Skip to main content

​
Overview

The Illumio integration enables ThreatAware to collect data from your Illumio Policy Compute Engine (PCE), providing visibility into zero trust segmentation policies and network traffic patterns across your organisation.
Connection Method: API Setup Time: 20 minutes Access Required: Illumio Administrator account

​
Data collected

The Illumio integration provides:
  • Segmentation policy status
  • Workload and application inventory
  • Network traffic patterns
  • Policy compliance metrics
  • Security event and enforcement data

​
Use cases

Segmentation Monitoring

Track zero trust segmentation policies and enforcement across workloads

Policy Compliance

Monitor segmentation policy compliance and violations

Workload Inventory

Maintain comprehensive visibility into workload and application relationships

Security Analytics

Analyze network traffic patterns and policy enforcement

​
Setup instructions

1

Log in to Illumio Console

Access the Illumio PCE Console using an account with administrator privileges.
2

Navigate to API Key Settings

In the Illumio console:
  • Go to Settings > API Keys
  • This is where you’ll create credentials for ThreatAware
3

Create an API Key Pair

Click Create API Key Pair to generate new credentials for ThreatAware integration.
  • The system will generate an API Key and API Secret
  • Set the permissions to Read-only for monitoring purposes
  • Copy both the API Key and API Secret and store them securely
The API Secret will only be displayed once. Copy both values immediately and store them securely.
4

Note Your Illumio Console URL

Identify your Illumio PCE instance URL:
  • This is the base URL you use to access the console
  • Example: https://your-illumio-instance-url
  • You’ll need this for ThreatAware configuration
5

Enter Credentials in ThreatAware

In ThreatAware:
  • Navigate to Settings > Integrations
  • Search for and select Illumio
  • Enter the required credentials:
    • API Key: The key you copied from Illumio
    • API Secret: The secret you copied from Illumio
    • Illumio Console URL: Your Illumio PCE instance URL
6

Connect and Verify

Click Connect to establish the integration.Verify the connection status shows Active in ThreatAware.

​
Required credentials

Field Name: Illumio API Key Type: String Description: The API key generated for API access in Illumio
Store this credential securely in your organisation’s password manager.
Field Name: Illumio API Secret Type: Password (encrypted) Description: The secret associated with the API Key
The API Secret will only be displayed once during creation. Copy it immediately and store it securely.
Field Name: Illumio URL Type: String Description: The URL of your Illumio PCE instanceFormat: https://your-illumio-instance-url Example: https://pce.acme.com or https://illumio.company.net

​
Verification and testing

After setup, verify the integration is working correctly:
  1. Check Integration Status
    • Navigate to Settings > Integrations in ThreatAware
    • Confirm the Illumio integration shows Active status
  2. Verify Data Collection
    • Wait up to 1 hour for the initial data sync
    • Check that Illumio workload and policy data appears
    • Verify segmentation policies are visible in your dashboard
  3. Test Queries
    • Create a test query to filter by segmentation policy status
    • Verify workload data matches your Illumio environment
    • Test filtering by policy enforcement status

​
Troubleshooting

Symptoms: Connection fails with authentication errorSolutions:
  • Verify the API Key and API Secret are entered correctly
  • Ensure both values were copied completely without extra spaces
  • Confirm the API credentials have not expired
  • Generate a new API key pair if needed and update in ThreatAware
Symptoms: Integration fails to connect or times outSolutions:
  • Verify the Illumio Console URL is correct and accessible
  • Check firewall rules allow outbound HTTPS (443) to your Illumio instance
  • Test the URL in a browser to ensure it’s reachable
  • Verify your Illumio PCE is online and responding
Symptoms: Integration connects but returns permission errorsSolutions:
  • Verify the API credentials have read-only access permissions
  • Check that the API key permissions include access to:
    • Workloads
    • Policy rules
    • Traffic data
  • Review the Illumio API Documentation for required permissions
Symptoms: Integration shows active but no Illumio data appearsSolutions:
  • Verify there is workload and policy data in Illumio to collect
  • Check the API credentials have sufficient permissions
  • Wait up to 1 hour for the initial data sync
  • Review ThreatAware integration logs for errors
  • Verify your Illumio PCE has managed workloads

​
Additional resources

Illumio API Documentation

Official Illumio documentation for API configuration and permissions

ThreatAware Support

Contact ThreatAware support for integration assistance

​
Best practices

Credential Management
  • Create a dedicated API key pair specifically for ThreatAware
  • Store credentials securely in your organisation’s password manager
  • Rotate API credentials annually or per your security policy
  • Monitor for authentication failures in ThreatAware logs
Security Considerations
  • Only grant read-only permissions (never write access)
  • Limit API key scope to necessary workloads and policies
  • Review Illumio audit logs periodically to monitor API usage
  • Follow your organisation’s least privilege principles