Currently, I am testing the MAR and follow-through beblow article to try it out.
However, my MAR workspace cannot show anything including MAR client monitored, I have reviewed policy and setting over and over again but still cannot solve it, does anyone have this situation before?
You need to perform couple of steps to conclude the source of the problem.
Share the complete build of MAR and TIE.
Share the image of TIE & DXL topology page
Verify the DXL brokjer is enabled "provide Trace option for MAR " this you can see from DXL topology page for the every broker you have configured.
The very important among all, the sample file since it is showing unknown will not be listed in MAR workspace.
You need to create a sample, which contains or assuming some suspicious behavior to consider this need to push to MAR workspace.
Follow the KB92111, which contains the samples and to create multiple samples steps provided.
Additionally open DXL fabric page and click on each broker and click on Extensions tab & share the image.
If you have proxy for DXL broker to connect internet, update the proxy under the DXL databus page in server settings.