You are reviewing an Endpoint Incident in the DLP Enforce console.
When you click on the attachment in the incident, the .wav file that caused the incident is now replaced by a .wav.txt with contents: "The file exceeded the data retention threshold and was not retained"
This is the correct behaviour and by design.
Versions of DLP prior to 14.5 DLP would truncate files at a threshold which generally led to corrupt unreadable files in the console because very few file types are still usable post-truncation.
This behaviour was changed in version 14.5 and later to discard attachments above a specified threshold size and instead replace them with a text file of the same name with the message inside "The file exceeded the data retention threshold and was not retained".
The DLP Agent Configuration - Advanced Agent Setting named IncidentHandler.MAX_INCIDENT_FILE_SIZE.int allows you to choose a reasonable size threshold that can be supported by your network bandwidth and database storage designs, which in turn permits inclusion of attachments, without the corruption up to that pre-defined threshold size.
If the file exceeds the data retention threshold value of IncidentHandler.MAX_INCIDENT_FILE_SIZE.int the the file is discarded as mentioned above. The default value of this setting is 31457280 bytes.
To modify the threshold value follow these steps: