The Endpoint Agent's edpa_ext0.log file in the Endpoint Agent directory contains information about any message that is processed.
By default, the edpa_ext0.log is obfuscated. See TECH222092on how to deobfuscate this file.
The edpa_ext0.log file contains a Request Id, which is the request number. This number is added onto each of the lines relating to processing that request. Once the file has been deobfuscated, you can search for the Request Id within the file to follow the processing of the request.
Here are two examples of a request being processed - one that is not an incident, and one where an incident gets created:
Example of a request being processed that doesn't create an incident: