With 'Copy to local drive' enabled for Agent Monitoring, files being copied from one Network Drive to another Network Driver are being detected on the Endpoint Agent.
This is by design. The Endpoint is monitoring any traffic coming from the Endpoint Agent that is copying from the Network Share, and not just to the local drive. This is to ensure no copying is missed.
Imported Document ID: TECH221615
Subscribing will provide email updates when this Article is updated. Login is required.