Re: MAR workspace is empty even there is event in TIE server
You need to perform couple of steps to conclude the source of the problem.
Share the complete build of MAR and TIE. Share the image of TIE & DXL topology page Verify the DXL brokjer is enabled "provide Trace option for MAR " this you can see from DXL topology page for the every broker you have configured.
The very important among all, the sample file since it is showing unknown will not be listed in MAR workspace.
You need to create a sample, which contains or assuming some suspicious behavior to consider this need to push to MAR workspace.
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.
Community Help Hub
New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.