FortiDLP Agent feature matrix
The following tables outline the features the Agent supports by OS.
| Feature | Windows | macOS | Linux |
|---|---|---|---|
| Applications (foreground vs background changes) | ✓ |
✓
Application changes are reported, but window changes and window title changes are not |
|
| Browsers (URL visits, downloads, and uploads) (see Web monitoring) | ✓ | ✓ | ✓ |
| Clipboard (copies and pastes) (see Clipboard monitoring) | ✓ | ✓ |
✓
Browser copies and pastes only |
| DNS requests and responses | ✓ | ✓ | ✓ |
| Emails (see Email monitoring) |
✓
For Classic Outlook desktop, inbound and outbound emails For New Outlook desktop and Outlook on the Web, outbound emails only |
✓
For New Outlook desktop and Outlook on the Web, outbound emails only |
|
| Event Tracing for Windows (ETW) | ✓ | ||
| File accesses (opens, modifications, closes, moves, renames, and deletions) and executions | ✓ | ✓ | ✓ |
|
File content inspection (CI) |
✓ | ✓ |
✓
Preview support |
|
File Microsoft sensitivity label inspection (refer to the FortiDLP Administration Guide) |
✓ | ✓ |
✓
Preview support |
|
Email Microsoft sensitivity label inspection (see Email monitoring and refer to the FortiDLP Administration Guide) |
✓
For Classic Outlook desktop, inbound and outbound emails For New Outlook desktop and Outlook on the Web, outbound emails only |
✓
For New Outlook desktop and Outlook on the Web, outbound emails only |
|
| Keystrokes (see Keystroke monitoring) | ✓ | ✓ | |
| Locations (Wi-Fi landscaping) | ✓ | ✓ | ✓ |
| Logins and failed login attempts | ✓ |
✓
Logins only |
✓ |
| Networks (TCP connections and disconnections) | ✓ | ✓ | ✓ |
| Print jobs (see Print monitoring) | ✓ | ✓ | ✓ |
| Process starts | ✓ | ✓ | ✓ |
| USB devices (connections and disconnections) | ✓ | ✓ | ✓ |
| User activity (idle vs active users) | ✓ | ✓ | |
| Wi-Fi networks (connections and disconnections) | ✓ | ✓
For macOS 14.4 and earlier only |
✓ |
|
When performing CI, the FortiDLP Agent examines files of interest locally. File contents are not uploaded to the FortiDLP Infrastructure. On Windows, CI cannot be performed on documents created using Microsoft Office 2003. |
|
|
On macOS, policies relating to pasting to desktop applications only monitor pastes via keyboard shortcuts. |
| Feature | Windows | macOS | Linux |
|---|---|---|---|
| Block browser download | ✓ | ✓ |
✓
Preview CI support |
| Block browser upload | ✓ | ✓ |
✓
Preview CI support |
| Block file transfer to USB storage device | ✓ | ✓ | |
| Block outbound email | ✓ | ✓ | |
| Block print job |
✓ |
✓ |
✓
Preview CI support |
| Block USB storage device | ✓ | ✓ | ✓ |
| Display message | ✓ | ✓ | |
| Empty clipboard | ✓ | ✓ | |
| Isolate/Deisolate | ✓ | ✓ | ✓ |
| Kill process | ✓ | ✓ | ✓ |
| Lock/Unlock | ✓ | ✓ | |
| Make shadow copy | ✓ | ✓ | ✓ |
| Reboot | ✓ | ✓ | ✓ |
| Request debug bundle | ✓ | ✓ | ✓ |
| Request performance report | ✓ | ✓ | ✓ |
| Take screenshot | ✓ | ✓ |