likely\n```\n\nThis is the most common reason a key that \"obviously should have been caught\" is missing from a policy set to Very Likely. The detector found it; the policy filtered it out.\n\n**Resolution:** If bare keys need to be caught, set the rule to **Likely** and measure the noise impact. Testing at Very Likely with a context-free sample will always understate what the detector is actually finding.\n\n### 2. The key was in a table and the column header was lost\n\nWhen a key sits in a table, the column header — `API Key`, `Token`, `Secret` — is usually the only context available. Whether it survives depends on the file type.\n\n_Header preserved: CSV, Excel, and other structured data files._ Each value stays tied to its column:\n\n```\nservice: payments-api\nenvironment: production\nAPI Key: sk_live_4eC39HqLyjWDarjtT1zdp7dc\nowner: platform-team\n```\n\nThe label sits right next to the key. Strong context, high score.\n\n_Header lost: images of tables and HTML tables._ Screenshots, photos, PDFs, and HTML flatten into a single run of text:\n\n```\npayments-api production sk_live_4eC39HqLyjWDarjtT1zdp7dc platform-team\n```\n\nThe header row appears **once**, at the top. Every row after it is pushed further away:\n\n```\nService Env API Key Owner ← the only place \"API Key\" appears\nRow 1 … … sk_live_4eC39… … ← header is ~30 characters back\nRow 2 … … sk_live_9fD21… … ← ~110 characters back\nRow 40 … … sk_live_7bA84… … ← thousands of characters back\n```\n\nThe detector looks for context within a short window around the value. Once the header falls outside it, each key is evaluated with nothing around it — and by cause 1, that means it cannot reach Very Likely.\n\nThis is why partial detection down a long column is such a common report. The first rows are close enough to the header; the rest are not.\n\n**Resolution:** Scan the source file directly where you can — a CSV or spreadsheet will always outperform a screenshot of the same data. Where image and HTML coverage matters, lower the rule to **Likely**.\n\n### 3. One character was misread during OCR, breaking the pattern\n\nThis hits API keys harder than any other data type, for a simple reason: **keys are long**. A provider key can run 40, 50, or more characters, and the pattern has to match all of them. One misread character and the pattern fails — there is no partial match and no lower-confidence finding. The key simply is not there.\n\nThe common OCR confusions are exactly the characters keys are built from:\n\n| | |\n| ---------- | ------------------------ |\n| Misread as | Frequently confused with |\n| `0` | `O`, `o`, `D` |\n| `1` | `l`, `I`, \\` |\n| `5` | `S` |\n| `8` | `B` |\n| `rn` | `m` |\n| `-` | `–`, `—`, `_` |\n\nThe risk compounds with length. A 40-character key gives OCR forty chances to make one fatal error; a nine-digit SSN gives it nine. This is why key detection from screenshots is noticeably less reliable than key detection from text, even when the image looks perfectly legible.\n\n```\nsk_live_4eC39HqLyjWDarjtT1zdp7dc → matches the pattern\nsk_live_4eC39HqLyjWDarjtTlzdp7dc → digit 1 read as lowercase L, no match\n```\n\n**Resolution:** Confirm whether the same key detects correctly as plain text. If it does, the problem is extraction, not detection. Send the original full-resolution image — a re-screenshot of a screenshot compounds the quality loss and often will not reproduce.\n\n### 4. Coverage or configuration gap\n\nTwo different things get reported the same way.\n\n**The detector never ran.** Check:\n\n- Is secret detection deployed on the integration where the content lives? The common gap in engineering organizations is coverage on chat and file storage but not on code hosting or ticketing.\n\n- Is the detection rule **scope** set to Content, not File Name only?\n\n- Are **minimum confidence** or **minimum number of findings** filtering the result out?\n\n- Is the policy in monitor-only mode with no automation and no end-user notification? That is experienced as \"nothing happened.\"\n\n**The key format is one of yours.** Internally-issued keys, and keys from providers our model has not yet learned. We can add support for your format.\n\n**Resolution:** For an internal or unsupported key format, send us sanitized examples that preserve the prefix, length, and character set. Several examples are much better than one, since the pattern has to describe the variation as well as the shape. In the meantime, a custom regex detector anchored on your prefix is usually quick to stand up and often the right long-term answer for internal formats — but check the supported provider list in cause 5 first, so you are not rebuilding something that already exists.\n\n### 5. A custom key detector is interfering\n\nCustom \"API Key or Token\" regex detectors are consistently the largest noise source in tuning reviews — over-broad patterns matching any long alphanumeric string. The inverse also occurs: a hand-tightened custom regex misses real keys the native detectors would have caught.\n\nThe most common way this starts is a custom detector built for a provider we already cover.\n\n### ⓘ Important: before building a custom detector for a specific vendor\n\nCheck whether we already support it. A duplicate detector competes with the native one, and the native detector does something a regex cannot — it **validates the key against that vendor's service** to determine whether it is real and still live.\n\n**Vendors and services we support:**\n\nAnthropic · Auth0 · AWS · Amazon MWS · Azure · Box · Coinbase · Cohere · Confluence · Confluent · Databricks · Datadog · Dropbox · Elasticsearch · Facebook · GCP · GitHub · GitLab · Google API · Heroku · Hugging Face · Jira · JWT · Nightfall · Notion · Okta · OneLogin · OpenAI · PagerDuty (Events and REST) · PayPal · Perplexity · Ping Identity · Plaid · Postman · Postmark · RapidAPI · Salesforce · SendGrid · Shopify · Slack · Slack Webhook · Snyk · Splunk · Square · Stripe · Telegram Bot · Twilio · Twitter · Zapier\n\n**Plus generic token classes**, recognized by shape and reported without validation since there is no single service to check them against:\n\naccess token · API key · authentication token · broker token · CSRF token · encryption key · geo tag · ID token · OAuth token · private key · refresh token · session token · generic token · unknown token\n\n**On the list?** Use the native detector and tune it rather than building your own. If it is not firing, the cause is elsewhere — work causes 1, 2, and 3.\n\n**Not on the list?** A custom detector is the right answer, and worth sending to us as an enhancement request at the same time (cause 4).\n\n**Resolution:** Where a custom key detector is deployed, test the same samples against the native detectors before tuning either one. For over-broad custom detectors, raise confidence, tighten the regex, and run a tuning session against recent false positive examples. Where a custom detector duplicates a supported vendor, retiring it usually resolves both the noise and the attribution confusion at once.\n\n## What not to do\n\n**Do not lower confidence to Possible as a general fix.** It will surface large volumes of ordinary high-entropy strings — hashes, UUIDs, build identifiers, encoded blobs. Validate any threshold change in the Playground or an isolated test policy first.\n\n## Reporting a missed detection to Nightfall Support\n\n**Non-findings are not retained.** A missed key cannot be investigated retroactively — there is no stored artifact.\n\nContact Nightfall Support and include these three items at minimum:\n\n| | |\n| -------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |\n| Required | Detail |\n| **Sanitized sample** | Replace the random portion of the key, but **preserve the prefix, the length, the character set, and the surrounding text**. Those are exactly what the pattern matches on. A key reduced to `sk_live_…` cannot be tested. |\n| **Time of the test** | Date and time including time zone, so Support can correlate against scan and policy logs. |\n| **Environment** | Where the test ran — Slack, endpoint (specify copy/paste, file upload, or screenshot), Google Drive, Outlook, Teams, OneDrive, Jira, Zendesk, GitHub, or the specific integration. |\n\nAlso helpful, in rough order of value:\n\n1. **Which provider issued the key**, or confirmation that it is an internal format\n\n2. Your Playground result — and whether it scored low or returned nothing. Different problems.\n\n3. Whether the same key detects as plain text but not from the image or table\n\n4. Whether _some_ keys in the file were detected and others were not\n\n5. Detection rule configuration: scope, minimum confidence, minimum findings\n\n6. Whether a custom key detector is deployed alongside the native ones\n\n## Triage sequence\n\n1. Paste the key into the Playground twice — once bare, once with it's native code or configuration context. Compare the two scores.\n\n2. Bare scores low, labelled scores high → context, cause 1. The fix is the policy threshold, not the detector.\n\n3. Neither returns anything → the pattern did not match. If the source was an image, work cause 3. If the key is an internal format, work cause 4.\n\n4. Came from a table or spreadsheet → cause 2. Re-test the same data as a direct file upload.\n\n5. Scored in the Playground but the policy did not fire → configuration, cause 4.\n\n6. A custom key detector is in play → compare against the native detectors, cause 5.\n\n7. Still unexplained → contact Nightfall Support with a sanitized sample, the time of the test, and the environment.\n","2026-08-03T17:22:59.680Z","2026-08-03T17:22:59.749Z","603e41cc-455b-4801-ae86-02b5484a1301",[],[],[],"Why a Government ID (SSN, National ID, Tax ID, Passport) Was Not Detected | Nightfall AI Knowledge Base","why-a-government-id-ssn-national-id-tax-id-passport-was-not-detected-nightfall-ai-knowledge-base","https://kb.nightfall.ai/articles/2647070131-why-an-api-key-or-secret-was-not-detected","# Why a Government ID (SSN, National ID, Tax ID, Passport) Was Not Detected\n\n**Data type:** Government & national identity numbers (SSN, driver's license, passport, national ID, tax ID, resident registration number)\n\n## Issue\n\nA government or national identity number was present in scanned content but produced no finding, or produced a finding at lower confidence than expected. This is commonly reported during a POV or a detection validation exercise.\n\n## Environment\n\nAll content integrations and endpoint scan paths. Applies to native ID detectors. Causes 1, 2, 3, and 5 describe model behavior and do not apply to custom regex detectors, which match purely on pattern.