The Illumio App for Splunk integrates with the Illumio Policy Compute Engine (PCE) to provide security and operational insights into your Illumio secured data center. A dashboard view displays an overview of the security posture of the data center.
With improved visibility of east-west traffic, Security Operations Center (SOC) staff can detect unauthorized activity and potential attacks from traffic blocked by Illumio segmentation policy on workloads in "Enforcement" mode. Additionally, the Illumio App for Splunk provides visibility into potentially blocked traffic for workloads in "Test" mode. SOC staff can quickly pinpoint potential attacks and identify workloads with a significant number of blocked flows.
Supported Splunk versions
* 8.1.x
* 8.2.x
* 9.0.x
* 9.1.x
Supported versions of the Illumio Policy Compute Engine (PCE)
* 21.5.x
* 22.2.x
* 22.5.x
* 23.2.x
* Illumio SaaS PCE (latest)
Supported Splunk Common Information Model (CIM) versions
* 4.x
* 5.x
illumio modular input must be configured to pull necessary data from the Illumio PCEThe Illumio Splunk integration is distributed in two parts:
1) The TA-Illumio add-on, which collects and parses syslog events and static objects from the PCE
2) This IllumioAppForSplunk app, which visualizes data from the PCE in Splunk dashboards and provides the Illumio data model to improve search performance
The app can be installed in either a standalone or distributed Splunk environment.
Note: Recommendations for the configuration and topology of a distributed Splunk environment are outside the scope of this document. See the documentation on Splunk Validated Architectures for suggestions on topology for distributed deployments.
For a standalone deployment, install and configure the TA per the installation instructions on Splunkbase, and install the app as described in the Installation section below.
For a distributed environment, install the TA to a heavy forwarder, to an indexer/indexer cluster, or to a search head/search head cluster. Install the app to the search head/search head cluster.
illumio_quarantine_workload - this custom role must be assigned for a user to trigger the illumio_quarantine action. More details about this action can be found in the TA-Illumio documentationThe Illumio App for Splunk has two scheduled alert saved searches configured but disabled by default. The Illumio_Check_PCE_Collector_Data and Illumio_VEN_Inactivity_Timer_Alert alerts can be configured and updated as needed:
Alert Examples
The following searches show how Illumio event data can be used to configure custom alerts for common issues. See the Illumio documentation on event monitoring best practices for suggestions of events and PCE behaviour to monitor.
Workloads affected by policy change - monitor security policy changes for high numbers of workloads affected by a single change:
`illumio_get_index` sourcetype="illumio:pce" event_type="sec_policy.create" resource_changes{}.changes.workloads_affected.after > 50
The threshold of 50 in the search above can be adjusted based on the number of workloads and overall policy churn in the PCE.
Workload modified with specific label - monitor workload change operations for specific labels:
`illumio_get_index` sourcetype="illumio:pce" event_type="workload.*" (resource_changes{}.changes.labels.created{}.value="Quarantine" OR resource_changes{}.changes.labels.deleted{}.value="Quarantine")
One or more label values that represent high-value applications or zones, such as a Production environment or a customer database, can be monitored to send an alert whenever a workload with those labels is modified.
System warnings and errors - monitor system health events for warning or higher severity messages:
`illumio_get_index` sourcetype="illumio:pce:health" (sev="warn*" OR sev="err*" OR sev="fatal")
Set a relatively high threshold and send an alert if the number of system warnings and errors spikes on the PCE.
The Illumio App for Splunk provides the following saved searches:
| Search Name | Type | Schedule | Auto-summary Schedule | Auto-Summary Range | Description | Enabled by Default |
|---|---|---|---|---|---|---|
| Illumio_Auditable_Events | scheduled report | /15 * * * | 55 0 * * 0 | -1w -> now | used to summarize auditable events | yes |
| Illumio_PortScan_Traffic | scheduled report | /20 * * * | 55 1 * * 0 | -1w -> now | used to summarize possible instances of port scanning | yes |
| Illumio_PortScan | search | - | - | - | uses the illumio_port_scan_settings_lookup and the Illumio_PortScan_Traffic summary to identify instances of port scanning above the thresholds configured in Illumio modular inputs | yes |
| Illumio_Firewall_Tampering   | scheduled report | /15 * * * | 55 2 * * 0 | -1w -> now | used to summarize firewall tampering events | yes |
| Illumio_Check_PCE_Collector_Data | scheduled alert | /5 * * * | - | - | raised if no events from the PCE have been indexed in the dispatch time range | no |
| Illumio_VEN_Inactivity_Timer_Alert | scheduled alert | /5 * * * | - | - | raised if one or more VEN suspend events are reported by the PCE in the dispatch time range | no |
The Illumio App for Splunk provides an Illumio data model that can help to improve search performance at the cost of disk space by building a limited index of PCE syslog event fields.
