Illumio Core

Illumio Core is a security platform that provides micro-segmentation to prevent unauthorized lateral movement within networks.

Use Cases the Adapter Solves

• Workload and VEN Asset Discovery: Automatically inventory all VEN-managed workloads, network devices, and container clusters in Illumio Core, maintaining a complete and up-to-date asset register across your segmented environment.
• Security Policy and Segmentation Validation: Correlate fetched rulesets and firewall policies with the rest of your asset inventory to verify that micro-segmentation policies are applied correctly and no unauthorized traffic flows are permitted.
• Application Setting Compliance Monitoring: Continuously monitor Illumio's application-level security settings—including password policy, SAML authentication configuration, and workload timeout thresholds—against benchmarks such as CIS and NIST.

Types of Assets Fetched

This adapter fetches the following types of assets:

• Devices, Users, Load Balancers, Containers, Network/Firewall Rules, Network Devices, Alerts/Incidents, Application Settings

Data Retrieved through the Adapter

Devices – cloud ID, cloud provider, enforcement mode, labels

Users – full name, username, account status (locked), last login

Containers – name, namespace

Alerts/Incidents – event type, severity, status, timestamp

Application Settings – authentication type, password policy settings, SAML configuration, firewall settings

Authentication Methods

The adapter authenticates using HTTP Basic Authentication. The Authentication User Name and API Secret are sent as credentials with each request, along with an Authorization: Token token={api_secret} header.

APIs

Axonius uses the Illumio Core 24.2.10 REST API. The following endpoints are called:

Devices

• GET api/v2/orgs/{org_id}/vens - Fetch VEN-managed devices
• GET api/v2/orgs/{org_id}/workloads - Fetch workloads
• GET api/v2/orgs/{org_id}/workloads/{workload_id} - Fetch individual workload details
• GET api/v2/orgs/{org_id}/vens/{ven_id}/compatibility_report - Fetch VEN compatibility reports

Labels and Rulesets

• GET api/v2/orgs/{org_id}/labels - Fetch labels
• GET api/v2/orgs/{org_id}/sec_policy/active/rule_sets - Fetch active rulesets (Network/Firewall Rules)

Additional Asset Types (optional)

• GET api/v2/users - Fetch users
• GET api/v2/orgs/{org_id}/events - Fetch events (Alerts/Incidents)
• GET api/v2/orgs/{org_id}/container_clusters - Fetch container clusters
• GET api/v2/orgs/{org_id}/container_clusters/{id}/container_workload_profiles - Fetch containers
• GET api/v2/orgs/{org_id}/sec_policy - Fetch security policy versions
• GET api/v2/orgs/{org_id}/sec_policy/{version}/firewall_settings - Fetch firewall policy settings
• GET api/v2/orgs/{org_id}/slbs - Fetch server load balancers
• GET api/v2/orgs/{org_id}/network_devices - Fetch network devices

Application Settings

• GET api/v2/authentication_settings - Fetch authentication settings
• GET api/v2/authentication_settings/password_policy - Fetch password policy
• GET api/v2/authentication_settings/saml_configs - Fetch SAML configurations
• GET api/v2/authentication_settings/saml_configs/{uuid} - Fetch individual SAML configuration
• GET api/v2/orgs/{org_id}/settings - Fetch organization settings
• GET api/v2/orgs/{org_id}/settings/events - Fetch event settings
• GET api/v2/orgs/{org_id}/settings/reports - Fetch report settings
• GET api/v2/orgs/{org_id}/settings/trusted_proxy_ips - Fetch trusted proxy IP settings
• GET api/v2/orgs/{org_id}/settings/workloads - Fetch workload settings
• GET api/v2/orgs/{org_id}/sec_policy/{pversion}/firewall_settings - Fetch firewall settings

Required Ports

Axonius must be able to communicate with the value supplied in Host Name or IP Address via the following ports:

• TCP port 8443

Required Permissions

The value supplied in Authentication User Name and API Secret must have at least read-only role.
That user can have also one of the following Roles: Organization owner, Administrator.

To generate Authentication User Name, API Secret and Organization ID:

1. Log into the Illumio PCE web console.

2. Click your name in the top right corner:

   

3. Click My API Keys in the drop-down list.

4. Click +Add in the window that appears:

   

5. Fill in the Name (mandatory) and Description (optional).

6. Click Save.

7. Click Show Credentials:

   

8. Copy and paste this information into a safe place. There is no way to
   retrieve it once you close this screen.

9. Optionally, you may choose to download the credentials into a file by
   clicking on Download Credentials. Keep this file in a very safe place.

Parameters

Required Parameters

1. Host Name or IP Address (required) - The hostname or IP address of the Illumio Core server that Axonius can communicate with via the Required Ports.

2. Port (required, default: 8443) - The port used to connect to the Illumio Core server.

3. Authentication User Name (required) - The credentials for a user account that has the Required Permissions to fetch assets. This is a randomized name generated when a user creates an API key.

4. API Secret (required) - An API Key associated with a user account that has the Required Permissions to fetch assets.

5. Organization ID (required) - Auto generated when the API Secret is created.

6. Verify SSL (required) - Select whether to verify the SSL certificate of the server against the CA database inside of Axonius. For more details, see SSL Trust & CA Settings.

Optional Parameters

7. HTTPS Proxy (optional) - Connect the adapter to a proxy instead of directly connecting it to the domain.

8. HTTPS Proxy User Name (optional) - The user name to use when connecting to the value supplied in Host Name or IP Address via the value supplied in HTTPS Proxy.

9. HTTPS Proxy Password (optional) - The password to use when connecting to the server using the HTTPS Proxy.

To learn more about common adapter connection parameters and buttons, see Adding a New Adapter Connection.

Advanced Settings

1. Fetch workloads (default: true) - Clear this option to stop fetching devices of the type "Workload"
2. Additional Assets to Fetch - From the dropdown, select one or more additional asset types to fetch.
3. Max Retries for Async API (default: 10) - Set the maximum times to check for task completion before timing out.
4. Default Wait Time Between Retries (seconds) (default 5) - Set how long to wait in seconds between checks when the adapter is waiting for a task to complete. If the server doesn't specify a wait time, this default will be used.
5. Fetch Compatibility Reports for Idle Workloads - Select this option to fetch compatibility report data.

Related Enforcement Actions

• Illumio - Create Workload
• Illumio - Delete Workload
• Illumio - Unpair VEN from Workload
• Illumio Update Workload