Nightfall Endpoint Agent: Third-Party AV App Flags Nightfall as Redirecting Network Traffic

Last updated 2 months ago

Issue

An EDR, NGAV, or XDR third-party program or app is detecting Nightfall as redirecting network traffic through a proxy or port.

• Windows third-party program detection shows:

  "C:\Program Files\NightfallAI-Agent\NightfallUI.exe"
  

• macOS third-party program detection shows:

  /Applications/NightfallAIAgent.app
  

Environment

• Microsoft Windows: All versions

• Apple macOS: All versions

Cause

Nightfall is performing a legitimate operation of analyzing traffic through its new Network Extension feature.

Resolution

Add the following processes/paths for Nightfall to the third-party program's allowlist/whitelist:

macOS

• /Applications/NightfallAIAgent.app

Windows

• C:\Program Files\NightfallAI-Agent\NightfallUI.exe

Reference Links

Nightfall Agent: What is the install path for the macOS and Windows Agent?

How helpful was this article?