Endpoint Prevent and Endpoint Discover do not retain the original file

Products

• Data Loss Prevention Endpoint Discover
• Data Loss Prevention

Issue/Introduction

Endpoint Prevent and Endpoint Discover do not retain the original file by default.
How can the original file be retained?

Resolution

By default, Endpoint does not keep the original files.  The files can be added, however, there will be additional overhead.  The messages between the Endpoint Server and the Endpoint Agent will be larger.  Also, the database space will be increased, which may be significant with Endpoint Discover.

To retain the original file, add a Response Rule to the Endpoint Policy in order to include file attachments.

Available actions:

All: Limit Incident Data Retention  
Network Incidents:
Discard Original Message:   
Discard Attachment:   All |  Attachments with no Violations |  None 

All Endpoint Incidents (Including Endpoint Discover Incidents):
Enabling this option may prevent some events on endpoints from blocking (e.g. Copy to USB). To ensure that endpoint prevent works properly, disable the ENABLE_VEP_FILE_ELIMINATION setting from the Endpoint Settings page of the endpoint servers. 
Retain Original Message: