How to configure Symantec DLP to retain the Endpoint incident file