category: Network Security provider: Illumio commonfields: id: IllumioCore version: -1 configuration: - additionalinfo: The URL this integration should connect to. display: Server URL name: url required: true type: 0 - additionalinfo: The port number to establish the connection. defaultvalue: '443' display: Port name: port required: true type: 0 - additionalinfo: The API user for authentication. display: API Key Username name: api_user required: true type: 4 - additionalinfo: The API Key required to authenticate to the service. display: API Secret name: api_key required: true type: 4 - additionalinfo: The organization ID to use when calling org-dependent APIs. defaultvalue: '1' display: Organization ID name: org_id required: true type: 0 - additionalinfo: Indicates whether to allow connections without verifying SSL certificate's validity. display: Trust any certificate (not secure) name: insecure type: 8 required: false - additionalinfo: Indicates whether to use XSOAR's system proxy settings to connect to the API. display: Use system proxy settings name: proxy type: 8 required: false description: Connects to Illumio Core APIs to perform investigative and restorative actions. display: Illumio Core name: IllumioCore script: commands: - arguments: - description: Port number. name: port required: true - auto: PREDEFINED defaultValue: tcp description: |- Communication protocol. Supported values are: 'tcp' and 'udp'. name: protocol predefined: - tcp - udp - defaultValue: 1 week ago description: |- Start of analysis range. Supported formats: N minutes, N hours, N days, N weeks, N months, N years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ For example: 01 Mar 2021, 01 Feb 2021 04:45:33, 2022-04-17T14:05:44Z. name: start_time - defaultValue: now description: |- End of analysis range. Supported formats: N minutes, N hours, N days, N weeks, N months, N years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ For example: 01 Mar 2021, 01 Feb 2021 04:45:33, 2022-04-17T14:05:44Z. name: end_time - defaultValue: potentially_blocked, unknown description: |- List of policy decisions to include in the search results. Supports comma-separated values. Supported values are: 'potentially_blocked', 'blocked', 'unknown', and 'allowed'. isArray: true name: policy_decisions description: Retrieves traffic flow of a particular port & protocol within the specified time range based on policy decisions. name: illumio-traffic-analysis outputs: - contextPath: Illumio.TrafficFlows.src.ip description: IP of the source. type: String - contextPath: Illumio.TrafficFlows.dst.ip description: Destination IP address. type: String - contextPath: Illumio.TrafficFlows.dst.workload.hostname description: Destination workload hostname. type: String - contextPath: Illumio.TrafficFlows.dst.workload.name description: Destination workload name. type: String - contextPath: Illumio.TrafficFlows.dst.workload.href description: Destination workload URI. type: String - contextPath: Illumio.TrafficFlows.dst.workload.os_type description: Destination workload OS type. type: String - contextPath: Illumio.TrafficFlows.dst.workload.labels.href description: Destination label URI. type: String - contextPath: Illumio.TrafficFlows.dst.workload.labels.key description: Destination workload label key. type: String - contextPath: Illumio.TrafficFlows.dst.workload.labels.value description: Destination workload label value. type: String - contextPath: Illumio.TrafficFlows.service.port description: Port of the traffic. type: Number - contextPath: Illumio.TrafficFlows.service.proto description: Protocol number of the traffic. type: Number - contextPath: Illumio.TrafficFlows.num_connections description: Number of traffic flows reported in connections. type: Number - contextPath: Illumio.TrafficFlows.policy_decisions description: Indicates the policy decision for the flow. Indicates if the traffic flow is allowed, potentially blocked (but allowed), or blocked. type: String - contextPath: Illumio.TrafficFlows.state description: State of the flow. type: String - contextPath: Illumio.TrafficFlows.flow_direction description: Flow direction of the traffic. type: String - contextPath: Illumio.TrafficFlows.dst_bi description: Bytes received till now by the destination over the flow during the interval. type: Number - contextPath: Illumio.TrafficFlows.dst_bo description: Bytes sent till now by the destination over the flow during the interval. type: Number - contextPath: Illumio.TrafficFlows.timestamp_range.last_detected description: Time range when traffic was last detected. type: Date - contextPath: Illumio.TrafficFlows.timestamp_range.first_detected description: Time range when traffic was first detected. type: Date - arguments: - description: Virtual service name. name: name required: true - description: Port number. name: port required: true - auto: PREDEFINED defaultValue: TCP description: Communication protocol. name: protocol predefined: - TCP - UDP description: Creates a virtual service for a particular port & protocol, which can be further binded to workloads. Until provisioned with the 'illumio-object-provision' command, this object will remain in a draft state. name: illumio-virtual-service-create outputs: - contextPath: Illumio.VirtualService.href description: Label URI. type: String - contextPath: Illumio.VirtualService.created_at description: Virtual service creation time. type: Date - contextPath: Illumio.VirtualService.updated_at description: Virtual service updated time. type: Date - contextPath: Illumio.VirtualService.deleted_at description: Virtual service deleted time. type: Date - contextPath: Illumio.VirtualService.created_by.href description: URI of the user who has created the virtual service. type: String - contextPath: Illumio.VirtualService.updated_by.href description: URI of the user who has updated the virtual service. type: String - contextPath: Illumio.VirtualService.deleted_by.href description: URI of the user who has deleted the virtual service. type: String - contextPath: Illumio.VirtualService.update_type description: What type of modification has been done on the virtual service. type: String - contextPath: Illumio.VirtualService.name description: Name of the virtual service. type: String - contextPath: Illumio.VirtualService.description description: Description of the virtual service. type: String - contextPath: Illumio.VirtualService.pce_fqdn description: PCE FQDN to assign to the virtual service. type: String - contextPath: Illumio.VirtualService.service_ports.port description: Port of the virtual service. type: Number - contextPath: Illumio.VirtualService.service_ports.proto description: Proto of the virtual service. type: Number - contextPath: Illumio.VirtualService.labels description: Labels of the virtual service. type: Unknown - contextPath: Illumio.VirtualService.ip_overrides description: Array of IPs or CIDRs as IP overrides. type: Unknown - contextPath: Illumio.VirtualService.apply_to description: 'Firewall rule target for workloads bound to this virtual service: host_only or internal_bridge_network.' type: String - contextPath: Illumio.VirtualService.caps description: Array of permissions for the entity for the current user - an empty array implies read only access. type: Unknown - contextPath: Illumio.VirtualService.service_addresses description: Service addresses of the virtual service. type: Unknown - arguments: - description: |- Workload HREFs to bind. Supports comma-separated values. Note: Users can retrieve the list of Href's by executing the "illumio-workloads-list" or the "illumio-traffic-analysis" command. isArray: true name: workloads required: true - description: Virtual service HREF to bind the workloads to. name: virtual_service required: true description: Binds the existing or a new virtual service to the workloads. name: illumio-service-binding-create outputs: - contextPath: Illumio.ServiceBinding.status description: Indicates the status of a request. type: String - contextPath: Illumio.ServiceBinding.href description: Label URI. type: String - arguments: - description: List of security policy object HREFs to provision. Supports comma-separated values. isArray: true name: security_policy_objects required: true description: A utility method for provisioning policy objects from draft to active state. Policy objects only affect the network once they've been provisioned. name: illumio-object-provision outputs: - contextPath: Illumio.PolicyState.href description: Object label URI. type: String - contextPath: Illumio.PolicyState.commit_message description: Message for the provisioning. type: String - contextPath: Illumio.PolicyState.version description: Version of the object. type: Number - contextPath: Illumio.PolicyState.workloads_affected description: Number of workloads affected. type: Number - contextPath: Illumio.PolicyState.created_by.href description: Created by label URI. type: String - contextPath: Illumio.PolicyState.object_counts.rule_sets description: Count of rulesets. type: Number - contextPath: Illumio.PolicyState.object_counts.services description: Count of services. type: Number - contextPath: Illumio.PolicyState.object_counts.ip_lists description: Count of IP lists. type: Number - contextPath: Illumio.PolicyState.object_counts.firewall_settings description: Count of firewall settings. type: Number - contextPath: Illumio.PolicyState.object_counts.label_groups description: Count of label groups. type: Number - contextPath: Illumio.PolicyState.object_counts.secure_connect_gateways description: Count of secure connection gateways. type: Number - contextPath: Illumio.PolicyState.object_counts.virtual_servers description: Count of virtual servers. type: Number - contextPath: Illumio.PolicyState.object_counts.enforcement_boudaries description: Count of enforcement boundaries. type: Number - contextPath: Illumio.PolicyState.object_counts.virtual_services description: Count of virtual services. type: Number - contextPath: Illumio.PolicyState.provisioned_hrefs description: List of active hrefs after provisioning. type: Unknown - arguments: - description: |- Workload HREF. Note: Users can retrieve the list of Href's by executing the "illumio-workloads-list" command. name: href required: true description: Retrieves the details of the workload based on the provided workload's HREF. name: illumio-workload-get outputs: - contextPath: Illumio.Workloads.href description: URI of workload. type: String - contextPath: Illumio.Workloads.deleted description: Whether this workload has been deleted or not. type: Boolean - contextPath: Illumio.Workloads.delete_type description: Workload deletion type. type: String - contextPath: Illumio.Workloads.name description: Interface name. type: String - contextPath: Illumio.Workloads.description description: The description of this workload. type: String - contextPath: Illumio.Workloads.managed description: True if the workload is managed, else false. type: Boolean - contextPath: Illumio.Workloads.hostname description: The hostname of this workload. type: String - contextPath: Illumio.Workloads.service_principal_name description: The Kerberos Service Principal Name (SPN). type: String - contextPath: Illumio.Workloads.agent_to_pce_certificate_authentication_id description: PKI Certificate identifier to be used by the PCE for authenticating the VEN. type: String - contextPath: Illumio.Workloads.distinguished_name description: X.509 Subject distinguished name. type: String - contextPath: Illumio.Workloads.public_ip description: The public IP address of the server. type: String - contextPath: Illumio.Workloads.external_data_set description: External data set identifier. type: String - contextPath: Illumio.Workloads.external_data_reference description: External data reference identifier. type: String - contextPath: Illumio.Workloads.interfaces.name description: Interface name. type: String - contextPath: Illumio.Workloads.interfaces.link_state description: Link state. type: String - contextPath: Illumio.Workloads.interfaces.address description: The IP address to assign to this interface. type: String - contextPath: Illumio.Workloads.interfaces.cidr_block description: The number of bits in the subnet /24 is 255.255.255.0. type: Number - contextPath: Illumio.Workloads.interfaces.default_gateway_address description: The IP address of the default gateway. type: String - contextPath: Illumio.Workloads.interfaces.network.href description: URI of the network. type: String - contextPath: Illumio.Workloads.interfaces.network_detection_mode description: Network detection mode. type: String - contextPath: Illumio.Workloads.interfaces.friendly_name description: User-friendly name for interface. type: String - contextPath: Illumio.Workloads.service_provider description: Service provider. type: String - contextPath: Illumio.Workloads.data_center description: Data center. type: String - contextPath: Illumio.Workloads.data_center_zone description: Data center zone. type: String - contextPath: Illumio.Workloads.os_id description: Our OS identifier. type: String - contextPath: Illumio.Workloads.os_detail description: Additional OS details - just displayed to the end user. type: String - contextPath: Illumio.Workloads.online description: If this workload is online. type: Boolean - contextPath: Illumio.Workloads.firewall_coexistence.illumio_primary description: Illumio is the primary firewall if set to true. type: Boolean - contextPath: Illumio.Workloads.containers_inherit_host_policy description: This workload will apply the policy it receives both to itself and the containers hosted by it. type: Boolean - contextPath: Illumio.Workloads.blocked_connection_action description: Firewall action for blocked connections. type: String - contextPath: Illumio.Workloads.labels.href description: URI of this label. type: String - contextPath: Illumio.Workloads.labels.deleted description: Assigned labels. type: Boolean - contextPath: Illumio.Workloads.labels.key description: Key in key-value pair. type: String - contextPath: Illumio.Workloads.labels.value description: Value in key-value pair. type: String - contextPath: Illumio.Workloads.labels.external_data_set description: External data set identifier. type: String - contextPath: Illumio.Workloads.labels.external_data_reference description: External data reference identifier. type: String - contextPath: Illumio.Workloads.labels.created_at description: Timestamp when this label was first created. type: Date - contextPath: Illumio.Workloads.labels.updated_at description: Timestamp when this label was last updated. type: Date - contextPath: Illumio.Workloads.labels.created_by.href description: User who has originally created this label. type: String - contextPath: Illumio.Workloads.labels.updated_by.href description: User who has last updated this label. type: String - contextPath: Illumio.Workloads.services.uptime_seconds description: How long since the last reboot of this box - used as a timestamp for this. type: Number - contextPath: Illumio.Workloads.services.created_at description: Timestamp when this service was first created. type: Date - contextPath: Illumio.Workloads.services.open_service_ports.protocol description: Transport protocol. type: Number - contextPath: Illumio.Workloads.services.open_service_ports.address description: The local address this service is bound to. type: String - contextPath: Illumio.Workloads.services.open_service_ports.port description: The local port this service is bound to. type: Number - contextPath: Illumio.Workloads.services.open_service_ports.process_name description: The process name (including the full path). type: String - contextPath: Illumio.Workloads.services.open_service_ports.user description: The user account that the process is running under. type: String - contextPath: Illumio.Workloads.services.open_service_ports.package description: The RPM/DEB package that the program is part of. type: String - contextPath: Illumio.Workloads.services.open_service_ports.win_service_name description: Name of the windows service. type: String - contextPath: Illumio.Workloads.vulnerabilities_summary.num_vulnerabilities description: Number of vulnerabilities associated with the workload. type: Number - contextPath: Illumio.Workloads.vulnerabilities_summary.vulnerable_port_exposure description: The aggregated vulnerability port exposure score of the workload across all the vulnerable ports. type: Number - contextPath: Illumio.Workloads.vulnerabilities_summary.vulnerable_port_wide_exposure.any description: The boolean value represents if at least one port is exposed to the internet (any rule) on the workload. type: Boolean - contextPath: Illumio.Workloads.vulnerabilities_summary.vulnerable_port_wide_exposure.ip_list description: The boolean value represents if at least one port is exposed to ip_list(s) on the workload. type: Boolean - contextPath: Illumio.Workloads.vulnerabilities_summary.vulnerability_exposure_score description: The aggregated vulnerability exposure score of the workload across all the vulnerable ports. type: Number - contextPath: Illumio.Workloads.vulnerabilities_summary.vulnerability_score description: The aggregated vulnerability score of the workload across all the vulnerable ports. type: Number - contextPath: Illumio.Workloads.vulnerabilities_summary.max_vulnerability_score description: The maximum of all the vulnerability scores associated with the detected_vulnerabilities on the workload. type: Number - contextPath: Illumio.Workloads.detected_vulnerabilities.ip_address description: The IP address of the host where the vulnerability is found. type: String - contextPath: Illumio.Workloads.detected_vulnerabilities.port description: The port which is associated with the vulnerability. type: Number - contextPath: Illumio.Workloads.detected_vulnerabilities.proto description: The protocol which is associated with the vulnerability. type: Number - contextPath: Illumio.Workloads.detected_vulnerabilities.port_exposure description: The exposure of the port based on the current policy. type: Number - contextPath: Illumio.Workloads.detected_vulnerabilities.port_wide_exposure.any description: The boolean value represents if the port is exposed to the internet (any rule). type: Boolean - contextPath: Illumio.Workloads.detected_vulnerabilities.port_wide_exposure.ip_list description: The boolean value represents if the port is exposed to ip_list(s). type: Boolean - contextPath: Illumio.Workloads.detected_vulnerabilities.workload.href description: The URI of the workload to which this vulnerability belongs to. type: String - contextPath: Illumio.Workloads.detected_vulnerabilities.vulnerability.href description: The URI of the vulnerability class to which this vulnerability belongs to. type: String - contextPath: Illumio.Workloads.detected_vulnerabilities.vulnerability.score description: The normalized score of the vulnerability within the range of 0 to 100. type: Number - contextPath: Illumio.Workloads.detected_vulnerabilities.vulnerability.name description: The title/name of the vulnerability. type: String - contextPath: Illumio.Workloads.detected_vulnerabilities.vulnerability_report.href description: The URI of the report to which this vulnerability belongs to. type: String - contextPath: Illumio.Workloads.agent.config.mode description: DEPRECATED AND REPLACED (Use workload enforcement_mode instead). type: String - contextPath: Illumio.Workloads.agent.config.log_traffic description: True if we want to log traffic events from this workload. type: Boolean - contextPath: Illumio.Workloads.agent.config.security_policy_update_mode description: Defines the current policy update mode, which can be either adaptive or static based on static policy scopes. type: String - contextPath: Illumio.Workloads.agent.href description: HREF of the service agent. type: String - contextPath: Illumio.Workloads.agent.secure_connect.matching_issuer_name description: Issuer name match criteria for certificate used during establishing secure connections. type: String - contextPath: Illumio.Workloads.agent.status.uid description: The unique ID reported by the server. type: String - contextPath: Illumio.Workloads.agent.status.last_heartbeat_on description: The last time (rfc3339 timestamp) a heartbeat was received from this workload. type: Date - contextPath: Illumio.Workloads.agent.status.uptime_seconds description: How long since the last reboot of this server. Recorded in DB at the time of the last heartbeat. type: Number - contextPath: Illumio.Workloads.agent.status.agent_version description: Agent software version string. type: String - contextPath: Illumio.Workloads.agent.status.managed_since description: The time (rfc3339 timestamp) at which this workload became managed by a VEN. type: Date - contextPath: Illumio.Workloads.agent.status.fw_config_current description: If this workload's firewall config is up to string'. type: Boolean - contextPath: Illumio.Workloads.agent.status.firewall_rule_count description: 'DEPRECATED WITH NO REPLACEMENT: Number of firewall rules currently installed.' type: Number - contextPath: Illumio.Workloads.agent.status.security_policy_refresh_at description: DEPRECATED AND REPLACED (USE security_policy_applied_at and security_policy_received_at INSTEAD). type: Date - contextPath: Illumio.Workloads.agent.status.security_policy_applied_at description: Last reported time when policy was applied (UTC). type: Date - contextPath: Illumio.Workloads.agent.status.security_policy_received_at description: Last reported time when policy was received (UTC). type: Date - contextPath: Illumio.Workloads.agent.status.agent_health_errors.errors description: Errors associated with the security policy. type: Unknown - contextPath: Illumio.Workloads.agent.status.agent_health_errors.warnings description: Warnings associated with the security policy. type: Unknown - contextPath: Illumio.Workloads.agent.status.agent_health.type description: This field describes the error or the warning type. type: String - contextPath: Illumio.Workloads.agent.status.agent_health.severity description: Severity of the error type. type: String - contextPath: Illumio.Workloads.agent.status.agent_health.audit_event description: The URI of the audit event that was generated for the corresponding error or warning. type: String - contextPath: Illumio.Workloads.agent.status.security_policy_sync_state description: Current state of security policy. type: String - contextPath: Illumio.Workloads.agent.active_pce_fqdn description: The FQDN of the PCE that received the agent's last heartbeat. type: String - contextPath: Illumio.Workloads.agent.target_pce_fqdn description: The FQDN of the PCE the agent will use for future connections. type: String - contextPath: Illumio.Workloads.agent.type description: Agent type. type: String - contextPath: Illumio.Workloads.ven.href description: The URI of the VEN that manages this workload. This replaces the 'agent' field of this object. type: String - contextPath: Illumio.Workloads.ven.hostname description: The hostname of the host managed by the VEN, only displayed in expanded representations. type: String - contextPath: Illumio.Workloads.ven.name description: The friendly name of the VEN, only displayed in expanded representations. type: String - contextPath: Illumio.Workloads.ven.status description: Status of the VEN, only displayed in expanded representations. type: String - contextPath: Illumio.Workloads.enforcement_mode description: Workload's enforcement mode. type: String - contextPath: Illumio.Workloads.selectively_enforced_services.href description: Workload's selective enforcement mode. type: String - contextPath: Illumio.Workloads.created_at description: The time (rfc3339 timestamp) at which this workload was created. type: Date - contextPath: Illumio.Workloads.updated_at description: The time (rfc3339 timestamp) at which this workload was last updated. type: Date - contextPath: Illumio.Workloads.deleted_at description: The time (rfc3339 timestamp) at which this workload was deleted. type: Date - contextPath: Illumio.Workloads.created_by.href description: The URI of the user who has created this workload. type: String - contextPath: Illumio.Workloads.updated_by.href description: The URI of the user who has last updated this workload. type: String - contextPath: Illumio.Workloads.deleted_by.href description: The URI of the user who has deleted this workload. type: String - contextPath: Illumio.Workloads.container_cluster.href description: Container cluster URI. type: String - contextPath: Illumio.Workloads.container_cluster.name description: Container cluster name. type: String - contextPath: Illumio.Workloads.ike_authentication_certificate description: IKE authentication certificate for certificate-based Secure Connect and Machine Auth connections. type: String - arguments: - defaultValue: '500' description: |- Maximum number of workloads to return in the result set. The value must be positive integer. High value will result in performance issue. Note: 2500 is the optimum value. name: max_results - description: Workload name. name: name - description: Workload hostname. name: hostname - description: Workload IP address. Supports partial matches. name: ip_address - auto: PREDEFINED description: True to return online workloads, false to return offline workloads. Leave empty to return both. name: online predefined: - 'true' - 'false' - auto: PREDEFINED description: True to return managed workloads, false to return unmanaged workloads. Leave empty to return both. name: managed predefined: - 'true' - 'false' - description: Workload labels. isArray: true name: labels - auto: PREDEFINED description: Workload enforcement mode. name: enforcement_mode predefined: - visibility_only - full - idle - selective - auto: PREDEFINED description: Workload visibility level. name: visibility_level predefined: - flow_full_detail - flow_summary - flow_drops - flow_off - enhanced_data_collection description: Retrieves the list of workloads based on the provided filters. name: illumio-workloads-list outputs: - contextPath: Illumio.Workloads.href description: URI of workload. type: String - contextPath: Illumio.Workloads.deleted description: Whether this workload has been deleted or not. type: Boolean - contextPath: Illumio.Workloads.delete_type description: Workload deletion type. type: String - contextPath: Illumio.Workloads.name description: Interface name. type: String - contextPath: Illumio.Workloads.description description: The description of this workload. type: String - contextPath: Illumio.Workloads.managed description: True if the workload is managed, else false. type: Boolean - contextPath: Illumio.Workloads.hostname description: The hostname of this workload. type: String - contextPath: Illumio.Workloads.service_principal_name description: The Kerberos Service Principal Name (SPN). type: String - contextPath: Illumio.Workloads.agent_to_pce_certificate_authentication_id description: PKI Certificate identifier to be used by the PCE for authenticating the VEN. type: String - contextPath: Illumio.Workloads.distinguished_name description: X.509 Subject distinguished name. type: String - contextPath: Illumio.Workloads.public_ip description: The public IP address of the server. type: String - contextPath: Illumio.Workloads.external_data_set description: External data set identifier. type: String - contextPath: Illumio.Workloads.external_data_reference description: External data reference identifier. type: String - contextPath: Illumio.Workloads.interfaces.name description: Interface name. type: String - contextPath: Illumio.Workloads.interfaces.link_state description: Link state. type: String - contextPath: Illumio.Workloads.interfaces.address description: The IP address to assign to this interface. type: String - contextPath: Illumio.Workloads.interfaces.cidr_block description: The number of bits in the subnet /24 is 255.255.255.0. type: Number - contextPath: Illumio.Workloads.interfaces.default_gateway_address description: The IP address of the default gateway. type: String - contextPath: Illumio.Workloads.interfaces.network.href description: URI of the network. type: String - contextPath: Illumio.Workloads.interfaces.network_detection_mode description: Network detection mode. type: String - contextPath: Illumio.Workloads.interfaces.friendly_name description: User-friendly name for interface. type: String - contextPath: Illumio.Workloads.service_provider description: Service provider. type: String - contextPath: Illumio.Workloads.data_center description: Data center. type: String - contextPath: Illumio.Workloads.data_center_zone description: Data center zone. type: String - contextPath: Illumio.Workloads.os_id description: Our OS identifier. type: String - contextPath: Illumio.Workloads.os_detail description: Additional OS details - just displayed to the end user. type: String - contextPath: Illumio.Workloads.online description: If this workload is online. type: Boolean - contextPath: Illumio.Workloads.firewall_coexistence.illumio_primary description: Illumio is the primary firewall if set to true. type: Boolean - contextPath: Illumio.Workloads.containers_inherit_host_policy description: This workload will apply the policy it receives both to itself and the containers hosted by it. type: Boolean - contextPath: Illumio.Workloads.blocked_connection_action description: Firewall action for blocked connections. type: String - contextPath: Illumio.Workloads.labels.href description: URI of this label. type: String - contextPath: Illumio.Workloads.labels.deleted description: Assigned labels. type: Boolean - contextPath: Illumio.Workloads.labels.key description: Key in key-value pair. type: String - contextPath: Illumio.Workloads.labels.value description: Value in key-value pair. type: String - contextPath: Illumio.Workloads.labels.external_data_set description: External data set identifier. type: String - contextPath: Illumio.Workloads.labels.external_data_reference description: External data reference identifier. type: String - contextPath: Illumio.Workloads.labels.created_at description: Timestamp when this label was first created. type: Date - contextPath: Illumio.Workloads.labels.updated_at description: Timestamp when this label was last updated. type: Date - contextPath: Illumio.Workloads.labels.created_by.href description: User who has originally created this label. type: String - contextPath: Illumio.Workloads.labels.updated_by.href description: User who has last updated this label. type: String - contextPath: Illumio.Workloads.services.uptime_seconds description: How long since the last reboot of this box - used as a timestamp for this. type: Number - contextPath: Illumio.Workloads.services.created_at description: Timestamp when this service was first created. type: Date - contextPath: Illumio.Workloads.services.open_service_ports.protocol description: Transport protocol. type: Number - contextPath: Illumio.Workloads.services.open_service_ports.address description: The local address this service is bound to. type: String - contextPath: Illumio.Workloads.services.open_service_ports.port description: The local port this service is bound to. type: Number - contextPath: Illumio.Workloads.services.open_service_ports.process_name description: The process name (including the full path). type: String - contextPath: Illumio.Workloads.services.open_service_ports.user description: The user account that the process is running under. type: String - contextPath: Illumio.Workloads.services.open_service_ports.package description: The RPM/DEB package that the program is part of. type: String - contextPath: Illumio.Workloads.services.open_service_ports.win_service_name description: Name of the windows service. type: String - contextPath: Illumio.Workloads.vulnerabilities_summary.num_vulnerabilities description: Number of vulnerabilities associated with the workload. type: Number - contextPath: Illumio.Workloads.vulnerabilities_summary.vulnerable_port_exposure description: The aggregated vulnerability port exposure score of the workload across all the vulnerable ports. type: Number - contextPath: Illumio.Workloads.vulnerabilities_summary.vulnerable_port_wide_exposure.any