Save files (or messages) which triggered incident creation based on the policies