The model provides the following objects:
| Name | Type | Parent | Base Search | Description |
|---|---|---|---|---|
| Audit | root event node | - | `illumio_get_index` sourcetype="illumio:pce" |
auditable syslog events |
| Traffic | root event node | - | `illumio_get_index` sourcetype="illumio:pce:collector" |
traffic flow events |
| Status | root event node | - | `illumio_get_index` sourcetype="illumio:pce:health" |
system health and status events |
| Status.Policy | child event node | Status | event_source="policy" |
policy service events |
| Status.Collector | child event node | Status | event_source="collector" |
collector service events |
| Status.FlowAnalytics | child event node | Status | event_source="flow_analytics" |
flow_analytics service events |
Note: Per Splunk app guidelines, model acceleration is disabled by default
Using the Data Model
Illumio data model nodes can be referenced using the tstats command. For example, the following search uses the Traffic node to sum flow counts from a given PCE over time by source/destination IP:
| tstats sum(Traffic.count) AS flows FROM datamodel=Illumio.Traffic WHERE Traffic.pce_fqdn="my.pce.com" BY _time, Traffic.src_ip, Traffic.dest_ip
Note: Enabling/disabling acceleration for the Illumio data model requires the
accelerate_datamodelcapabiility
To enable acceleration:
Note: If using a distributed search head cluster, see the Splunk documentation on sharing data model acceleration summaries to aviod rebuilding the summary on each search head in the cluster
Rebuilding the Data Model
To rebuild the summary for the data model:
illumio_quarantine role definition - it has been moved to TA-Illumio in v4.0.1New Features
resubmit_click_handler.js, has been added. It is used on the Change Monitoring and Traffic Explorer dashboards to automatically update searches when a token-set drilldown is clickedImprovements
Data model and Searches
illumio:pce, illumio:pce:collector, and illumio:pce:health sourcetypes. See the Data Model section above for further detailsIllumio_PortScan saved search has been split into a summary search (Illumio_PortScan_Traffic) and a filtering search (Illumio_PortScan). It now requires pce_fqdn and org_id values to be passed as parameters: | savedsearch Illumio_PortScan pce_fqdn="my.pce.com" org_id=1Dashboards
illumio_workloads_lookup to improve performance and simplify searchesQoL
illumio.xml has been renamed to security_operations.xml to better reflect the dashboard it representsFirewall Tempering has been corrected to Tampering in all locationsRemoved Features
illumio_get_time(1) - the searches on the Security Operations dashboard using this macro have been changedillumio_portscan_index - port scan data is no longer summarized to this indexillumio_system_health, illumio_rule_update, illumio_policy_provisioning, illumio_workload_labeling - these were set using the now-removed Alert Configurations pageIllumio_Workload_Mapping, Illumio_IP_Lists_Mapping, Illumio_Services_Mapping, Illumio_PortScan_Details, Illumio_Host_Details, Illumio_Host_Details_S3, and Illumio_hostname_ip_mapping are superseded by the updated PCE metadata KVStore collections in the Illumio TASee the EULA document on the Illumio Integrations docs site.
Copyright 2023 Illumio, Inc. All rights reserved.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
illumio_quarantine role definition - it has been moved to TA-Illumio v4.0.1resubmit_click_handler.js, has been added. It is used on the Change Monitoring and Traffic Explorer dashboards to automatically update searches when a token-set drilldown is clicked*For additional information on Improvements and Changes, refer to the README
Illumio App For Splunk v3.1.0
Added health metrics panels in PCE Operations dashboard
- VEN Heartbeat Latency
- VEN Policy Latency
- Collector Flow Rate
- Traffic Ingest Rate
- Policy Database Summary
- Disk Latency in Cluster Cores Section
Used Basesearch for panels in PCE operations dashboard to improve search performance
Splunk 8 Support
Made App Python23 compatible
Changed all queries to the data model for sourcetype illumio:pce
Added label filters on Workload Investigation
Added Allowed option on Security Operations
Added Alert Configuration screen to create/update alert filters
Added Alerts page to setup the configured alerts filters
Workload Investigation: Added drill down from panel Audit Events
Added support of S3 collected data
Fixed the bug with Quarantine workload from the drill-down of Firewall Tampering panel
Panels using Syslog data will now use pce_fqdn field instead of fqdn field
Auditable event count uses both system events and audit events
In the Workload Operations dashboard, modified default time range from 60 minutes to 72 hours
Added 'PCE' column in the drill-down of Firewall Tampering panel
Removed "Illumio_Host_PublicIP_Mapping" and "Illumio_PublicIP_Host_Mapping" saved searches as we are not using host field anymore inside "illumio_host_details_lookup"
Created new dashboard "Workload Investigation"
Created new panels "VEN Count", "VEN Event Count By Status", "Agent Event Count By EventType" and "Workload Event Count By EventType" in "Workload Operations" dashboard
Modified panels "Managed VEN by Version", "Managed VEN by Mode" and "Managed VEN by Operating System" in "Workload Operations" dashboard
Updated the logic of "Port Scan" panel and its drill-down
Fixed issue with quarantining destination workload in port scan panel
Removed "dnslookup" custom command
Documented steps of configuration for SUF
Certified Addon/App with Illumio v18.3.1 and v19.1
Added support of JSON data format for Illumio Cloud data
Added test script to check the connection with Illumio server
Updated the search time of single value panels to last 60 minutes with a trend line of 24 hours in Security Operations dashboard
Minor Bug Fixes in the panels "Top Workloads with" and "Managed VEN by Operating System"
Fixed the bug related to label filter not considering label type while searching for traffic data in Security Operations dashboard
Removed VEN Changes by Type panel from Workload Operations
Support for PCE 18.1 and PCE 18.2.
Create an alert that gets triggered if there is no data for more than 5 minutes
New Dashboard - Workload Operations
New Dashboard - PCE Operations
Enhancement in the existing Security Operations Dashboard.
App Cert Compliance Changes
App Branding related changes
Support for PCE V17.2
Minor Bug Fixes
The Illumio App for Splunk integrates with the Illumio Policy Compute Engine (PCE) to provide security and operational insights into your Illumio secured data center. A dashboard view displays an overview of the security posture of the data center.
Before installing this app, please install the Illumio Technology Add-On (TA) for Splunk available at https://splunkbase.splunk.com . The TA provides data inputs configuration and CIM mapping support.
As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.