When a file is being copied from the Detection Server to Enforce, the file is created as a .tmp. Once the transfer completes, the file is renamed from .tmp to .idc.If a transfer fails, the .tmp file may linger for a number of hours. The time is configured in the C:\Vontu\Protect\config\MonitorController.properties file with the setting temp_incident_expiration_hours. The default is 24 hours.
If there is an excessive number of .tmp files that have a timestamp of more than an hour, it could be a sign of a problem with communication with one or more Detection Servers.