\n\n## Before troubleshooting: test the sample in the Nightfall Playground\n\nThe Playground returns the model's confidence score for any text you paste, independent of your policies and detection rules. It is the fastest way to separate a _detection_ question from a _configuration_ question, and it is the first step for every report below.\n\n**→** [**playground.nightfall.ai**](http://playground.nightfall.ai/)\n\nPaste the exact sample and record the result. There are three outcomes and they point in different directions:\n\n| | | |\n| ---------------------------------------- | ------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------- |\n| Playground result | What it means | Where to look next |\n| Scores at or above your policy threshold | The detector works. Your policy did not act on it. | Configuration — rule scope, minimum confidence, minimum findings, context rules, integration coverage |\n| Scores below your policy threshold | The detector evaluated the value and found weaker evidence than expected | Missing context, or a downweighted pattern |\n| No finding at all | The value was never scored, or was excluded | Format, candidate identification, exclusion rules, or coverage that does not exist yet |\n\nDo this before changing any policy. If you want to evaluate the effect of a lower confidence threshold, test it in the Playground or in an isolated test policy rather than editing a production policy.\n\n### Sanity-check your test data with an LLM first\n\nBefore concluding anything is a miss, confirm your sample is a well-formed identifier. Paste it into Claude or ChatGPT and ask:\n\n_\"Is this a structurally valid \\[US Social Security Number / Indonesian driver's license / Korean resident registration number]? Check the format, length, and any checksum or range rules. Is it a commonly used test, sample, or placeholder value?\"_\n\nThis catches invalid values and well-known test data in seconds, and resolves a large share of reported misses before a ticket is ever opened.\n\n## Cause and resolution\n\nMost reported ID misses trace to one of the following. Work them in order — the first three explain the large majority.\n\n### 1. No contextual clue near the value\n\nID detectors generally reach **Very Likely** confidence only when a contextual indicator appears within roughly 50–100 characters of the value, depending on the model. A bare identifier with no label is expected to score lower.\n\n| | |\n| ------------------------------------ | ------------------------------------- |\n| Sample | Expected behavior |\n| `SSN: 523-06-6789` | Very Likely |\n| `523-06-6789` alone in a message | Likely or lower |\n| `Employee 523-06-6789 starts Monday` | Varies — no ID-specific label present |\n\nContext keyword coverage is language- and locale-specific, and includes abbreviations, informal variants, and romanized forms. Coverage is not identical across every detector — if a variant your organization uses is not recognized, tell us and we can add it.\n\n```\n주민등록번호 860903-4567890 → detected\n주민번호 860903-4567890 → detected\nKorea RRN 860903-4567890 → detected\n```\n\n**Resolution 1:** Add a contextual clue to your test sample. If it still does not trigger, share the sample with us — our model can learn your contextual clues.\n\n**Resolution 2:** If the use case requires detecting unlabeled identifiers, set the detection rule minimum confidence to **Likely** rather than Very Likely. Validate the noise impact before rolling out broadly.\n\n### 2. The value failed candidate identification before reaching the model\n\nDetectors run a candidate-identification stage before any model scoring. If a value does not match the expected pattern or validation rules for that identifier, it never reaches the model, so no confidence score is produced at all. This is a hard filter, not a low score — adjusting the confidence threshold will not change the outcome.\n\n**Example — US Social Security Number.** An SSN is structured as `AAA-GG-SSSS` (area, group, serial). The Social Security Administration has never issued numbers in certain ranges, so a nine-digit value falling in those ranges is not a possible SSN no matter how it is labeled:\n\n| | |\n| ----------------------- | ----------------------------- |\n| Component | Never issued |\n| Area (first 3 digits) | `000`, `666`, and `900`–`999` |\n| Group (middle 2 digits) | `00` |\n| Serial (last 4 digits) | `0000` |\n\nApplied to samples:\n\n| | | |\n| ------------------ | ------- | -------------------------- |\n| Sample | Detects | Why |\n| `SSN: 523-06-6789` | Yes | Valid structure |\n| `SSN: 000-06-6789` | No | Area `000` never issued |\n| `SSN: 523-00-6789` | No | Group `00` never issued |\n| `SSN: 523-06-0000` | No | Serial `0000` never issued |\n\nOther identifier types apply their own format and validation rules, and several national IDs and driver's licenses include check digits that must reconcile before the value is treated as a candidate.\n\n**Resolution:** Confirm the sample satisfies the documented format and validation rules for that country's identifier before treating the result as a miss. If your real-world format is legitimate but differs from the canonical one, that is a detector enhancement request rather than a tuning exercise — share samples with us and we will route them to our Detection team.\n\n### 3. Well-known test values are suppressed\n\nSequential and repeated values may be suppressed as statistically common test and placeholder data. They are widely used as sample values, so treating them as real identifiers produces unacceptable noise.\n\n| | |\n| ---------------- | ----------------- |\n| Do not test with | Test with instead |\n| `123-45-6789` | `523-06-6789` |\n| `123456789` | `523066789` |\n| `123 45 6789` | `523 06 6789` |\n\nNote that these values are _structurally valid_ — they reach the model and are then suppressed, unlike the values in cause 2, which are never evaluated at all. The visible outcome is the same; the mechanism is not.\n\n**Resolution:** Re-test with a non-sequential, format-valid value. This is the single most common cause of self-inflicted \"misses\" during validation.\n\n### 4. Country mismatch, or the country is not supported\n\nNo detector exists for that country's identifier, so the miss is real and expected.\n\nCountry-specific passport number detectors currently exist for approximately 19 countries, plus generic passport/visa **image** detection covering all countries. Confirm the current supported list before responding; coverage changes.\n\n**Resolution:** For unsupported countries, new detectors can be built on request. Please share the country, the identifier type (tax ID, driver's license, passport, national ID), and a few sanitized format examples with us. We can build an ID model(s) within 10 business days.\n\n### 5. The ID was inside an image or a table\n\nExtraction runs before detection, and it can remove the very thing the detector needs. Two variants, same symptom.\n\n**Identity documents as images.** Image classification and text detection are separate capabilities. A passport or driver's license image may be classified as an identity document while the number printed on it produces no text finding — or the reverse. Track those as two issues, not one.\n\nExtraction accuracy also matters at the character level. A single misread digit turns a valid identifier into one that fails format or checksum validation, at which point it is dropped at candidate identification (cause 2) and produces nothing at all. Low-resolution, compressed, skewed, or photographed images make this more likely.\n\n**IDs in tables.** When an identifier sits in a table, the column header — `SSN`, `Social Security Number`, `Passport No.`, `NIK` — is usually the only context the detector has. Whether it survives depends on the file type.\n\n_Header preserved: CSV, Excel, and other structured data files._ Each value stays tied to its column, so the detector effectively reads:\n\n```\nPatient Name: Lisa Samson\nPhone Number: 303-781-8970\nMember Identifier: 1EG4TE5MK73\nSocial Security Number: 523-36-8350\n```\n\nThe label sits right next to the number. Scores Very Likely.\n\n_Header lost: images of tables and HTML tables._ Screenshots, photos, PDFs, and HTML flatten into a single run of text:\n\n```\nLisa Samson 303-781-8970 1EG4TE5MK73 523-36-8350 Alprazolam\n```\n\nThe header row appears **once**, at the top. Every row after it is pushed further away:\n\n```\nName Phone Member ID SSN Medication ← the only place \"SSN\" appears\nRow 1 … … … 523-36-8350 … ← header is ~40 characters back\nRow 2 … … … 489-36-8351 … ← ~120 characters back\nRow 40 … … … 478-36-8352 … ← thousands of characters back\n```\n\nThe detector looks for context within a short window around the value. Once the header falls outside that window, the identifier is just a nine-digit number with nothing around it — and an SSN that scores **Very Likely** as a structured file scores **Possible, or produces no finding at all**.\n\nThis is why partial detection down a long column is such a common report. The first rows are close enough to the header; the rest are not.\n\n**Resolution:** Scan the source file directly where you can — a CSV or spreadsheet will always outperform a screenshot of the same data. Where image and HTML coverage matters, lower the rule to **Likely** and validate the noise impact. When reporting, send the original file or full-resolution image rather than a re-screenshot.\n\n**See also:** [Why Sensitive Data in an Image Was Not Detected](https://claude.ai/chat/LINK-TBD) · [Why Detection Results Differ Between File Upload, Copy/Paste, and Screenshot](https://claude.ai/chat/LINK-TBD)\n\n### 6. Coverage or configuration gap, not a detection failure\n\nFrequently the detector never ran. Check, in this order:\n\n- Is the detector deployed on the integration where the content lives? A common real-world pattern is SSN and driver's license coverage on chat but not on the file store where the identity documents actually reside.\n\n- Is the detection rule **scope** set to Content (or Both), not File Name only?\n\n- Is **minimum confidence** filtering the finding out?\n\n- Is **minimum number of findings** suppressing a single occurrence?\n\n- Are context rules or keyword gates excluding the content? Temporarily disable and re-test.\n\n### 7. The identifier was split or fragmented\n\nValues deliberately broken across characters, lines, or fields are not detected, and this is intentional. Detecting fragmented identifiers would require matching arbitrary character combinations and would generate an impractical volume of false positives.