When a file is being copied from the Detection Server to Enforce, the file is created as a .tmp.  Once the transfer completes, the file is renamed from .tmp to .idc. 

If a transfer fails, the .tmp file may linger for a number of hours.  The time is configured in the \Protect\config\MonitorController.properties file with the setting temp_incident_expiration_hours.  The default is 24 hours.

If there is an excessive number of .tmp files that have a timestamp of more than an hour, it could be a sign of a problem with communication with one or more Detection Servers.