cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

MAR workspace is empty even there is event in TIE server

Hi All,

Currently, I am testing the MAR and follow-through beblow article to try it out.

https://community.mcafee.com/t5/McAfee-Active-Response-MAR/Test-File-for-MAR-Threat-Workspace/td-p/5...

However, my MAR workspace cannot show anything including MAR client monitored, I have reviewed policy and setting over and over again but still cannot solve it, does anyone have this situation before?

 

3 Replies

Re: MAR workspace is empty even there is event in TIE server

More photos are attached.

rgc
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 3 of 4

Re: MAR workspace is empty even there is event in TIE server

Hello,

 

You need to perform couple of steps to conclude the source of the problem.

Share the complete build of MAR and TIE.
Share the image of TIE & DXL topology page
Verify the DXL brokjer is enabled "provide Trace option for MAR " this you can see from DXL topology page for the every broker you have configured.

The very important among all, the sample file since it is showing unknown will not be listed in MAR workspace.

 

You need to create a sample, which contains or assuming some suspicious behavior to consider this need to push to MAR workspace.

Follow the KB92111, which contains the samples and to create multiple samples steps provided. 
https://kc.mcafee.com/corporate/index?page=content&id=KB92111


Additionally open DXL fabric page and click on each broker and click on Extensions tab & share the image.

If you have proxy for DXL broker to connect internet, update the proxy under the DXL databus page in server settings.


 


Raghavendra GC
McAfee Technical Support – APAC
Customer Success Group
www.mcafee.com

Re: MAR workspace is empty even there is event in TIE server

Here are my MAR and TIE builds along with DXL setting.

Health status.PNG

dxl farbic.PNGdxl topology.PNGtie build.PNGproduct list.PNG

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community