description: The boolean value represents if at least one port is exposed to the internet (any rule) on the workload. type: Boolean - contextPath: Illumio.Workloads.vulnerabilities_summary.vulnerable_port_wide_exposure.ip_list description: The boolean value represents if at least one port is exposed to ip_list(s) on the workload. type: Boolean - contextPath: Illumio.Workloads.vulnerabilities_summary.vulnerability_exposure_score description: The aggregated vulnerability exposure score of the workload across all the vulnerable ports. type: Number - contextPath: Illumio.Workloads.vulnerabilities_summary.vulnerability_score description: The aggregated vulnerability score of the workload across all the vulnerable ports. type: Number - contextPath: Illumio.Workloads.vulnerabilities_summary.max_vulnerability_score description: The maximum of all the vulnerability scores associated with the detected_vulnerabilities on the workload. type: Number - contextPath: Illumio.Workloads.detected_vulnerabilities.ip_address description: The IP address of the host where the vulnerability is found. type: String - contextPath: Illumio.Workloads.detected_vulnerabilities.port description: The port which is associated with the vulnerability. type: Number - contextPath: Illumio.Workloads.detected_vulnerabilities.proto description: The protocol which is associated with the vulnerability. type: Number - contextPath: Illumio.Workloads.detected_vulnerabilities.port_exposure description: The exposure of the port based on the current policy. type: Number - contextPath: Illumio.Workloads.detected_vulnerabilities.port_wide_exposure.any description: The boolean value represents if the port is exposed to the internet (any rule). type: Boolean - contextPath: Illumio.Workloads.detected_vulnerabilities.port_wide_exposure.ip_list description: The boolean value represents if the port is exposed to ip_list(s). type: Boolean - contextPath: Illumio.Workloads.detected_vulnerabilities.workload.href description: The URI of the workload to which this vulnerability belongs to. type: String - contextPath: Illumio.Workloads.detected_vulnerabilities.vulnerability.href description: The URI of the vulnerability class to which this vulnerability belongs to. type: String - contextPath: Illumio.Workloads.detected_vulnerabilities.vulnerability.score description: The normalized score of the vulnerability within the range of 0 to 100. type: Number - contextPath: Illumio.Workloads.detected_vulnerabilities.vulnerability.name description: The title/name of the vulnerability. type: String - contextPath: Illumio.Workloads.detected_vulnerabilities.vulnerability_report.href description: The URI of the report to which this vulnerability belongs to. type: String - contextPath: Illumio.Workloads.agent.config.mode description: DEPRECATED AND REPLACED (Use workload enforcement_mode instead). type: String - contextPath: Illumio.Workloads.agent.config.log_traffic description: True if we want to log traffic events from this workload. type: Boolean - contextPath: Illumio.Workloads.agent.config.security_policy_update_mode description: Defines the current policy update mode, which can be either adaptive or static based on static policy scopes. type: String - contextPath: Illumio.Workloads.agent.href description: HREF of the service agent. type: String - contextPath: Illumio.Workloads.agent.secure_connect.matching_issuer_name description: Issuer name match criteria for certificate used during establishing secure connections. type: String - contextPath: Illumio.Workloads.agent.status.uid description: The unique ID reported by the server. type: String - contextPath: Illumio.Workloads.agent.status.last_heartbeat_on description: The last time (rfc3339 timestamp) a heartbeat was received from this workload. type: Date - contextPath: Illumio.Workloads.agent.status.uptime_seconds description: How long since the last reboot of this server. Recorded in DB at the time of the last heartbeat. type: Number - contextPath: Illumio.Workloads.agent.status.agent_version description: Agent software version string. type: String - contextPath: Illumio.Workloads.agent.status.managed_since description: The time (rfc3339 timestamp) at which this workload became managed by a VEN. type: Date - contextPath: Illumio.Workloads.agent.status.fw_config_current description: If this workload's firewall config is up to string'. type: Boolean - contextPath: Illumio.Workloads.agent.status.firewall_rule_count description: 'DEPRECATED WITH NO REPLACEMENT: Number of firewall rules currently installed.' type: Number - contextPath: Illumio.Workloads.agent.status.security_policy_refresh_at description: DEPRECATED AND REPLACED (USE security_policy_applied_at and security_policy_received_at INSTEAD). type: Date - contextPath: Illumio.Workloads.agent.status.security_policy_applied_at description: Last reported time when policy was applied (UTC). type: Date - contextPath: Illumio.Workloads.agent.status.security_policy_received_at description: Last reported time when policy was received (UTC). type: Date - contextPath: Illumio.Workloads.agent.status.agent_health_errors.errors description: Errors associated with the security policy. type: Unknown - contextPath: Illumio.Workloads.agent.status.agent_health_errors.warnings description: Warnings associated with the security policy. type: Unknown - contextPath: Illumio.Workloads.agent.status.agent_health.type description: This field describes the error or the warning type. type: String - contextPath: Illumio.Workloads.agent.status.agent_health.severity description: Severity of the error type. type: String - contextPath: Illumio.Workloads.agent.status.agent_health.audit_event description: The URI of the audit event that was generated for the corresponding error or warning. type: String - contextPath: Illumio.Workloads.agent.status.security_policy_sync_state description: Current state of security policy. type: String - contextPath: Illumio.Workloads.agent.active_pce_fqdn description: The FQDN of the PCE that received the agent's last heartbeat. type: String - contextPath: Illumio.Workloads.agent.target_pce_fqdn description: The FQDN of the PCE the agent will use for future connections. type: String - contextPath: Illumio.Workloads.agent.type description: Agent type. type: String - contextPath: Illumio.Workloads.ven.href description: The URI of the VEN that manages this workload. This replaces the 'agent' field of this object. type: