When an incident is created by the Endpoint Agent, we do not send the whole file back to the Endpoint Server unless the original message is needed. Only the information relevant to the incident reports are sent to the Endpoint Server. The whole file is sent if Two Tier Detection is relevant for this message or if the Response Rule is set to Retain Original Message. Any data, either the original message or the incident is compressed before sending to the Endpoint Server.