Endpoint Printer/Fax incident does not retain attachment

Hi All,

Please let me know if this is possible.

I have  created a Endpoint  policy with few keywords to detect the printing of those words, i have added a user cancel response rule to it. I have also added a response rule for incident data retention. Once i try to violate this policy, it is getting detected and also showing up the popup of User cancel. However the file which i am trying to print is not being shown in the incident.

Please help me to understand if there is a way to retain the file.