\n\n## What not to do\n\n**Do not lower confidence to Possible as a general fix.** At Possible, a nine-digit ID detector will surface effectively every nine-digit number in the environment — expect 40–70% noise. Reserve Possible for narrow cases where exhaustive coverage is explicitly wanted and the volume is accepted, such as a one-time historical scan.\n\nTo evaluate the impact of a lower threshold safely, test in the Playground or an isolated test policy rather than changing a production policy.\n\n## Reporting a missed detection to Nightfall Support\n\n**Non-findings are not retained.** For a missed detection there is no stored artifact to investigate after the fact — unlike a false positive, where the content is available in the event finding. Without a sample, the issue cannot be worked.\n\nContact Nightfall Support and include these three items at minimum:\n\n| | |\n| -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |\n| Required | Detail |\n| **Sanitized sample** | The content that should have matched. Replace real values with format-equivalent substitutes — preserve length, delimiters, and the surrounding context. Text snippets are fine; a full file is not required. |\n| **Time of the test** | Date and time including time zone. This lets Support correlate your test against scan and policy logs. |\n| **Environment** | Where the test ran — Slack, endpoint (specify copy/paste, file upload, or screenshot), Google Drive, Outlook, Teams, OneDrive, Jira, Zendesk, or the specific integration in use. |\n\nAlso helpful, in rough order of value:\n\n1. The country and the identifier type\n\n2. Your Playground result for the same sample — the confidence score, or \"no finding\"\n\n3. Detection rule configuration: scope, minimum confidence, minimum findings, any context rules\n\n4. Whether the same sample behaves differently in another tenant or another integration\n\n## Triage sequence\n\n1. Paste the sample into the Playground and record the confidence score.\n\n2. If the Playground scores it but the policy did not fire → configuration issue, work cause 6.\n\n3. If the Playground scores it low → context issue, work cause 1. If the content came from an image or a table, work cause 5.\n\n4. If the Playground produces nothing at all → candidate identification, test-value suppression, or missing coverage; work causes 2, 3, and 4.\n\n5. Reproduce in a second tenant to rule out tenant-specific configuration.\n\n6. Still unexplained → contact Nightfall Support with a sanitized sample, the time of the test, and the environment.\n","2026-08-03T17:22:59.900Z","2026-08-03T17:22:59.967Z","677b6b9a-dac5-4d38-a444-f9e41be93a94",[],[],[],"Why a Credit Card Number Was Not Detected | Nightfall AI Knowledge Base","why-a-credit-card-number-was-not-detected-nightfall-ai-knowledge-base","https://kb.nightfall.ai/articles/9169942286-why-a-credit-card-number-was-not-detected","# Why a Credit Card Number Was Not Detected\n\n**Data type:** Payment card data (PAN, CVV/CVC/CID, card images) **Article type:** Known behavior / troubleshooting\n\n## Issue\n\nA payment card number was present in scanned content but produced no finding, or scored lower than expected. Most often reported during PCI validation testing, or after a card table screenshot fails to trigger.\n\n## Environment\n\nAll content integrations and endpoint scan paths. Applies to the native credit card detector. The causes below describe model and pipeline behavior and do not apply to custom regex detectors, which match purely on pattern.\n\n## Before troubleshooting: test the sample in the Nightfall Playground\n\nThe Playground returns the model's confidence score for any text you paste, independent of your policies and detection rules. It is the fastest way to separate a _detection_ question from a _configuration_ question.\n\n**→** [**playground.nightfall.ai**](http://playground.nightfall.ai/)\n\n| | | |\n| ---------------------------------------- | ----------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------- |\n| **Playground result** | **What it means** | **Where to look next** |\n| Scores at or above your policy threshold | The detector works. Your policy did not act on it. | Configuration — rule scope, minimum confidence, minimum findings, context rules, integration coverage |\n| Scores below your policy threshold | The value was evaluated but the evidence was weaker than expected | Missing context (cause 4), or extraction stripped it (cause 8) |\n| No finding at all | The value never reached scoring | Validation or a pipeline filter — causes 1, 2, 3, 5, 6, 7 |\n\n### Sanity-check your test card first\n\nBefore concluding anything is a miss, confirm the number is actually a valid card. Paste it into Claude or ChatGPT and ask:\n\n> _\"Is this a valid credit card number? Check the Luhn checksum, and tell me which network the prefix belongs to and whether the digit count matches that network's real card length.\"_\n\nYou can also test your credit card number here: \n\n[_https://www.bincodes.com/bin-checker/_](https://www.bincodes.com/bin-checker/)\n\nAn invalid or wrong-length test number is the most common cause of a reported miss, and this check takes seconds.\n\n## Cause and resolution\n\nWork these in order. Causes 1 through 3 account for most reported misses during validation testing.\n\n### 1. The number fails a validation stage\n\nThree validation gates run before any scoring. Failing any one drops the candidate entirely — no confidence score is produced, and lowering your policy threshold will not change the result.\n\n**a. Luhn checksum.** If the number does not satisfy Luhn, it is not a card number and nothing should fire. Note: 10% of all 16 digit numbers pass the Luhn checksum so other checks are necessary.\n\n**b. Card number prefix and exact length must agree.** The number must match a known network prefix _and_ one of that network's valid lengths. A prefix with the wrong digit count is dropped.\n\n**c. The issuer prefix must exist in our BIN/IIN reference data.** The leading 6 to 9 digits are checked against a Bank Identification Number dataset. A number that passes Luhn and has a plausible network prefix will still be dropped if its issuer range is not a real, issued one.\n\n**Internal note.** Gate (c) is the usual reason a hand-generated or synthetic \"Luhn-valid\" test card produces nothing. Luhn generators produce checksum-valid numbers with arbitrary issuer prefixes, which then fail the BIN lookup. Explain this as \"the number must belong to a real issuer range,\" not as a published blocklist — **there is no test-card blocklist in the pipeline.**\n\n**Resolution:** Test with a number that is Luhn-valid, matches a real network prefix at that network's correct length, and carries a genuine issuer prefix. Ask your payments team for a de-provisioned real BIN rather than generating a number.\n\nYou can also test your credit card number here: \n\n[_https://www.bincodes.com/bin-checker/_](https://www.bincodes.com/bin-checker/)\n\n### 2. The card was repeated, so it was treated as ordinary grouped numbers\n\nA card number embedded in a longer run of **same-length, same-delimiter digit groups** is filtered out. The assumption is that a long uniform sequence of digit groups is tabular or machine-generated data, not a card.\n\nThis is the single most common self-inflicted miss in validation testing, because the instinct when testing is to paste the number repeatedly:\n\n```\n4242 4242 4242 4242 4242 4242 → filtered, reads as one long grouped sequence\n\n1111 2222 4242 4242 4242 4242 → filtered, the card sits inside a longer run\n\nCredit card: 4242 4242 4242 4242 → evaluated normally\n```\n\nNote that this filter only applies to candidates with **uniform** group lengths. Numbers with no delimiter at all, or with irregular grouping such as American Express (4-6-5), are not affected.\n\n**Resolution:** Test one card per line with surrounding text. Do not paste the same number several times in a row, and do not place test cards in a column of other same-width numbers.\n\n### 3. Delimiters were inconsistent\n\nDelimiters within a single number must be consistent. Supported separators are the space, the hyphen, eight Unicode dash variants, and no delimiter at all — but they cannot be mixed within one number.\n\n```\n4242-4242-4242-4242 → evaluated\n\n4242 4242 4242 4242 → evaluated\n\n4242424242424242 → evaluated\n\n4242-4242 4242-4242 → filtered, mixed delimiters\n```\n\n**Resolution:** Use one delimiter consistently. If real customer data legitimately mixes delimiters, capture a sample — that is a detector enhancement request.\n\n### 4. No contextual clue near the value\n\nCard detection starts from a base score and adds evidence. Context is by far the largest single contributor, which is why a bare card number frequently lands below Very Likely while the same number with a label clears it.\n\nRecognized context includes the network and card-related keywords — credit, visa, mastercard, amex, discover, jcb, diners, maestro, instapayment, card, cc, ccn, american express, withdrawal, purchase, cvv, cvc, csc, exp, expiration — and also a standalone expiration date in MM/YY form, where the year falls within a window around the current year.\n\n| | |\n| -------------------------------- | ---------------------------------------------------------------------------------------- |\n| **Sample** | **Behavior** |\n| Credit card: 5270-4267-6450-5516 | Keyword context present, scores highest |\n| 5270-4267-6450-5516 exp 04/29 | Expiration context present, rewarded |\n| 5270-4267-6450-5516 alone | Valid but unrewarded, typically below Very Likely |\n| 5270-4267-6450-5516 2010/06/25 | Not rewarded — YYYY/MM/DD is not an MM/YY expiration, and the year is outside the window |\n\nTwo limitations worth knowing:\n\n- A date in full MM/DD/YYYY or MM/DD/YY form does not count as expiration context. This is deliberate, so that ordinary calendar dates near a number do not inflate confidence.\n\n**Resolution:** Add a contextual clue to your test sample. Where bare card numbers must be caught in production, set the rule to **Likely**. If your environment uses non-English card terminology, share samples — context vocabulary can be extended.\n\n### 5. The number appeared in a field labeled as an ID\n\nIf the surrounding field label looks like an identifier field — id, id#, idno, idnumber — the candidate is filtered out. This exists because internal record IDs are a large false positive source, but it means a genuine card number stored under an ID-like column or key will be suppressed.\n\n```\ncard_number: 4242 4242 4242 4242 → evaluated\n\nid: 4242 4242 4242 4242 → filtered\n```\n\n**Resolution:** This is a known tradeoff. If a customer legitimately stores card data in an ID-named field, capture the sample and route it to Detection — do not attempt to tune around it with a threshold change, which will not help.\n\n### 6. A negation preceded the context keyword\n\nIf a negating word such as \"not\" or \"no\" precedes the card keyword, the candidate is dropped rather than merely downweighted.\n\n```\nThis is not a credit card: 4242 4242 4242 4242 → filtered\n```\n\nThis matters mainly for test content and documentation, where explanatory prose often negates. It is rarely the cause in production data.\n\n### 7. The number was inside a URL, path, email address, or larger number\n\nCandidates are removed when they fall inside a URL, a URL parameter, a file path, an email address local part, or a longer floating-point number. Test data assembled as a query string or a path fragment will not produce findings.\n\n### 8. The credit card number was in a table and the column header was lost\n\nWhen a card number sits in a table, the column header — `CCN`, `Card Number`, `CC#` — is usually the only context the detector has. Whether that header survives depends on the file type.\n\n**Header preserved: CSV, Excel, and other structured data files.** Each value stays tied to its column, so the detector effectively reads:\n\n```\nemail: jwhite@domain.com\ncc_type: m\nCCN: 5270-4267-6450-5516\ncc_cvc: 123\ncc_expiredate: 2010/06/25\n```\n\n`CCN` sits right next to the number. Scores Very Likely.\n\n**Header lost: images of tables and HTML tables.** Screenshots, photos, PDFs, and HTML flatten into a single run of text:\n\n```\njwhite@domain.com m 5270-4267-6450-5516 123 2010/06/25\n```\n\nThe header row appears **once**, at the top. Every row after it is pushed further away:\n\n```\nName Email Phone CCN CVC Expires ← the only place \"CCN\" appears\nRow 1 … … … 5270-4267-6450-5516 … ← header is ~40 characters back\nRow 2 … … … 4532-1234-5678-9010 … ← ~120 characters back\nRow 40 … … … 6011-0009-9013-9424 … ← thousands of characters back\n```\n\nThe detector looks for context within a short window around the value. Once the header falls outside that window, the card number is just a 16-digit number with nothing around it — and a card that scores **Very Likely** as a structured file scores **Possible, or produces no finding at all**.\n\nThis is why partial detection down a long column is such a common report. The first rows are close enough to the header; the rest are not.\n\n### 9. There is no native CVV/CVC/security code detector\n\nExpected behavior, not a gap. CVV values are 3–4 digits and indistinguishable from dates, quantities, internal IDs, and ordinary numbers, so a standalone CVV detector would generate very high false positive volume. Tightening context requirements to suppress that noise raises the miss rate instead, because CVVs are frequently shared without consistent labels.\n\n**Recommended approach:** Rely on the card number and card image detectors, which are far stronger PCI signals. Note that cvv, cvc, and csc already function as _context_ that boosts card number confidence — so a card and its CVV appearing together helps detect the card.\n\n### 10. A clipboard image will not trigger the card _image_ detector\n\nImages in the copy buffer are processed for text extraction only. The card-image classifier does not run on clipboard content — it applies when the image is its own file or is embedded in a document. If extraction is clean, the card _number_ detector can still fire on the extracted text.\n\nRelated: mixed clipboard content is not supported. Text is preferred over image, except where the text portion is only a URL, in which case the image is processed.\n\n**Resolution:** Expect the card number detector, not the card image detector, on clipboard paste events. Test image classifiers using file uploads or embedded images.\n\n### 11. Coverage gap — the detector was never deployed there\n\nCommon pattern: card detection deployed on the primary file store and chat tool but absent from the support ticketing system or wiki, which is often exactly where customers submit payment details. Verify the detector is present on the integration in question before treating this as a detection problem.\n\n### 12. Results differ between tenants\n\nIf a sample fails in one tenant and succeeds in another, the cause is detection rule configuration — minimum confidence, minimum findings, or scope — not model behavior. Cheap early triage step.\n\n## Ruled out as a cause\n\n**Card numbers at end-of-line or end-of-file.** Suspected during regression testing and confirmed to behave as expected. Do not spend time on this hypothesis.\n\n**A test-card blocklist.** There is none. Well-known test PANs are not suppressed by name or range. When a test card fails, the reason is Luhn, prefix/length, BIN lookup, or the repeated-groups filter — not an exclusion list.\n\n## What not to do\n\n**Do not lower confidence to Possible as a general fix.** It will surface large volumes of ordinary numeric data. Reserve it for narrow, time-boxed cases such as a one-time historical scan where the volume is explicitly accepted. Validate any threshold change in the Playground or an isolated test policy first.\n\n## Reporting a missed detection to Nightfall Support\n\n**Non-findings are not retained.** A missed detection cannot be investigated retroactively — there is no stored artifact, unlike a false positive where the content is available in the event finding.\n\nContact Nightfall Support and include these three items at minimum:\n\n| | |\n| -------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |\n| **Required** | **Detail** |\n| **Sanitized sample** | The content that should have matched. Preserve the full card length, the delimiters exactly as they appeared, and the surrounding context. A card sanitized to 4242... cannot be tested. |\n| **Time of the test** | Date and time including time zone, so Support can correlate against scan and policy logs. |\n| **Environment** | Where the test ran — Slack, endpoint (specify copy/paste, file upload, or screenshot), Google Drive, Outlook, Teams, OneDrive, Jira, Zendesk, or the specific integration. |\n\nAlso helpful, in rough order of value:\n\n1. Confirmation the number is Luhn-valid, at a correct length for its network prefix, and carries a real issuer prefix\n\n2. Your Playground result — the confidence score, or \"no finding\"\n\n3. Whether the number appeared more than once, or alongside other same-width numbers\n\n4. The field label or column header the value sat under\n\n5. Detection rule configuration: scope, minimum confidence, minimum findings, context rules\n\n6. For images, the original image file — not a re-screenshot\n\n7. Whether the same sample behaves differently in another tenant or integration\n\n## Triage sequence\n\n1. **Validate the number first** — Luhn, prefix/length agreement, real issuer range. This resolves most reports. \n\n2. Check whether the number was repeated or sat among other same-width grouped numbers (cause 2), and whether its delimiters were consistent (cause 3).\n\n3. Paste the sample into the Playground and record the result.\n\n4. No finding at all → validation or a pipeline filter; work causes 1, 2, 3, 5, 6, 7.\n\n5. Scored but below threshold → context; work cause 4, or cause 8 if the source was an image or table.\n\n6. Scored in the Playground but the policy did not fire → configuration; work causes 11 and 12.\n\n7. If the source was an image or a table, identify the ingestion path before anything else.\n\n8. Still unexplained → contact Nightfall Support with a sanitized sample, the time of the test, and the environment.\n","2026-08-03T17:22:59.031Z","2026-08-03T17:22:59.111Z","1bbc781b-aa68-4fae-b365-611b0fe96334",[],[],[],"SSO | Nightfall AI Knowledge Base","sso-nightfall-ai-knowledge-base","https://kb.nightfall.ai/collections/5062672630-sso","\\[\n\nNightfall Console: How to Invite an Admin to a Nightfall Tenant when SSO is Activated\n\n›\n\n]\\()\n","2026-08-03T17:22:52.079Z","2026-08-03T17:22:52.107Z","7d71bc7c-020d-4512-ae89-8602004e48c0",[],[],[],"Slack: Does a manually resolved violation inform the user that it has been resolved? | Nightfall AI Knowledge Base","slack-does-a-manually-resolved-violation-inform-the-user-that-it-has-been-resolved-nightfall-ai-know","https://kb.nightfall.ai/articles/1729912039-slack-does-a-manually-resolved-violation-inform-the-user-that-it-is-resolved","# Slack: Does a manually resolved violation inform the user that it has been resolved?\n\nLast updated 3 months ago\n\n## Purpose\n\nTo know a user has received confirmation that the business justification received has been seen and resolved\n\n## Answer\n\nYes, the user is sent a resolved message after a Nightfall Admin manually resolves the alert.\n\nExample:\n\n> ID xxxxxxxx - **Data Security Issue Resolved**\n>\n> The data security issue you were alerted to has now been **resolved**.\n>\n> This could be due to actions you've taken or through steps taken by your security admin. Either way, your data is now secure.\n\nHow helpful was this article?\n","2026-08-03T17:22:58.864Z","2026-08-03T17:22:58.916Z","198022a9-569c-4f2e-a590-88c8f36d6881",[],[],[],"Policies | Nightfall AI Knowledge Base","policies-nightfall-ai-knowledge-base","https://kb.nightfall.ai/collections/4723799015-policies","\\[\n\nNightfall Console: What are the max amount of days that can be set for an automated action in a policy?\n\n›\n\n]\\()\n","2026-08-03T17:22:50.213Z","2026-08-03T17:22:50.259Z","a5c896a3-4b0e-4e6d-bffd-59af389bfa3e",[],[],[],"Nightfall Windows Agent: Error: \"Configuration error\" in Agent Popup | Nightfall AI Knowledge Base","nightfall-windows-agent-error-configuration-error-in-agent-popup-nightfall-ai-knowledge-base","https://kb.nightfall.ai/articles/9407066696-nightfall-windows-agent-error-configuration-error-in-agent-popup","# Nightfall Windows Agent: Error: \"Configuration error\" in Agent Popup\n\nLast updated 4 months ago\n\n## Issue\n\nReceiving a configuration error from the agent pop-up on a Windows machine.\n\n- Agent error shows: `Configuration Error`\n\n## Environment\n\n- Nightfall Windows Agent: All Versions\n\n## Cause\n\nAdministrator access was not used when deploying the MSI.\n\n## Resolution\n\nBefore deploying the MSI via Command Prompt, right-click CMD and select \"Run as Administrator\".\n\nAn elevated Command Prompt is required when running the MSI due to the permissions required when deploying the agent and extension.\n\nHow helpful was this article?