Client events are not generating at MAR workspace

[dilan90]

Hi All,

We have an issue regarding MAR server, Its not displaying any threats since the day we installed the MAR server. There are no any connection issues as you can see below

[GA]

Hi,

You can test your deployment with some info from this post.

https://community.mcafee.com/t5/McAfee-Active-Response-MAR/Test-File-for-MAR-Threat-Workspace/m-p/59...

[rgc]

Select the broker from DXL fabric page and at the right hand side click on Extensions tab and select CLoudBus & verify there is no timedout or connectivity failure message.

If there is no errors from DXL broker, which the MAR client system is able to Lookup, then we need to follow the workflow for the workspace.

Additionally, you need to get the sample files for UNKNOWN file to get reflected in MAR workspace.

[dilan90 · Accepted solution]

Hi Raghavendra,

The Issue was files that went in to Mcafee cloud bridge has been blocked by Radware (IPS Rules - SSL Inspection) So we were able to generated events on the MAR workspace by disabling the SSL inspection between MAR server and the Cloudbridge.  

Thanks all for ideas on this

Thanks