Endpoint Prevent and Endpoint Discover do not retain the original file by default.
How can the original file be retained?
By default, Endpoint does not keep the original files. The files can be added, however, there will be additional overhead. The messages between the Endpoint Server and the Endpoint Agent will be larger. Also, the database space will be increased, which may be significant with Endpoint Discover.
To retain the original file, add a Response Rule to the Endpoint Policy in order to include file attachments.
All: Limit Incident Data Retention
Discard Original Message:
Discard Attachment: All | Attachments with no Violations | None
All Endpoint Incidents (Including Endpoint Discover Incidents):
Enabling this option may prevent some events on endpoints from blocking (e.g. Copy to USB). To ensure that endpoint prevent works properly, disable the ENABLE_VEP_FILE_ELIMINATION setting from the Endpoint Settings page of the endpoint servers.
Retain Original Message: