A tool that scans directories, exports, and backups for sensitive data like PII and API keys using Nightfall's data loss prevention APIs.
Scan directories, exports, and backups for sensitive data (like PII and API keys) with Nightfall's data loss prevention (DLP) APIs. Discover what lives at-rest in your data silos.
This tool is designed for security and compliance teams who need to discover and audit sensitive data residing at-rest in various data silos such as cloud backups or exports from platforms like Salesforce or Jira. It helps organizations identify sensitive information to reduce data exposure risks and support compliance auditing.
Users must have a Nightfall account and appropriate admin access to generate backups or exports of their data silos. The tool relies on a local webhook server and ngrok for receiving scan results, so network configuration and security of the webhook endpoint should be carefully managed. The detection rule UUID is optional but can be customized to tailor sensitive data detection. Results are output in CSV format for easy auditing.
Create a cloud backup or export of the systems you wish to scan and extract it locally
Install dependencies with: pip install -r requirements.txt
Create a local ngrok tunnel pointing to your webhook server: ./ngrok http 8000
Set environment variables for NIGHTFALL_API_KEY, NIGHTFALL_SIGNING_SECRET, NIGHTFALL_DETECTION_RULE_UUID (optional), NIGHTFALL_SERVER_URL, and SCAN_DIRECTORY_PATH./ngrok http 8000
Starts a local ngrok tunnel to expose the webhook server for receiving Nightfall scan results
export NIGHTFALL_API_KEY=<your_key_here>
Sets the Nightfall API key environment variable for authentication
export NIGHTFALL_SIGNING_SECRET=<your_secret_here>
Sets the Nightfall signing secret environment variable for webhook verification
export NIGHTFALL_DETECTION_RULE_UUID=<your_uuid_here>
Optionally sets a custom detection rule UUID to specify what sensitive data to detect
export NIGHTFALL_SERVER_URL=https://<your_subdomain_here>.ngrok.io
Sets the webhook server URL that Nightfall will send scan results to
export SCAN_DIRECTORY_PATH='/path/to/your/export/'
Specifies the local directory path containing the extracted backup or export to scan
gunicorn app:app
Starts the local webhook server to receive scan results from Nightfall
python scanner.py
Initiates the scan of the specified directory using Nightfall's DLP APIs