Behavior of Limit Incident Data Retention response rule action on Mac OS endpoints