When an incident is generated on the Endpoint Agent (for example copying a file to a USB drive), when the incident information is sent from the Endpoint Agent to the Endpoint Server, is the file compressed when transmitted?

When an incident is created by the Endpoint Agent, we do not send the whole file back to the Endpoint Server unless the original message is needed.  Only the information relevant to the incident reports are sent to the Endpoint Server.  The whole file is sent if Two Tier Detection is relevant for this message or if the Response Rule is set to Retain Original Message. Any data, either the original message or the incident is compressed before sending to the Endpoint Server.