Hello,
I have a Endpoint DLP environment in which i have 2 endpoint servers and few agents reporting to them. I have created few policies and deployed them to the agents. Now the Endpoint agent is generating 2 incidents for every violation. Initially i thought there was some problem with the policy and configuration. but i feel everything is proper in place. I have analzed the incidents and i feel other than the Incident id,every single field in the incident is similar in both the incidents . same policy, same matached,same timing etc.. everything looks the same. Is there any setting which has to be done to overcome this behaviour. anyone faced similar issue.
Note: the problem is only with HTTP and Print incidents. HTTPS and removable storage incidents works fine.