Incidents contain lower match count than expected with Endpoint blocking enabled