You've noticed in the DLP Enforce Console some Endpoint Incidents with an Agent Response field value of "Allowed on macOS Timeout: Configured Action was Block" and a little alarm clock icon. You're wondering what this means and when does it occur.
Release : 15.8, 16.x
The "Allowed on macOS Timeout: Configured Action was Block" Endpoint Agent Response is specific to macOS DLP Endpoint Agents and signifies when there is a macOS timeout waiting on the agent to perform detection. Once the timeout period is reached the incident is created however the block response rule is not triggered and the message is allowed as indicated in the Agent Response field. There is no way to change this timeout period as it is hard coded.
In addition you may notice the ability to filter incidents on Agent Response field with the following values however only the value mentioned above actually is used so the other three values will not return any incident results.
Allowed on macOS Timeout: Configured Action was Notify
Blocked on macOS Timeout: Configured Action was Block
Blocked on macOS Timeout: Configured Action was Notify