Take screenshot

Requirements: Windows or macOS.

For macOS, approval is needed for screenshots to be captured. For information about granting the access required, refer to the FortiDLP Agent Deployment Guide.

The take screenshot action allows you to capture an image of a user's computer screen. Designed to be used in high-risk situations, this action helps you validate whether a user poses a threat before you take further security measures.

The FortiDLP Agent can take screenshots in two modes:

• Static: Captures a single screenshot as a JPEG file.
• Motion: Captures a series of screenshots that are composed into an animated GIF. This mode requires Agent configuration groups to be enabled. For details, refer to the FortiDLP Administration Guide.

The take screenshot action is compatible with single and multiple monitor displays, capturing one JPEG/GIF for the entire virtual display. You can view screenshots in the Action details panel.

Screenshot actions can be executed manually, as described below, or automatically through policies.

How to take a screenshot on a managed node

1. In the FortiDLP Console, on the left-hand sidebar, click .
   
2. Filter for the relevant node. For guidance on this, see Nodes.
3. In the Table tab, on the row of the node, click> Perform actions.
   
4. In the Actions dialog box, click Take screenshot.
5. In the Take screenshot dialog box, click Take screenshot again.
6. To view the screenshot, do the following:
   1. Click View in Investigate.
   2. Select the relevant action event's table row.
      The Action details panel displays with the screenshot shown in the Key information & content widget.

An event for new actions is reported after the action is completed (succeeded or failed). For this reason, it may take longer for these events to display in the FortiDLP Console.