FortiDLP
FortiDLP is a cloud-native endpoint DLP and Insider Risk Solution which is aimed at monitoring and Preventing Data Theft on the endpoint, across Windows, macOS and Linux.
james-hodgson
Article Id 365654
Description

This article describes a new user prompt added in macOS 15.2 that may be shown to users of the FortiDLP (formerly Reveal) Agent.

 

An example of this is:

 

screen-prompt.png

Scope

This issue exclusively applies to macOS 15.2 devices on which the user has consented to FortiDLP Agent screen capture/recording. 

The internal investigation confirmed that the popup is displayed when all the following circumstances are true: 

  • The managed macOS device has been updated to macOS 15.2.
  • The user has accepted the FortiDLP Agent screen capture consent popup, either before or after the update to 15.2. 
  • A policy action is executed that performs a screen capture.
Solution

A similar prompt was added to provide weekly reminders of Screen recording access in v15.0 and reduced to monthly reminders in v15.1. This other prompt can be disabled using a mobileconfig profile with ForceBypassScreenCaptureAlert set.

 

If the popup is ignored, it disappears after 15 seconds. If the popup is selected, System Settings opens at the Screen & System Audio Recording pane, showing screen recording is allowed for uk.ava.reveal.Reveal-Agent.

 

Whether the popup is clicked or ignored, on display of the popup, macOS 15.2 sets a new setting kScreenCapturePrivacyHintDate for 'uk.ava.reveal.Reveal-Agent' in ~/Library/Group\  Containers/group.com.apple.replayd/ScreenCaptureApprovals.plist to 90 days from the current date (kScreenCaptureApprovalLastUsed). 

No further popups are seen until the kScreenCapturePrivacyHintDate date, at that time the value is reset to 90 days from the current date again.