Anti-ransomware alerts missing

[stiff olive]

Recently activated ARP in our ONTAP (9.12) clusters and noticed we only see ARP events on the clusters themselves.
What could be the reason for them not showing in AIQUM (9.13) ?

ARP snapshots has been created, pretty sure it's false positives, because of suspicious file extension if that makes any difference.

[floral thorn]

I'd recommend opening up a support case. We will need the timestamp for the cluster events so we can match them up with the Unified Manager logs and recording files.

[stiff olive]

Ok thanks!