> ## Documentation Index
> Fetch the complete documentation index at: https://docs.threataware.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Illumio

> Connect ThreatAware to Illumio PCE to monitor zero trust segmentation and policy compliance

## Overview

The Illumio integration enables ThreatAware to collect data from your Illumio Policy Compute Engine (PCE), providing visibility into zero trust segmentation policies and network traffic patterns across your organisation.

<Info>
  **Connection Method**: API
  **Setup Time**: 20 minutes
  **Access Required**: Illumio Administrator account
</Info>

## Data collected

The Illumio integration provides:

* Segmentation policy status
* Workload and application inventory
* Network traffic patterns
* Policy compliance metrics
* Security event and enforcement data

## Use cases

<CardGroup cols={2}>
  <Card title="Segmentation Monitoring" icon="shield-halved">
    Track zero trust segmentation policies and enforcement across workloads
  </Card>

  <Card title="Policy Compliance" icon="clipboard-check">
    Monitor segmentation policy compliance and violations
  </Card>

  <Card title="Workload Inventory" icon="server">
    Maintain comprehensive visibility into workload and application relationships
  </Card>

  <Card title="Security Analytics" icon="eye">
    Analyze network traffic patterns and policy enforcement
  </Card>
</CardGroup>

## Setup instructions

<Steps>
  <Step title="Log in to Illumio Console">
    Access the [Illumio PCE Console](https://your-illumio-instance-url) using an account with administrator privileges.
  </Step>

  <Step title="Navigate to API Key Settings">
    In the Illumio console:

    * Go to **Settings** > **API Keys**
    * This is where you'll create credentials for ThreatAware
  </Step>

  <Step title="Create an API Key Pair">
    Click **Create API Key Pair** to generate new credentials for ThreatAware integration.

    * The system will generate an **API Key** and **API Secret**
    * Set the permissions to **Read-only** for monitoring purposes
    * Copy both the **API Key** and **API Secret** and store them securely

    <Warning>
      The API Secret will only be displayed once. Copy both values immediately and store them securely.
    </Warning>
  </Step>

  <Step title="Note Your Illumio Console URL">
    Identify your Illumio PCE instance URL:

    * This is the base URL you use to access the console
    * Example: `https://your-illumio-instance-url`
    * You'll need this for ThreatAware configuration
  </Step>

  <Step title="Enter Credentials in ThreatAware">
    In ThreatAware:

    * Navigate to **Settings** > **Integrations**
    * Search for and select **Illumio**
    * Enter the required credentials:
      * **API Key**: The key you copied from Illumio
      * **API Secret**: The secret you copied from Illumio
      * **Illumio Console URL**: Your Illumio PCE instance URL
  </Step>

  <Step title="Connect and Verify">
    Click **Connect** to establish the integration.

    Verify the connection status shows **Active** in ThreatAware.
  </Step>
</Steps>

## Required credentials

<AccordionGroup>
  <Accordion title="API Key" icon="key">
    **Field Name**: Illumio API Key
    **Type**: String
    **Description**: The API key generated for API access in Illumio

    <Tip>
      Store this credential securely in your organisation's password manager.
    </Tip>
  </Accordion>

  <Accordion title="API Secret" icon="lock">
    **Field Name**: Illumio API Secret
    **Type**: Password (encrypted)
    **Description**: The secret associated with the API Key

    <Warning>
      The API Secret will only be displayed once during creation. Copy it immediately and store it securely.
    </Warning>
  </Accordion>

  <Accordion title="Illumio Console URL" icon="server">
    **Field Name**: Illumio URL
    **Type**: String
    **Description**: The URL of your Illumio PCE instance

    **Format**: `https://your-illumio-instance-url`
    **Example**: `https://pce.acme.com` or `https://illumio.company.net`
  </Accordion>
</AccordionGroup>

## Verification and testing

After setup, verify the integration is working correctly:

1. **Check Integration Status**
   * Navigate to **Settings** > **Integrations** in ThreatAware
   * Confirm the Illumio integration shows **Active** status

2. **Verify Data Collection**
   * Wait up to 1 hour for the initial data sync
   * Check that Illumio workload and policy data appears
   * Verify segmentation policies are visible in your dashboard

3. **Test Queries**
   * Create a test query to filter by segmentation policy status
   * Verify workload data matches your Illumio environment
   * Test filtering by policy enforcement status

## Troubleshooting

<AccordionGroup>
  <Accordion title="Invalid Credentials" icon="triangle-exclamation">
    **Symptoms**: Connection fails with authentication error

    **Solutions**:

    * Verify the **API Key** and **API Secret** are entered correctly
    * Ensure both values were copied completely without extra spaces
    * Confirm the API credentials have not expired
    * Generate a new API key pair if needed and update in ThreatAware
  </Accordion>

  <Accordion title="Connection Timeout" icon="clock">
    **Symptoms**: Integration fails to connect or times out

    **Solutions**:

    * Verify the **Illumio Console URL** is correct and accessible
    * Check firewall rules allow outbound HTTPS (443) to your Illumio instance
    * Test the URL in a browser to ensure it's reachable
    * Verify your Illumio PCE is online and responding
  </Accordion>

  <Accordion title="Permission Denied" icon="ban">
    **Symptoms**: Integration connects but returns permission errors

    **Solutions**:

    * Verify the API credentials have read-only access permissions
    * Check that the API key permissions include access to:
      * Workloads
      * Policy rules
      * Traffic data
    * Review the [Illumio API Documentation](https://docs.illumio.com) for required permissions
  </Accordion>

  <Accordion title="No Data Appearing" icon="database">
    **Symptoms**: Integration shows active but no Illumio data appears

    **Solutions**:

    * Verify there is workload and policy data in Illumio to collect
    * Check the API credentials have sufficient permissions
    * Wait up to 1 hour for the initial data sync
    * Review ThreatAware integration logs for errors
    * Verify your Illumio PCE has managed workloads
  </Accordion>
</AccordionGroup>

## Additional resources

<CardGroup cols={2}>
  <Card title="Illumio API Documentation" icon="book" href="https://docs.illumio.com">
    Official Illumio documentation for API configuration and permissions
  </Card>

  <Card title="ThreatAware Support" icon="life-ring" href="mailto:help@threataware.com">
    Contact ThreatAware support for integration assistance
  </Card>
</CardGroup>

## Best practices

<Tip>
  **Credential Management**

  * Create a dedicated API key pair specifically for ThreatAware
  * Store credentials securely in your organisation's password manager
  * Rotate API credentials annually or per your security policy
  * Monitor for authentication failures in ThreatAware logs
</Tip>

<Tip>
  **Security Considerations**

  * Only grant read-only permissions (never write access)
  * Limit API key scope to necessary workloads and policies
  * Review Illumio audit logs periodically to monitor API usage
  * Follow your organisation's least privilege principles
</Tip>