\n","2026-08-03T17:22:51.564Z","2026-08-03T17:22:51.607Z","42be7491-fb2e-42d8-9157-dce89048721f",[],[],[],"Nightfall MDM Integration: How to Deploy the Powershell Script for Third-party MDM Windows Machines | Nightfall AI Knowledge Base","nightfall-mdm-integration-how-to-deploy-the-powershell-script-for-third-party-mdm-windows-machines-n","https://kb.nightfall.ai/articles/8198527729-nightfall-mdm-integration-how-to-deploy-the-powershell-script-for-third-party-mdm-windows-machines","# Nightfall MDM Integration: How to Deploy the Powershell Script for Third-party MDM Windows Machines\n\n## Purpose\n\nWhen an MDM for Windows machines cannot be integrated with Nightfall, it is required to deploy a script to the machines through MDM to update a registry key. This is the equivalent walkthrough to the [macOS Third-Party MDM Integration](https://nightfall-ai-knowledge-base.help.usepylon.com/articles/4310598802-how-to-find-the-mdm-profile-and-emailid-in-the-payload#environment) for Windows.\n\n## Environment\n\n- Nightfall: MDM Integration\n\n- Windows: All Versions\n\n## Resolution\n\n1. Download the \"add-upn-to-registry.txt\" from this article.\n\n2. Change the name from a .txt extension to a .ps1 extension.\n\n3. Open your preferred MDM.\n\n4. Navigate to where you will upload a script for Windows machines.\n\n5. Upload the \"add-upn-to-registry.ps1\" script.\n\n6. Add the appropriate parameters.\n\n```\npowershell.exe -ExecutionPolicy Bypass -File .\\add-upn-to-registry.ps1 -UPN $env:email\n```\n\n7. Deploy it to a specific target group of Windows machines.\n\nPlease test this on a machine or two in a separate group before rolling out fleet-wide!\n\n## Download(s)\n\n## Additional Notes\n\nThe script uses the `{EmailAddress}` parameter. If your MDM uses a different parameter then this will need changed accordingly. Outside of this parameter, Nightfall is unaware of what your MDM uses.\n\n## Related Content\n\n- [Nightfall Web Console: How to Set Up MDM Integration](https://kb.nightfall.ai/articles/7684715306-nightfall-web-console-how-to-set-up-the-mdm-integration)\n\n- [MDM Integration: How to Find the MDM macOS Profile and EmailID in the Payload](https://kb.nightfall.ai/articles/4310598802-how-to-find-the-mdm-profile-and-emailid-in-the-payload)\n","2026-08-03T17:22:53.141Z","2026-08-03T17:22:53.182Z","75420e18-0cfe-44e7-aa4e-6af6ae52b8c0",[],[],[],"Nightfall macOS Agent: How to Add the Nightfall Chrome ExtensionSettings to an Existing Non-Nightfall Profile | Nightfall AI Knowledge Base","nightfall-macos-agent-how-to-add-the-nightfall-chrome-extensionsettings-to-an-existing-non-nightfall","https://kb.nightfall.ai/articles/9283028250-nightfall-macos-agent-how-to-add-the-nightfall-chrome-extensionsettings-to-an-existing-non-nightfall-profile","# Nightfall macOS Agent: How to Add the Nightfall Chrome ExtensionSettings to an Existing Non-Nightfall Profile\n\nLast updated 4 months ago\n\n## Purpose\n\nTo add the Nightfall Chrome ExtensionSettings of the \"with\\_browser\\_extensions\" mobileconfig to an already existing profile that is deployed by the customer\n\n## Environment\n\nOperating System: macOS\n\n## Resolution\n\nThis can prove useful when a company has deployed another profile that controls the Chrome browser ExtensionSettings and it clashes with Nightfall's Profile thereby preventing connectivity of the extension. Adding the Nightfall ExtensionSettings within the currently present profile will allow the Nightfall extension to connect.\n\nAdd the following ExtensionSettings anywhere within the brackets:\n\n```\n\t\t\n\t\t\tExtensionSettings\n\t\t\t\n\t\t\t\tjgmgecncmjklkabkejnjfgfkglapfgek\n\t\t\t\t\n\t\t\t\t\tinstallation_mode\n\t\t\t\t\tforce_installed\n\t\t\t\t\tupdate_url\n\t\t\t\t\thttps://clients2.google.com/service/update2/crx\n\t\t\t\t\n\t\t\t\n\t\t\tPayloadDisplayName\n\t\t\tGoogle Chrome - Nightfall Extension\n\t\t\tPayloadIdentifier\n\t\t\tcom.google.Chrome.8370900F-6579-4703-8FEF-1DE3DD384618\n\t\t\tPayloadType\n\t\t\tcom.google.Chrome\n\t\t\tPayloadUUID\n\t\t\t8370900F-6579-4703-8FEF-1DE3DD384618\n\t\t\tPayloadVersion\n\t\t\t1\n\t\t\n\t\t\n\t\t\tExtensionSettings\n\t\t\t\n\t\t\t\tjgmgecncmjklkabkejnjfgfkglapfgek\n\t\t\t\t\n\t\t\t\t\tinstallation_mode\n\t\t\t\t\tforce_installed\n\t\t\t\t\tupdate_url\n\t\t\t\t\thttps://clients2.google.com/service/update2/crx\n\t\t\t\t\n\t\t\t\n\t\t\tPayloadDisplayName\n\t\t\tGoogle Chrome Beta - Nightfall Extension\n\t\t\tPayloadIdentifier\n\t\t\tcom.google.Chrome.beta.A6E44352-4604-4968-8F35-F74BA0FE5C48\n\t\t\tPayloadType\n\t\t\tcom.google.Chrome.beta\n\t\t\tPayloadUUID\n\t\t\tA6E44352-4604-4968-8F35-F74BA0FE5C48\n\t\t\tPayloadVersion\n\t\t\t1\n\t\t\n```\n\nThe array brackets may look something like this:\n\n```\nPayloadContent\n \n\n(Nightfall ExtensionSettings shown above go anywhere here)\n\n\n```\n\nHow helpful was this article?\n","2026-08-03T17:22:52.699Z","2026-08-03T17:22:52.733Z","ef941c25-e823-481b-af44-2eec6af4cf25",[],[],[],"Nightfall Extension: How to Collect Extension Logs | Nightfall AI Knowledge Base","nightfall-extension-how-to-collect-extension-logs-nightfall-ai-knowledge-base","https://kb.nightfall.ai/articles/7340421050-nightfall-extension-how-to-collect-extension-logs","# Nightfall Extension: How to Collect Extension Logs\n\nLast updated 1 month ago\n\n## Purpose\n\nTo collect the extension logs for the extension itself within a browser\n\n## Environment\n\n- Google Chrome: All Versions\n\n- Nightfall Extension: v8.10.0+\n\n## Resolution\n\n1. From Google Chrome, click the puzzle icon at the top right (Extensions).\n\n2. Locate the Nightfall Extension and click the three vertical-dots menu.\n\n3. Click Options.\n\n4. Change the URL to include: `?showLogs=true`.\n\n Example:\n\n ```\n chrome-extension://jgmgecncmjklkabkejnjfgfkglapfgek/src/extension-popup/options/options.html?showLogs=true\n ```\n\n5. **Reproduce** the issue.\n\n6. Click the export button at the top right.\n\n7. Provide logs to Nightfall Technical Support.\n\nHow helpful was this article?\n","2026-08-03T17:22:53.823Z","2026-08-03T17:22:53.855Z","81e8bedb-0ab6-46b9-8030-7dd5f7895b55",[],[],[],"Nightfall Endpoint: Can the notification banner on Nightfall's \".mobileconfig\" profile be changed? | Nightfall AI Knowledge Base","nightfall-endpoint-can-the-notification-banner-on-nightfalls-mobileconfig-profile-be-changed-nightfa","https://kb.nightfall.ai/articles/3335053991-nightfall-endpoint-can-the-notification-banner-on-nightfall-s-mobileconfig-profile-be-edited","# Nightfall Endpoint: Can the notification banner on Nightfall's \".mobileconfig\" profile be changed?\n\n## Purpose\n\nTo know if the \".mobileconfig\" profile can be edited to adjust the Notification Banner option\n\n## Answer\n\nNo, the profile is signed. A signed profile cannot be edited by a third-party unless the signature is completely removed.\n\nWe do NOT recommend removing the signature from a profile. In testing, some features within the profile were not able to function when the signature was removed.\n","2026-08-03T17:22:54.121Z","2026-08-03T17:22:54.146Z","49a6cc60-3079-4b3b-bd88-ff54a7f0fee9",[],[],[],"Nightfall Endpoint Agent: Third-Party AV App Flags Nightfall as Redirecting Network Traffic | Nightfall AI Knowledge Base","nightfall-endpoint-agent-third-party-av-app-flags-nightfall-as-redirecting-network-traffic-nightfall","https://kb.nightfall.ai/articles/4608996630-nightfall-endpoint-agent-third-party-av-app-flags-nightfall-as-redirecting-network-traffic","# Nightfall Endpoint Agent: Third-Party AV App Flags Nightfall as Redirecting Network Traffic\n\nLast updated 2 months ago\n\n## Issue\n\nAn EDR, NGAV, or XDR third-party program or app is detecting Nightfall as redirecting network traffic through a proxy or port.\n\n- **Windows** third-party program detection shows:\n\n ```\n \"C:\\Program Files\\NightfallAI-Agent\\NightfallUI.exe\"\n ```\n\n- **macOS** third-party program detection shows:\n\n ```\n /Applications/NightfallAIAgent.app\n ```\n\n## Environment\n\n- Microsoft Windows: All versions\n\n- Apple macOS: All versions\n\n## Cause\n\nNightfall is performing a legitimate operation of analyzing traffic through its new Network Extension feature.\n\n## Resolution\n\nAdd the following processes/paths for Nightfall to the third-party program's allowlist/whitelist:\n\n## macOS\n\n- `/Applications/NightfallAIAgent.app`\n\n## Windows\n\n- `C:\\Program Files\\NightfallAI-Agent\\NightfallUI.exe`\n\n## Reference Links\n\n[Nightfall Agent: What is the install path for the macOS and Windows Agent?](https://kb.nightfall.ai/articles/1301349102-nightfall-agent-what-is-the-install-path-for-the-macos-and-windows-agent#answer)\n\nHow helpful was this article?\n","2026-08-03T17:22:53.966Z","2026-08-03T17:22:53.998Z","7c739c2c-ebae-4ad9-a2be-2b1151fe1a90",[],[],[],"Nightfall Detection Rules: Why is \"Very Likely\" Grayed Out within the Detection Rule? | Nightfall AI Knowledge Base","nightfall-detection-rules-why-is-very-likely-grayed-out-within-the-detection-rule-nightfall-ai-knowl","https://kb.nightfall.ai/articles/5150286119-nightfall-console-why-is-very-likely-grayed-out-within-the-detection-rule","# Nightfall Detection Rules: Why is \"Very Likely\" Grayed Out within the Detection Rule?\n\nLast updated 6 months ago\n\n## Context\n\nSometimes a Detection Rule can prevent the user from adjusting the Confidence to that of \"Very Likely\".\n\n## Answer\n\nRegEx Detection Rules default to \"Likely\" confidence unless adding additional context to the detector.\n\nHow helpful was this article?\n","2026-08-03T17:22:57.697Z","2026-08-03T17:22:57.724Z","e34eb187-bcea-40bb-8d3e-246cd2329a4b",[],[],[],"Nightfall Detection Rules: How to Use Regex Context Rules | Nightfall AI Knowledge Base","nightfall-detection-rules-how-to-use-regex-context-rules-nightfall-ai-knowledge-base","https://kb.nightfall.ai/articles/2934048721-using-regex-context-rules-in-nightfall","# Nightfall Detection Rules: How to Use Regex Context Rules\n\n## Purpose\n\nTo set up and use RegEx context rules within Nightfall\n\n## Environment\n\n- Nightfall Web Console: Detection\n\n - Detectors\n\n## Resolution\n\nTo create effective regex patterns in Nightfall:\n\n1. Use RE2-compatible syntax for your patterns\n\n2. Test your regex using a [regex testing tool](https://regex101.com/) that supports RE2\n\n3. Refer to the [RE2 documentation](https://github.com/google/re2/wiki/Syntax) for supported syntax\n\n## Example\n\nTo create exclusion patterns, consider reframing the RegEx logic, instead of using negative \"lookaheads\".\n\nFor example, use a combination of supported RE2 features to achieve the same result, as opposed to using a negative lookahead pattern like, \\`Authorization(?!(?:.