Unable to download incident attachment

Products

• Data Loss Prevention

Issue/Introduction

I have an endpoint incident in my UI that references a file, but the file is not able to be downloaded.

Cause

By default Endpoint incidents do not retain the attachments.

Therefore you cannot download the file as it was not kept.

Resolution

You can override the default behavior by adding the limit data retention response rule, and configuring it to retain the attachments.

Please see

Configuring the Limit Incident Data Retention action

Additional Information

Please note:

Retaining incident attachments on the endpoints can have negative results on agent communications, and creates higher than normal network bandwidth consumption. 

More endpoint servers and increased polling interval may be required depending on your environment.

Please see:

Endpoint Server running slowly, Aggregator logs show 'Rejecting existing connection with AgentId...'

and

Key DLP agent and Endpoint Server communications settings