Multiple pop-ups display on Mac endpoint after user enter applies justification to subsequent pop-ups

Products

• Data Loss Prevention Endpoint Prevent

Issue/Introduction

When a Mac endpoint user moves multiple sensitive files to a removable storage device in quick succession, and the Block response rule displays a pop-up notification, the user can opt to apply a justification to all subsequent incidents. However, a pop-up still displays for each sensitive file that was moved to the removable storage device. This occurs because the Finder application launches a new process for each file that is moved.

When multiple sensitive files are moved to a removable storage device in Mac OS X Yosemite using Finder, the subsequent incident displays DesktopServiceHelper in the incident snapshot instead of Finder. This occurs because DesktopServiceHelper is the service that performs the copy operation.
 

Resolution

None.