\\*Basic))\\`,\n\n**NOTE**: Nightfall RegEx rules uses RE2. RE2 does not support:\n\n- Lookbehind assertions\n\n- Some advanced lookahead patterns, like \\`(?!)\\`\n\n- Backreferences\n\nRemember to always test your regex patterns before implementing them in production to ensure they match your intended patterns correctly.\n","2026-08-03T17:22:51.389Z","2026-08-03T17:22:51.424Z","2acbc999-e855-409b-aa97-c83d61435ce1",[],[],[],"Nightfall Detection Rules: How to Set Up Credit Card Number Exclusions | Nightfall AI Knowledge Base","nightfall-detection-rules-how-to-set-up-credit-card-number-exclusions-nightfall-ai-knowledge-base","https://kb.nightfall.ai/articles/2382365871-how-to-setup-credit-card-number-exclusions","# Nightfall Detection Rules: How to Set Up Credit Card Number Exclusions\n\nLast updated 6 months ago\n\n## Purpose\n\nTo set up an exclusion for credit card numbers and prevent Nightfall AI from detecting specific content and Regex patterns\n\n## Environment\n\n- Nightfall Web Console: Detection Rules\n\n - Detectors\n\n## Resolution\n\n1. On the left pane under Configuration, navigate to Detection > Detectors tab in the Nightfall dashboard\n\n2. Click the \"+ Custom Detector\" button in the upper right-hand corner.\n\n3. Select \"Extend a Nightfall detector\" from the options\n\n 1. **Step 1**: Nightfall Detector and Name\n\n - From the Nightfall Detector dropdown, select \"Credit card number\".\n\n - Name the detector (recommended name: \"Credit Card Number\" for simplicity)\n 2. **Step 2**: Context Rules _(Optional)_\n\n - This is only recommended if the administrator is wanting to exclude based on specific sensitive data and wording.\n\n - For help on Context Rules, see: [How do I use Context Rules?](https://help.nightfall.ai/detection_platform/faq/context_rules)\n 3. **Step 3**: Token Rules\n\n - Click \"+ Add Token Rule\" to create the exclusion.\n\n - Add the credit card numbers to exclude, ensuring they follow proper regex formatting.\n\n - For more information on Regex, view our [Regex FAQ](https://help.nightfall.ai/detection_platform/faq/regex_library).\n\n Ensure that the regex patterns are properly formatted to match the exact test credit card numbers that need to be excluded.\n 4. **Step 4**: Review\n\n - Save the rule by clicking \"Add\".\n\n4. One the left pane under Configuration, go to Detection > Detection Rules\n\n5. Replace the default credit card detector with the newly created enriched detector in any existing rules.\n\nCreating a standalone regex detector without building on top of an existing detector will not work for exclusions, as it lacks the necessary foundation to create violations. Always extend the existing Credit Card Number detector when setting up exclusions.\n\n## Reference Links\n\n- [Using Exclusion Rules](https://help.nightfall.ai/developer-api/key-concepts/scanning_features/exclusion_rules)\n\n- [Using Context Rules](https://help.nightfall.ai/developer-api/key-concepts/scanning_features/context_rules)\n\nHow helpful was this article?\n","2026-08-03T17:22:56.813Z","2026-08-03T17:22:56.884Z","1c592217-511f-47c8-b29b-fc4f4c4c223a",[],[],[],"Nightfall Detection Rules: How to Increase the Confidence of a Custom RegEx Detector | Nightfall AI Knowledge Base","nightfall-detection-rules-how-to-increase-the-confidence-of-a-custom-regex-detector-nightfall-ai-kno","https://kb.nightfall.ai/articles/1290485382-nightfall-exfiltration-prevention-how-to-increase-the-confidence-of-a-regex-detector","# Nightfall Detection Rules: How to Increase the Confidence of a Custom RegEx Detector\n\n## Purpose\n\nTo increase the confidence of a custom RegEx detector and have the option to use \"Very Likely\" confidence\n\n## Environment\n\n- Nightfall Web Console: Detection\n\n - Detectors\n\n## Resolution\n\nTo increase the confidence for of a custom Detector, include a context rule that captures words or phrases commonly found near the RegEx match. This up-weights the finding and reduces false positives.\n\n## Example\n\nPrescription Numbers typically follow the format `RX-###-YYYY-##` and often appear near keywords such as _“Prescription Number,” “Prescription#,” “PN,” “Medication,” “Med,”_ or _“RX.”_\n\nIn this case, use:\\\n• Create a regex detector:\\\n `RX-\\d{3}-(19|20)\\d{2}-\\d{2}`\\\n• Add a context rule that looks for:\\\n `(Prescription Number|Prescription#|PN|Medication|Med|RX)`\\\n within 25 characters of the detected entity and changes the Confidence to _Very Likely._\n\n![image.png](/api/knowledge-base/images/693a9194-b1e7-4a5b-88e9-4bcd97348ad1 \"image.png\")\n","2026-08-03T17:22:57.033Z","2026-08-03T17:22:57.555Z","f4bc64c0-aee7-4ab8-b16e-da7dc6955eaf",[],[],[],"Nightfall Console: What are the max amount of days that can be set for an automated action in a policy? | Nightfall AI Knowledge Base","nightfall-console-what-are-the-max-amount-of-days-that-can-be-set-for-an-automated-action-in-a-polic","https://kb.nightfall.ai/articles/1797901654-nightfall-console-what-are-the-max-amount-of-days-that-can-be-set-for-an-automated-action-in-a-policy","# Nightfall Console: What are the max amount of days that can be set for an automated action in a policy?\n\nLast updated 4 months ago\n\n## Purpose\n\nTo know what the maximum amount of days an automated action under a policy can be set to.\n\n## Answer\n\nPolicy automated actions can only be set to a max of 29 days out. An example of this is Redaction or Deletion. Both have a max of 29 days under \"Trigger action\".\n\n![image.png](/api/knowledge-base/images/bf3c4076-a514-4e78-8e8b-e701294de26d \"image.png\")\n\n29 days is the max amount due to [stored data](https://nightfall-ai-knowledge-base.help.usepylon.com/articles/6722826529-how-long-are-violations-events-stored-and-actionable-in-the-nightfall-ai-console) only being actionable up to 30 days.\n\nHow helpful was this article?\n","2026-08-03T17:22:58.069Z","2026-08-03T17:22:58.583Z","1d036166-47dd-4667-aa8e-47d507f40bc1",[],[],[],"Nightfall Console: How to Invite an Admin to a Nightfall Tenant when SSO is Activated | Nightfall AI Knowledge Base","nightfall-console-how-to-invite-an-admin-to-a-nightfall-tenant-when-sso-is-activated-nightfall-ai-kn","https://kb.nightfall.ai/articles/2154133891-nightfall-console-how-to-invite-an-admin-to-a-nightfall-tenant-when-sso-is-activated","# Nightfall Console: How to Invite an Admin to a Nightfall Tenant when SSO is Activated\n\nLast updated 2 months ago\n\n## Purpose\n\nTo know the process of how to invite another administrator to a Nightfall tenant when SSO is already set up and in-use\n\n## Environment\n\nNightfall Web Console: All Versions\n\n## Resolution\n\n### Nightfall Administrator\n\n1. Log into the Nightfall tenant\n\n2. Navigate to Account > Settings > Users & Roles\n\n3. Click the `+ Invite User` button\n\n4. Add a Name, Email Address, and Role\n\n5. Click the `Invite` button\n\n### Invited User\n\n_NOTE: There is no need for the invited user to accept the invitation. In fact, attempting to accept the invitation will not work._\n\n1. Log into your IdP\n\n2. Log into Nightfall via SSO\n\nThis guide requires SSO to have already been set up by Nightfall Support.\n\nHow helpful was this article?\n","2026-08-03T17:22:51.736Z","2026-08-03T17:22:51.786Z","7e8f1563-df70-4765-a01d-6a3a0f75a35f",[],[],[],"Nightfall AI Knowledge Base","nightfall-ai-knowledge-base","https://kb.nightfall.ai","Integration: Gmail/Data Encryption\n","2026-08-03T17:22:48.478Z","2026-08-03T17:22:48.519Z","717e8c2b-fb08-498a-8d49-54d7d45ca3d7",[],[],[],"Nightfall AI Extension: How to Collect Logs | Nightfall AI Knowledge Base","nightfall-ai-extension-how-to-collect-logs-nightfall-ai-knowledge-base","https://kb.nightfall.ai/articles/4851642686-nightfall-ai-extension-how-to-collect-logs","# Nightfall AI Extension: How to Collect Logs\n\nLast updated 3 months ago\n\n## Purpose\n\nTo collect logs for the extension directly in the Chrome browser.\n\n## Environment\n\n- Google Chrome: All Versions\n\n- Nightfall Extension: v8.10.0 and higher\n\n## Resolution\n\n1. Within Chrome, navigate to the Options menu for the Nightfall extension.\n\n 1. From the Chrome bar, click on the Extensions icon.\n\n 2. Find the Nightfall extension > click on the three-vertical-dots menu.\n\n 3. Click on \"Options\".\n2. Change the URL path to include \"?showLogs=true\" and press enter.\n\nExample:\n\nchrome-extension://jgmgecncmjklkabkejnjfgfkglapfgek/src/extension-popup/options/options.html?showLogs=true\n\nNOTE: The value, \"true\", is case-sensitive. Confirm it is lowercase.\n\n3. When the page loads press the Export button at the top-right.\n\n ![](/api/knowledge-base/images/f897f03b-a9c5-496c-ba3f-aeb2ae10a0a0)\n4. Share the logs with Nightfall Support.\n\nHow helpful was this article?\n","2026-08-03T17:22:53.315Z","2026-08-03T17:22:53.691Z","2230f7ad-571b-4bf1-b1b0-78c724642f57",[],[],[],"Nightfall Agent: What is the install path for the macOS and Windows Agent? | Nightfall AI Knowledge Base","nightfall-agent-what-is-the-install-path-for-the-macos-and-windows-agent-nightfall-ai-knowledge-base","https://kb.nightfall.ai/articles/1301349102-nightfall-agent-what-is-the-install-path-for-the-macos-and-windows-agent","# Nightfall Agent: What is the install path for the macOS and Windows Agent?\n\n## Purpose\n\nTo know where the macOS and Windows agents and their processes are installed\n\n## Answer\n\n## macOS\n\n### **macOS install path:**\n\n`/Applications/NightfallAIAgent.app`\n\n**Additional Nightfall macOS processes:**\n\n- Launch Daemon: `/Library/LaunchDaemons/ai.nightfall.daemon.plist`\n\n- Launch Agent: `/Library/LaunchAgents/ai.nightfall.agent.plist`\n\n- Configuration: `/Applications/NightfallAIAgent.app/Contents/Info.plist`\n\n**macOS logs path:**\n\n- Root Account:\n\n`/var/root/Library/\"Application Support\"/NightfallAIAgent/Logs`\n\n- User Account:\n\n`~/Library/\"Application Support\"/NightfallAIAgent/Logs`\n\n## Windows\n\n**Windows install path:**\n\n`C:\\Program Files\\NightfallAI-Agent`\n\n**Additional Nightfall Windows processes:**\n\n- User Interface: `C:\\Program Files\\NightfallAI-Agent\\NightfallUI.exe`\n\n- Configuration: `C:\\Program Files\\Nightfall Agent\\appsettings.json`\n\n- Registry: `HKEY_LOCAL_MACHINE\\SOFTWARE\\NightfallAI\\NightfallAgent`\n\n- Auto Updater:\n\n `C:\\Program Files\\NightfallAI-Agent\\NightfallAutoUpdater.exe`\n\n**Windows logs path:**\n\n`C:\\ProgramData\\Nightfall Agent\\Logs`\n","2026-08-03T17:22:52.980Z","2026-08-03T17:22:53.011Z","fe57cae4-465e-4267-9e71-83490c2a2694",[],[],[],"Nightfall Agent: Logs Show Error: \"Error: Agent not authorized for full disk access.