1 of 1 people found this helpful
The events are stored in SQL and that share holds only the evidence (Reaction rule has the option Store evidence checked). It's up to you to do a correct sizing depending on the rules you create and how specific are they.
For e-mail you`ll have both the body of the message and the attachment as two separate files in the event and they're stored in the evidence folder. If you uncheck the "Store evidence" you'll then have only the name of the file in the attachment that triggered the rule.