EDM detection rules on an Endpoint Agent can cause network performance issues.
To reduce the number of messages, we recommend creating a compound rule for the Endpoint policy.
First, set the rule for the EDM, then select 'also match' a DCM target, such as a keyword or a data identifier.
The DCM detection rule will work as a short circuit. Only the messages that match the DCM will be sent to the Server.