How to solve Error: “Error 1802: Corrupted incident received”

Extend the tablespace:
See technote, Extend tablespace (LOB_TABLESPACE, USERS, etc.) when nearly or critically full
Once you have resolved the tablespace issue, you can rename the .bad files to .idc files, and the system will then store them in Oracle normally.
See technote, What is a .bad file?
Open a command prompt as Administrator
cd to the incidents folder on Enforce:
SymantecDLPProtectincidents (Windows)
/opt/Vontu/Protect/incidents (Linux) or /var/SymantecDLP/incidents
As a precaution backup all files in the incident folder to another location.
Rename the files from .bad to .idc.
Here is an example of the files, be sure to only rename the .bad to .idc.
Before: l1508521889832.idc_1506531432885.idc.1510146362333.bad

After: l1508521889832.idc_1506531432885.idc.1510146362333.idc

You can run the following command to rename all the files at once:

rename *.bad *.idc

Enforce should then begin to process the incident file.
Note: If you see incidents from some detection servers that are being stored normally, the cause is unrelated to a tablespace issue and the cause is likely due to a configuration issue on the affected detection servers.