Vadagam,
When and endpoint is not able to connect to an Ednpoint server, it will store the encrypted incidents on the Hard Drive of the Laptop/desktop. You can configure how much drive space the agent can use for storage in the agent configuraiton.
Once the agent can connect to the endpoint server, it will send the encrypted incidents to the Endpoint Server.
The endpoint Server will store the incidents on its Hard Drive until it can connect to the Enforce Server. If the Endpoint server can't connect to the Enforce server it will store the incdient on the Hard Drive unitl it can recoonect to the Enforce Serve. Once the incident is received on the Enforce Server it will be sent to the Connected DB and then you will see the incident in the Enforce UI.
Good Luck,
Ronak
PLEASE MARKED SOLVED WHEN POSSIBLE