Rapid ransomware containment - Illumio

Isolate one or more workloads based on traffic flows to a given port/protocol.

Illumio Rapid Ransomware Containment · 22 tasks · 4 inputs · 0 outputs

Inputs

  • Port — Provide Port to be blocked.
  • Protocol — Protocol of Port.
  • allow_traffic — Do you want to search for traffic on this port before the incident to allow? (Yes or No)
  • update_enforcement_mode — Do you want to update the enforcement mode?(Yes or No)

Commands used

illumio-enforcement-boundary-create illumio-ip-lists-get illumio-object-provision illumio-rule-create illumio-ruleset-create illumio-service-binding-create illumio-traffic-analysis illumio-virtual-service-create illumio-workloads-list

Flowchart

no no yes Yes yes Start Start Get traffic analysis - illumio-traffic-analysis Get traffic analysis illumio-traffic-analysis Create virtual service - illumio-virtual-service-create Create virtual service illumio-virtual-service-create Provision virtual service - illumio-object-provision Provision virtual service illumio-object-provision Create service binding - illumio-service-binding-create Create service binding illumio-service-binding-create Create ruleset - illumio-ruleset-create Create ruleset illumio-ruleset-create Create rule - illumio-rule-create Create rule illumio-rule-create Create enforcement boundary - illumio-enforcement-boundary-create Create enforcement boundary illumio-enforcement-boundary-... Provision enforcement boundary - illumio-object-provision Provision enforcement bou... illumio-object-provision Provision ruleset - illumio-object-provision Provision ruleset illumio-object-provision end end Is update enforcement mode? Is update enforcement mode? Get workloads - illumio-workloads-list Get workloads illumio-workloads-list Is traffic allowed? Is traffic allowed? Provide necessary inputs Provide necessary inputs Is Illumio Core integration enabled? Is Illumio Core integrati... Are workloads available? Are workloads available? Are workloads available? Are workloads available? Update enforcement mode - Illumio - Update enforcement mode - Illumio Update enforcement mode -... Update enforcement mode - Ill... Workload status - Print Workload status Print Print message for no workloads - Print Print message for no work... Print Get ip lists - illumio-ip-lists-get Get ip lists illumio-ip-lists-get