Open an Endpoint incident that has a detection on the body and/or header.
Hover the cursor over the "Body" or "Header" link at the top of the incident.
You will see a note to "Download File Body" or "Download File Header".
Clicking on the link does not download the body or header.
A new page is opened, but that page is blank.
The URL of the new page is similar to "https://xxx-xxxxx.xxx.xx.local/ProtectManager/EndpointIncidentDetail.do?value(variable_1)=incident.id&value(operator_1)=incident.id_in&value(operand_1)=5738961&value(state_menuID)=endpoint.3".
Right-clicking on Body or Header does not present a download option.
You can download attachments and print jobs.
The response rule has "Retain Original Message" selected.
But it does not matter if that option is selected or not.
Release: 15.7 and 15.8
Engineering has identified a fix.
That fix will be included in DLP 16.
That fix will not be back-ported to DLP 15.x.