\" | Nightfall AI Knowledge Base","nightfall-agent-logs-show-error-error-agent-not-authorized-for-full-disk-access-nightfall-ai-knowled","https://kb.nightfall.ai/articles/9537148009-nightfall-endpoint-agent-logs-show-error-error-agent-not-authorized-for-full-disk-access","# Nightfall Agent: Logs Show Error: \"Error: Agent not authorized for full disk access.\"\n\nLast updated 6 months ago\n\n## Issue\n\nFull Disk Access error is being shown:\n\n- /var/root/Library/Application Support/NightfallAIAgent/Logs shows error:\n\n```\nError: Agent not authorized for full disk access.\n```\n\n- Console endpoint status shows, \"Missing full disk access\".\n\n## Environment\n\n- macOS: All versions\n\n- Nightfall Endpoint Agent: v1.2.7 and higher\n\n## Cause\n\nFull Disk Access (FDA) is not enabled locally for the NightfallAIAgent process.\n\n## Resolution\n\n### Local (from the machine):\n\n1. Navigate to: Settings > Privacy & Security > Full Disk Access\n\n2. Toggle on Full Disk Access for the NightfallAIAgent\n\n### MDM:\n\n1. Select the appropriate [MDM walkthrough](https://help.nightfall.ai/data-exfiltration-prevention/exfiltration_endpoint/installation_mac) according to the MDM being utilized.\n\n2. Confirm that the \".mobileconfig\" profile is being pushed out successfully. This profile sets up Full Disk Access permissions for the agent.\n\n3. Redeploy following the steps within the MDM guide of choice; confirm none of the steps were missed.\n\nThe agent requires Full Disk Access to run successfully.\n\n## Referenced Links\n\n- [Using MDM for macOS Agent Deployment](https://help.nightfall.ai/data-exfiltration-prevention/exfiltration_endpoint/installation_mac)\n\n- [How to Collect macOS Agent Logs](https://nightfall-ai-knowledge-base.help.usepylon.com/articles/9204213686-macos-nightfall-agent-where-are-the-macos-agent-logs-stored)\n\n- [What is the purpose of the macOS pre\\_install scripts and the .mobileconfig file?](https://nightfall-ai-knowledge-base.help.usepylon.com/articles/7312589129-what-is-the-purpose-of-the-macos-pre-install-scripts-and-the-mobileconfig-file)\n\nHow helpful was this article?\n","2026-08-03T17:22:52.551Z","2026-08-03T17:22:52.583Z","a5ef7b12-0e96-4172-954d-f1548edd5c28",[],[],[],"Nightfall Agent: How to Collect Windows Agent Logs | Nightfall AI Knowledge Base","nightfall-agent-how-to-collect-windows-agent-logs-nightfall-ai-knowledge-base","https://kb.nightfall.ai/articles/9070551745-windows-nightfall-agent-where-are-the-windows-agent-logs-stored","# Nightfall Agent: How to Collect Windows Agent Logs\n\nLast updated 6 months ago\n\n## Context\n\nThe purpose is to identify where the Windows agent logs are stored to either examine them or provide them to Nightfall Technical Support.\n\n## Answer\n\n1. Navigate to:\n\n```\n%ProgramData%\\NightfallAI-Agent\\Logs\n```\n\n2. Find and copy the logs entitled:\n\n```\nnightfall-agent-*.log\n```\n\nThe nightfall-agent logs go by a YearMonthDay naming convention. Choose the one according to the day wanting to be analyzed.\n\nHow helpful was this article?\n","2026-08-03T17:22:52.390Z","2026-08-03T17:22:52.437Z","2a4889e0-b53f-488c-9231-50c86ca1005b",[],[],[],"Nightfall Agent: How to Collect macOS Agent Logs | Nightfall AI Knowledge Base","nightfall-agent-how-to-collect-macos-agent-logs-nightfall-ai-knowledge-base","https://kb.nightfall.ai/articles/9204213686-macos-nightfall-agent-where-are-the-macos-agent-logs-stored","# Nightfall Agent: How to Collect macOS Agent Logs\n\nLast updated 6 months ago\n\n## Context\n\nThe purpose is to identify where the macOS agent logs are stored to either examine them or provide them to Nightfall Technical Support.\n\n## Answer\n\nNavigate to the two directories below and copy the files to share with Technical Support:\n\n- Root Account:\n\n```\nsudo -s\ncd /var/root/Library/\"Application Support\"/NightfallAIAgent/Logs\n```\n\n- User Account:\n\n```\ncd ~/Library/\"Application Support\"/NightfallAIAgent/Logs\n```\n\n**Note**: The log files in both locations will follow the naming convention of:\n\n_\"ai.nightfall.endpoint year-month-day--time.log\"_\n\nHow helpful was this article?\n","2026-08-03T17:22:51.241Z","2026-08-03T17:22:51.278Z","ac893e6c-5a0d-429b-a3f1-2896f191aec5",[],[],[],"Nightfall","https://support.nightfall.ai/login?kbUrl=https%3A%2F%2Fkb.nightfall.ai%2Farticles%2F7684715306-nightfall-web-console-how-to-set-up-the-mdm-integration","![](/api/knowledge-base/images/d0244358-3890-4998-b055-d422066b06df)\n\n[Powered by Pylon](https://www.usepylon.com/)\n","2026-08-03T17:23:00.986Z","2026-08-03T17:23:02.402Z","109da6e7-33c6-4912-b3c6-095ba7eb5bdc",[],[],[],"MS Teams Integration: Error: \"Onboarding error\" | Nightfall AI Knowledge Base","ms-teams-integration-error-onboarding-error-nightfall-ai-knowledge-base","https://kb.nightfall.ai/articles/6825923980-ms-teams-integration-error-onboarding-error","# MS Teams Integration: Error: \"Onboarding error\"\n\nLast updated 4 months ago\n\n## Issue\n\nCannot set up the Microsoft Teams integration.\n\n- Console shows error, \"_Onboarding error_\"\n\n![image.png](/api/knowledge-base/images/86f85411-3b8a-428d-a589-7ff998577fe1 \"image.png\")\n\n- When the \"_Permissions requested_\" box appears from Microsoft, the checkbox, \"_Consent on behalf of your organisation_\" is not present.\n\n![image.png](/api/knowledge-base/images/8f15bb01-c36f-4049-b2f8-37e247a803b9 \"image.png\")\n\n## Environment\n\n- Nightfall Web Console\n\n- Integration: Microsoft Teams\n\n## Cause\n\nInsufficient user permissions\n\n## Resolution\n\nChange permissions to one of these two:\n\n- Privileged Role Administrator\n\n- Global Administrator\n\nHow helpful was this article?\n","2026-08-03T17:23:00.113Z","2026-08-03T17:23:00.845Z","79418109-dd28-478f-a169-1f04d2cf6f11",[],[],[],"MDM Integration: How to Find the MDM macOS Profile and EmailID in the Payload | Nightfall AI Knowledge Base","mdm-integration-how-to-find-the-mdm-macos-profile-and-emailid-in-the-payload-nightfall-ai-knowledge-","https://kb.nightfall.ai/articles/4310598802-how-to-find-the-mdm-profile-and-emailid-in-the-payload","# MDM Integration: How to Find the MDM macOS Profile and EmailID in the Payload\n\n## Purpose\n\nTo find the MDM profile and Email to share with Nightfall\n\n## Environment\n\n- MDM: Payload\n\n - Profile and EmailID\n- macOS: All Versions\n\n## Resolution\n\nFrom the machine, open Terminal and run:\n\n`sudo profiles show -o stdout`\n\n1. Locate the email and profile in question. Example:\n\n ```\n ProfileIdentifier = \"com.random.abcdefgh12345678\"ProfileItems = ( { PayloadContent = { ... Email = \"john.doe@contoso.com\";\n ```\n\n2. Take note of the ProfileIdentifier, ProfileItems, PayloadContent, and Email.\n\n3. Provide the complete profile payload to Technical Support\n\nNOTE: The email and Profile in the payload to choose would be whatever is assigned to your MDM profile.\n","2026-08-03T17:22:52.229Z","2026-08-03T17:22:52.261Z","a6d6b8d6-fd44-4f51-91c7-8ccaac62566b",[],[],[],"Integration: Slack | Nightfall AI Knowledge Base","integration-slack-nightfall-ai-knowledge-base","https://kb.nightfall.ai/collections/3634823133-integration_slack","\\[\n\nSlack: Does a manually resolved violation inform the user that it has been resolved?\n\n›\n\n]\\()\n","2026-08-03T17:22:50.806Z","2026-08-03T17:22:50.831Z","18698aa0-9708-4719-a216-067b14d176eb",[],[],[],"Integration: Microsoft Teams | Nightfall AI Knowledge Base","integration-microsoft-teams-nightfall-ai-knowledge-base","https://kb.nightfall.ai/collections/6094206353-integration_microsoft_teams","\\[\n\nMS Teams Integration: Error: \"Onboarding error\"\n\n›\n\n]\\()\n","2026-08-03T17:22:58.706Z","2026-08-03T17:22:58.736Z","e648e003-98cf-4dcf-bf1a-91c8347d7c7f",[],[],[],"Integration: Microsoft 365 | Nightfall AI Knowledge Base","integration-microsoft-365-nightfall-ai-knowledge-base","https://kb.nightfall.ai/collections/3758001502-integration_microsoft_365","Integration: Microsoft Teams\n","2026-08-03T17:22:50.663Z","2026-08-03T17:22:50.690Z","c09dcf63-4f40-44fd-a18c-77b68ec1a3c4",[],[],[],"Integration: Gmail/Data Encryption | Nightfall AI Knowledge Base","integration-gmaildata-encryption-nightfall-ai-knowledge-base","https://kb.nightfall.ai/collections/8250732653-integration_gmail_data_encryption","\\[\n\nData Encryption: How to Perform the One-Time Local Approval of the Extension\n\n›\n\n]\\()\n","2026-08-03T17:22:50.520Z","2026-08-03T17:22:50.547Z","32e2815e-2769-4c2c-88c4-0ec9241d20fb",[],[],[],"https://kb.nightfall.ai/articles/8665745649-troubleshooting-nightfall-endpoint-agent-process-on-macos","# How to Confirm that the Nightfall Endpoint Agent Process is Running on macOS\n\n## Purpose\n\nTo identify if the Nightfall Endpoint Agent Process is Running on a macOS machine and restart it if necessary.\n\nIf you're experiencing issues with the Nightfall endpoint agent not appearing to run on some laptops, despite the console showing a connected status, follow these steps.\n\n## Environment\n\n- macOS\n\n- Nightfall Endpoint Agent: v1.2.7 and higher\n\n## Resolution\n\n## Verify the Process Status\n\nTo check if the Nightfall process is running on your macOS device:\n\n1. Open Terminal\n\n2. Run the following command:\n\n ```\n ps aux | grep Nightfall\n ```\n\nNote: The process name \"Nightfall\" is case-sensitive. Make sure to use a capital 'N' when searching for the process.\n\n## Interpreting the Results\n\nAfter running the command, you may encounter one of these scenarios:\n\n1. **Process is running:** You'll see output lines containing \"Nightfall\" (excluding the grep command itself).\n\n2. **Process is not running:** You'll only see the grep command in the output.\n\n## What to Do If the Process Is Not Running\n\nIf the Nightfall process doesn't appear to be running:\n\n1. Check the Nightfall console to confirm the device's connection status.\n\n2. If the console shows the device as connected but the process isn't visible, try restarting the Nightfall agent on your device.\n\n3. If the issue persists, there might be a deployment problem or a discrepancy between the agent's status and its actual operation.\n\n## Still Having Issues?\n\nIf you've followed these steps and are still experiencing problems:\n\n1. Ensure you have the latest version of the Nightfall agent installed.\n\n2. Check for any security software that might be interfering with the Nightfall process.\n\n3. Contact Nightfall support for further assistance, providing:\n\n - The output of the `ps aux | grep Nightfall` command\n\n - A screenshot of the device's status in the Nightfall console\n\n - Your device's operating system version\n","2026-08-03T17:22:51.907Z","2026-08-03T17:22:51.955Z",[],[],[],[],[],[],"https://kb.nightfall.ai/collections/1035662851-detection-rules","\\[\n\nNightfall Detection Rules: Why is \"Very Likely\" Grayed Out within the Detection Rule?\n\n›\n\n]\\(\n\nNightfall Detection Rules: How to Increase the Confidence of a Custom RegEx Detector\n\n›\n\n]\\(\n\nNightfall Detection Rules: How to Use Regex Context Rules\n\n›\n\n]\\(\n\nNightfall Detection Rules: How to Set Up Credit Card Number Exclusions\n\n›\n\n]\\()\n","2026-08-03T17:22:50.375Z","2026-08-03T17:22:50.403Z",[],[],[],"Detection | Nightfall AI Knowledge Base","detection-nightfall-ai-knowledge-base","https://kb.nightfall.ai/collections/4598309553-detection","Why a Government ID (SSN, National ID, Tax ID, Passport) Was Not Detected\n\n›\n","2026-08-03T17:22:50.943Z","2026-08-03T17:22:50.971Z","c2caaeaa-65ed-4726-a7b5-745a48f7f330",[],[],[],"Data Encryption: How to Perform the One-Time Local Approval of the Extension | Nightfall AI Knowledge Base","data-encryption-how-to-perform-the-one-time-local-approval-of-the-extension-nightfall-ai-knowledge-b","https://kb.nightfall.ai/articles/7699220704-data-encryption-how-to-perform-the-one-time-local-approval-of-the-extension","# Data Encryption: How to Perform the One-Time Local Approval of the Extension\n\nLast updated 1 month ago\n\n## Purpose\n\nTo locally approve the Google connection and extension on a machine for the first- and only-time\n\n## Environment\n\n- Google Chrome: All versions\n\n- Google Workspace: Gmail\n\n- Nightfall Extension: All versions\n\n## Resolution\n\n### Enable the Extension\n\n1. Click on the Nightfall extension at the top-right of the Chrome browser.\n\n NOTE: It is normal to see a red square with a black exclamation mark.\n\n2. Click the \"**Grant Permissions**\" button.\n\n![image.png](/api/knowledge-base/images/838a90f5-2a1d-44e6-9665-a5ad3de4af82 \"image.png\")\n\n3. Follow the prompts to enable the Nightfall DLP extension.\n\n ![image.png](/api/knowledge-base/images/b86f4f5b-ae10-4ada-9c31-15ab83a29185 \"image.png\")\n\n### Connect the Gmail Account\n\n_This requires the user to send their very first email with data encryption being enabled._\n\n1. Send a real or test email.\n\n 1. **Log** into Gmail\n\n 2. **Click** Compose\n\n 3. **Type** out the email\n\n 4. **Send** the email\n2. After sending, follow the prompts.\n\n 1. Select your email when prompted.\n\n ![image.png](/api/knowledge-base/images/a2174c69-1c99-4cd8-8413-478f515b44f3 \"image.png\")\n 2. Click \"**Continue**\" to allow Nightfall DLP to access your work info related your email.\n\n ![image.png](/api/knowledge-base/images/d26e5e21-0ea9-4be9-a094-56a5b082d312 \"image.png\")\n 3. Lastly, checkmark \"**Select All**\" and click \"**Continue**\".\n\n ![image.png](/api/knowledge-base/images/1766b2e4-084f-4aee-b2a6-fff752a145a7 \"image.png\")\n\nHow helpful was this article?\n","2026-08-03T17:22:54.262Z","2026-08-03T17:22:56.688Z","1a2cc70e-47fb-40b7-8212-7ca45448e463",[],[],[],"Console | Nightfall AI Knowledge Base","console-nightfall-ai-knowledge-base","https://kb.nightfall.ai/collections/3558083637-console","[![Nightfall AI Knowledge Base](/api/knowledge-base/images/732a47a6-b3ab-48b0-a165-2cb6a8cf82ca)![Nightfall AI Knowledge Base](/api/knowledge-base/images/2115878c-cbb1-4b53-88ed-2ee7e2555dbf)](https://kb.nightfall.ai/)\n\n\\[\n\nSSO\n\n1 article\n\n]\\()\n","2026-08-03T17:22:48.635Z","2026-08-03T17:22:49.797Z","9a6bc8e0-122c-457d-9d23-397589bdb364",[],[],[],"Browser Extension | Nightfall AI Knowledge Base","browser-extension-nightfall-ai-knowledge-base","https://kb.nightfall.ai/collections/7191926154-browser-extension","Nightfall AI Extension: How to Collect Logs\n\n›\n\nNightfall Extension: How to Collect Extension Logs\n\n›\n","2026-08-03T17:22:50.068Z","2026-08-03T17:22:50.095Z","f0ec561b-05e3-4e25-877c-bc810dff5cf7",[],[],[],{"_90":573,"_112":574,"_123":575,"_125":576,"_127":-5,"_128":108,"_129":577,"_131":578,"_22":579,"_24":25,"_134":-5,"_135":736,"_137":-5,"_138":737,"_140":738},{"_90":563,"_112":564,"_123":565,"_125":566,"_127":-5,"_128":108,"_129":567,"_131":568,"_22":569,"_24":25,"_134":-5,"_135":733,"_137":-5,"_138":734,"_140":735},{"_90":553,"_112":554,"_123":555,"_125":556,"_127":-5,"_128":108,"_129":557,"_131":558,"_22":559,"_24":25,"_134":-5,"_135":730,"_137":-5,"_138":731,"_140":732},{"_90":543,"_112":544,"_123":545,"_125":546,"_127":-5,"_128":108,"_129":547,"_131":548,"_22":549,"_24":25,"_134":-5,"_135":727,"_137":-5,"_138":728,"_140":729},{"_90":115,"_112":116,"_123":536,"_125":537,"_127":-5,"_128":108,"_129":538,"_131":539,"_22":114,"_24":25,"_134":-5,"_135":724,"_137":-5,"_138":725,"_140":726},{"_90":122,"_112":121,"_123":124,"_125":126,"_127":-5,"_128":108,"_129":130,"_131":132,"_22":133,"_24":25,"_134":-5,"_135":721,"_137":-5,"_138":722,"_140":723},{"_90":111,"_112":113,"_123":526,"_125":527,"_127":-5,"_128":108,"_129":528,"_131":529,"_22":110,"_24":25,"_134":-5,"_135":718,"_137":-5,"_138":719,"_140":720},{"_90":516,"_112":517,"_123":518,"_125":519,"_127":-5,"_128":108,"_129":520,"_131":521,"_22":522,"_24":25,"_134":-5,"_135":715,"_137":-5,"_138":716,"_140":717},{"_90":506,"_112":507,"_123":508,"_125":509,"_127":-5,"_128":108,"_129":510,"_131":511,"_22":512,"_24":25,"_134":-5,"_135":712,"_137":-5,"_138":713,"_140":714},{"_90":496,"_112":497,"_123":498,"_125":499,"_127":-5,"_128":108,"_129":500,"_131":501,"_22":502,"_24":25,"_134":-5,"_135":709,"_137":-5,"_138":710,"_140":711},{"_90":486,"_112":487,"_123":488,"_125":489,"_127":-5,"_128":108,"_129":490,"_131":491,"_22":492,"_24":25,"_134":-5,"_135":706,"_137":-5,"_138":707,"_140":708},{"_90":476,"_112":477,"_123":478,"_125":479,"_127":-5,"_128":108,"_129":480,"_131":481,"_22":482,"_24":25,"_134":-5,"_135":703,"_137":-5,"_138":704,"_140":705},{"_90":466,"_112":467,"_123":468,"_125":469,"_127":-5,"_128":108,"_129":470,"_131":471,"_22":472,"_24":25,"_134":-5,"_135":700,"_137":-5,"_138":701,"_140":702},{"_90":457,"_112":65,"_123":458,"_125":459,"_127":-5,"_128":108,"_129":460,"_131":461,"_22":462,"_24":25,"_134":-5,"_135":697,"_137":-5,"_138":698,"_140":699},{"_90":447,"_112":448,"_123":449,"_125":450,"_127":-5,"_128":108,"_129":451,"_131":452,"_22":453,"_24":25,"_134":-5,"_135":694,"_137":-5,"_138":695,"_140":696},{"_90":437,"_112":438,"_123":439,"_125":440,"_127":-5,"_128":108,"_129":441,"_131":442,"_22":443,"_24":25,"_134":-5,"_135":691,"_137":-5,"_138":692,"_140":693},{"_90":427,"_112":428,"_123":429,"_125":430,"_127":-5,"_128":108,"_129":431,"_131":432,"_22":433,"_24":25,"_134":-5,"_135":688,"_137":-5,"_138":689,"_140":690},{"_90":417,"_112":418,"_123":419,"_125":420,"_127":-5,"_128":108,"_129":421,"_131":422,"_22":423,"_24":25,"_134":-5,"_135":685,"_137":-5,"_138":686,"_140":687},{"_90":407,"_112":408,"_123":409,"_125":410,"_127":-5,"_128":108,"_129":411,"_131":412,"_22":413,"_24":25,"_134":-5,"_135":682,"_137":-5,"_138":683,"_140":684},{"_90":397,"_112":398,"_123":399,"_125":400,"_127":-5,"_128":108,"_129":401,"_131":402,"_22":403,"_24":25,"_134":-5,"_135":679,"_137":-5,"_138":680,"_140":681},{"_90":387,"_112":388,"_123":389,"_125":390,"_127":-5,"_128":108,"_129":391,"_131":392,"_22":393,"_24":25,"_134":-5,"_135":676,"_137":-5,"_138":677,"_140":678},{"_90":377,"_112":378,"_123":379,"_125":380,"_127":-5,"_128":108,"_129":381,"_131":382,"_22":383,"_24":25,"_134":-5,"_135":673,"_137":-5,"_138":674,"_140":675},{"_90":367,"_112":368,"_123":369,"_125":370,"_127":-5,"_128":108,"_129":371,"_131":372,"_22":373,"_24":25,"_134":-5,"_135":670,"_137":-5,"_138":671,"_140":672},{"_90":357,"_112":358,"_123":359,"_125":360,"_127":-5,"_128":108,"_129":361,"_131":362,"_22":363,"_24":25,"_134":-5,"_135":667,"_137":-5,"_138":668,"_140":669},{"_90":347,"_112":348,"_123":349,"_125":350,"_127":-5,"_128":108,"_129":351,"_131":352,"_22":353,"_24":25,"_134":-5,"_135":664,"_137":-5,"_138":665,"_140":666},{"_90":337,"_112":338,"_123":339,"_125":340,"_127":-5,"_128":108,"_129":341,"_131":342,"_22":343,"_24":25,"_134":-5,"_135":661,"_137":-5,"_138":662,"_140":663},{"_90":327,"_112":328,"_123":329,"_125":330,"_127":-5,"_128":108,"_129":331,"_131":332,"_22":333,"_24":25,"_134":-5,"_135":658,"_137":-5,"_138":659,"_140":660},{"_90":317,"_112":318,"_123":319,"_125":320,"_127":-5,"_128":108,"_129":321,"_131":322,"_22":323,"_24":25,"_134":-5,"_135":655,"_137":-5,"_138":656,"_140":657},{"_90":307,"_112":308,"_123":309,"_125":310,"_127":-5,"_128":108,"_129":311,"_131":312,"_22":313,"_24":25,"_134":-5,"_135":652,"_137":-5,"_138":653,"_140":654},{"_90":297,"_112":298,"_123":299,"_125":300,"_127":-5,"_128":108,"_129":301,"_131":302,"_22":303,"_24":25,"_134":-5,"_135":649,"_137":-5,"_138":650,"_140":651},{"_90":287,"_112":288,"_123":289,"_125":290,"_127":-5,"_128":108,"_129":291,"_131":292,"_22":293,"_24":25,"_134":-5,"_135":646,"_137":-5,"_138":647,"_140":648},{"_90":277,"_112":278,"_123":279,"_125":280,"_127":-5,"_128":108,"_129":281,"_131":282,"_22":283,"_24":25,"_134":-5,"_135":643,"_137":-5,"_138":644,"_140":645},{"_90":267,"_112":268,"_123":269,"_125":270,"_127":-5,"_128":108,"_129":271,"_131":272,"_22":273,"_24":25,"_134":-5,"_135":640,"_137":-5,"_138":641,"_140":642},{"_90":257,"_112":258,"_123":259,"_125":260,"_127":-5,"_128":108,"_129":261,"_131":262,"_22":263,"_24":25,"_134":-5,"_135":637,"_137":-5,"_138":638,"_140":639},{"_90":247,"_112":248,"_123":249,"_125":250,"_127":-5,"_128":108,"_129":251,"_131":252,"_22":253,"_24":25,"_134":-5,"_135":634,"_137":-5,"_138":635,"_140":636},{"_90":237,"_112":238,"_123":239,"_125":240,"_127":-5,"_128":108,"_129":241,"_131":242,"_22":243,"_24":25,"_134":-5,"_135":631,"_137":-5,"_138":632,"_140":633},{"_90":227,"_112":228,"_123":229,"_125":230,"_127":-5,"_128":108,"_129":231,"_131":232,"_22":233,"_24":25,"_134":-5,"_135":628,"_137":-5,"_138":629,"_140":630},{"_90":217,"_112":218,"_123":219,"_125":220,"_127":-5,"_128":108,"_129":221,"_131":222,"_22":223,"_24":25,"_134":-5,"_135":625,"_137":-5,"_138":626,"_140":627},{"_90":207,"_112":208,"_123":209,"_125":210,"_127":-5,"_128":108,"_129":211,"_131":212,"_22":213,"_24":25,"_134":-5,"_135":622,"_137":-5,"_138":623,"_140":624},[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],[],{"_62":747,"_742":748,"_743":-5,"_92":744,"_745":749,"_129":750,"_131":751,"_22":108,"_24":25},{"_62":741,"_742":-5,"_743":-5,"_92":744,"_745":-5,"_129":746,"_131":746,"_22":109,"_24":25},"Nightfall Support Portal","supportName","supportLogo","External support for customer inquiries and issues","defaultTriageChannelId","2026-08-03T17:52:54.263Z","Customer Support","Nightfall AI Agent","C0BMQ119FCJ","2026-08-03T16:57:14.215Z","2026-08-03T17:30:50.013Z","user",{"_755":756,"_754":27},"anonymous","uid","anon_1785790963417_w6pfgjg","apiKey","AIzaSyDCG_xdkCxQ0mNJT1LKg2XIf0cHJwSISYU","authDomain","unthread"]