The "Automated Workload Quarantine on Security Event" workflow template is designed to enhance network security by automatically quarantining IPs that trigger error-severity events in Illumio. This workflow identifies and groups events by source IP, applying quarantine measures to those exceeding a set threshold. It creates IP blocklists, applies quarantine labels to affected workloads, and enforces deny-all security rules. All policy changes are provisioned in one operation, with a summary sent to a designated Slack channel, ensuring swift and efficient threat containment.
Use Cases
Remediate Network Security Alerts
Workflow Breakdown
Polls Illumio for error-severity security events on a scheduled interval
Groups events by source IP and filters for IPs exceeding the threshold
Creates IP blocklists and deny-all security rules for each flagged IP
Applies quarantine labels to any matching managed workloads
Provisions all policy changes in a single operation
Sends a Slack summary with blocked IPs, workloads affected, and policy version
Vendors
Slack, Utils