String - contextPath: Illumio.Workloads.ven.hostname description: The hostname of the host managed by the VEN, only displayed in expanded representations. type: String - contextPath: Illumio.Workloads.ven.name description: The friendly name of the VEN, only displayed in expanded representations. type: String - contextPath: Illumio.Workloads.ven.status description: Status of the VEN, only displayed in expanded representations. type: String - contextPath: Illumio.Workloads.enforcement_mode description: Workload's enforcement mode. type: String - contextPath: Illumio.Workloads.selectively_enforced_services.href description: Workload's selective enforcement mode. type: String - contextPath: Illumio.Workloads.created_at description: The time (rfc3339 timestamp) at which this workload was created. type: Date - contextPath: Illumio.Workloads.updated_at description: The time (rfc3339 timestamp) at which this workload was last updated. type: Date - contextPath: Illumio.Workloads.deleted_at description: The time (rfc3339 timestamp) at which this workload was deleted. type: Date - contextPath: Illumio.Workloads.created_by.href description: The URI of the user who has created this workload. type: String - contextPath: Illumio.Workloads.updated_by.href description: The URI of the user who has last updated this workload. type: String - contextPath: Illumio.Workloads.deleted_by.href description: The URI of the user who has deleted this workload. type: String - contextPath: Illumio.Workloads.container_cluster.href description: Container cluster URI. type: String - contextPath: Illumio.Workloads.container_cluster.name description: Container cluster name. type: String - contextPath: Illumio.Workloads.ike_authentication_certificate description: IKE authentication certificate for certificate-based Secure Connect and Machine Auth connections. type: String - arguments: - description: Enforcement boundary name. name: name required: true - description: Port number. name: port required: true - auto: PREDEFINED defaultValue: TCP description: Communication protocol. name: protocol predefined: - TCP - UDP - description: List of HREFs of entities to be used as providers for the rule, or "ams" for all workloads. Supports comma separated values. isArray: true name: providers required: true - description: List of HREFs of entities to be used as consumers for the rule, or "ams" for all workloads. Supports comma separated values. isArray: true name: consumers required: true description: Creates an enforcement boundary for a particular port/protocol. After completion of this command, provisioning will be done using the "illumio-object-provision" command. name: illumio-enforcement-boundary-create outputs: - contextPath: Illumio.EnforcementBoundary.href description: Enforcement boundary label URI. type: String - contextPath: Illumio.EnforcementBoundary.created_at description: Enforcement boundary creation time. type: Date - contextPath: Illumio.EnforcementBoundary.updated_at description: Enforcement boundary updated time. type: Date - contextPath: Illumio.EnforcementBoundary.deleted_at description: Enforcement boundary deleted time. type: Date - contextPath: Illumio.EnforcementBoundary.created_by.href description: URI of the user who has created the enforcement boundary. type: String - contextPath: Illumio.EnforcementBoundary.updated_by.href description: URI of the user who has updated the enforcement boundary. type: String - contextPath: Illumio.EnforcementBoundary.deleted_by.href description: URI of the user who has deleted the enforcement boundary. type: String - contextPath: Illumio.EnforcementBoundary.update_type description: Type of the modification done on the enforcement boundary. type: String - contextPath: Illumio.EnforcementBoundary.name description: Name of the enforcement boundary. type: String - contextPath: Illumio.EnforcementBoundary.providers.actors description: All managed workloads ('ams'). type: String - contextPath: Illumio.EnforcementBoundary.providers.label.href description: URI of the provider label. type: String - contextPath: Illumio.EnforcementBoundary.providers.label_group.href description: URI of the provider label group. type: String - contextPath: Illumio.EnforcementBoundary.providers.ip_list.href description: Providers IP list label URI. type: String - contextPath: Illumio.EnforcementBoundary.consumers.actors description: All managed workloads ('ams'). type: String - contextPath: Illumio.EnforcementBoundary.consumers.label.href description: URI of the consumer label. type: String - contextPath: Illumio.EnforcementBoundary.consumers.label_group.href description: URI of the consumer label group. type: String - contextPath: Illumio.EnforcementBoundary.consumers.ip_list.href description: Consumers IP list label URI. type: String - contextPath: Illumio.EnforcementBoundary.ingress_service.port description: Port of the ingress services. type: Number - contextPath: Illumio.EnforcementBoundary.ingress_services.proto description: Protocol of the ingress services. type: Number - contextPath: Illumio.EnforcementBoundary.ingress_services.href description: URI of the ingress service. type: String - contextPath: Illumio.EnforcementBoundary.caps description: Array of permissions for the entity to the current user - an empty array implies read only access. type: Unknown - arguments: - auto: PREDEFINED description: New enforcement mode to apply. name: enforcement_mode predefined: - Idle - Visibility_only - Selective - Full required: true - description: "List of workload HREFs to update. Supports comma separated values. \nNote: Users can retrieve the list of Href's by executing the \"illumio-workloads-list\" command." isArray: true name: workloads required: true description: Update the Enforcement Mode for one or more workloads. name: illumio-enforcement-mode-update outputs: - contextPath: Illumio.UpdateStatuses.href description: Enforcement mode update workload URI. type: String - contextPath: Illumio.UpdateStatuses.status description: Whether the operation was successful or not. type: String - arguments: - description: |- URI of the IP list. Note: Users can retrieve the list of Href's of IP by executing the "illumio-ip-lists-get" command. name: href required: true description: Retrieves the list of IPs based on the name of the IP list. name: illumio-ip-list-get outputs: - contextPath: Illumio.IPLists.href description: URI of the IP list. type: String - contextPath: Illumio.IPLists.description description: Description of IP list. type: String - contextPath: Illumio.IPLists.external_data_set description: External data set identifier. type: String - contextPath: Illumio.IPLists.external_data_reference description: External data reference identifier. type: String - contextPath: Illumio.IPLists.created_at description: Time stamp when this IP list was first created. type: Date - contextPath: Illumio.IPLists.updated_at description: Time stamp when this IP List was last updated. type: Date - contextPath: Illumio.IPLists.deleted_at description: Time stamp when this IP List was deleted. type: Date - contextPath: Illumio.IPLists.created_by.href description: User who originally created this IP List. type: String - contextPath: Illumio.IPLists.updated_by.href description: User who last updated this IP List. type: String - contextPath: Illumio.IPLists.deleted_by.href description: User who has deleted this IP List. type: String - contextPath: Illumio.IPLists.name description: Name (must be unique). type: String - contextPath: Illumio.IPLists.ip_ranges.description description: Description of given IP range. type: String - contextPath: Illumio.IPLists.ip_ranges.from_ip description: IP address or a low end of IP range. Might be specified with CIDR notation. type: String - contextPath: Illumio.IPLists.ip_ranges.to_ip description: High end of an IP range. type: String - contextPath: Illumio.IPLists.ip_ranges.exclusion description: Whether this IP address is an exclusion. Exclusions must be a strict subset of inclusive IP addresses. type: String - contextPath: Illumio.IPLists.fqdns.fqdn description: Fully qualified domain name. type: String - contextPath: Illumio.IPLists.fqdns.description description: Description of FQDN. type: String - arguments: - description: Description of IP list to return. Supports partial matches. name: description - description: IP lists matching fqdn. Supports partial matches. name: fqdn - description: IP address matching IP list(s) to return. name: ip_address - defaultValue: '500' description: |- Maximum number of IP Lists to return. The value must be positive integer. High value will result in performance issue. Note: 2500 is the optimum value. name: max_results - description: Name of IP list(s) to return. Supports partial matches. name: name description: Retrieves the list of IPs based on the query parameters. name: illumio-ip-lists-get outputs: - contextPath: Illumio.IPLists.href description: URI of the IP list. type: String - contextPath: Illumio.IPLists.description description: Description of IP list. type: String - contextPath: Illumio.IPLists.external_data_set description: External data set identifier. type: String - contextPath: Illumio.IPLists.external_data_reference description: External data reference identifier. type: String - contextPath: Illumio.IPLists.created_at description: Time stamp when this IP list was first created. type: Date - contextPath: Illumio.IPLists.updated_at description: Time stamp when this IP List was last updated. type: Date - contextPath: Illumio.IPLists.deleted_at description: Time stamp when this IP List was deleted. type: Date - contextPath: Illumio.IPLists.created_by.href description: User who originally created this IP List. type: String - contextPath: Illumio.IPLists.updated_by.href description: User who last updated this IP List. type: String - contextPath: Illumio.IPLists.deleted_by.href description: User who has deleted this IP List. type: String - contextPath: Illumio.IPLists.name description: Name (must be unique). type: String - contextPath: Illumio.IPLists.ip_ranges.description description: Description of given IP range. type: String - contextPath: Illumio.IPLists.ip_ranges.from_ip description: IP address or a low end of IP range. Might be specified with CIDR notation. type: String - contextPath: Illumio.IPLists.ip_ranges.to_ip description: High end of an IP range. type: String - contextPath: Illumio.IPLists.ip_ranges.exclusion description: Whether this IP address is an exclusion. Exclusions must be a strict subset of inclusive IP addresses. type: Boolean - contextPath: Illumio.IPLists.fqdns.fqdn description: Fully qualified domain name. type: String - contextPath: Illumio.IPLists.fqdns.description description: Description of FQDN. type: String - arguments: - description: Ruleset name. name: name required: true description: Creates a ruleset with a unique name. Until provisioned with the 'illumio-object-provision' command, this object will remain in a draft state. name: illumio-ruleset-create outputs: - contextPath: Illumio.Ruleset.href description: Label URI. type: String - contextPath: Illumio.Ruleset.created_at description: Ruleset creation time. type: Date - contextPath: Illumio.Ruleset.updated_at description: Ruleset updation time. type: Date - contextPath: Illumio.Ruleset.deleted_at description: Ruleset deletion time. type: Date - contextPath: Illumio.Ruleset.created_by.href description: URI of the user who has created the ruleset. type: String - contextPath: Illumio.Ruleset.updated_by.href description: URI of the user who has updated the ruleset. type: String - contextPath: Illumio.Ruleset.deleted_by.href description: URI of the user who has deleted the ruleset. type: String - contextPath: Illumio.Ruleset.update_type description: Type of modification done on the ruleset. type: String - contextPath: Illumio.Ruleset.name description: Name of the ruleset. type: String - contextPath: Illumio.Ruleset.description description: Description of the ruleset. type: String - contextPath: Illumio.Ruleset.enabled description: Whether the ruleset is enabled or not. type: Boolean - contextPath: Illumio.Ruleset.scopes description: Scope of the ruleset. type: Unknown - contextPath: Illumio.Ruleset.rules description: Rules in the ruleset. type: Unknown - contextPath: Illumio.Ruleset.ip_tables_rules description: Array of IP table rules in the ruleset. type: Unknown - contextPath: Illumio.Ruleset.caps description: Array of permissions for the entity to the current user - an empty array implies read-only access. type: Unknown - arguments: - description: HREF of the ruleset in which to create the rule. name: ruleset_href required: true - description: HREFs of entities to be used as providers for the rule. For all workloads provide "ams". Supports comma-separated values. isArray: true name: providers required: true - description: HREFs of entities to be used as consumers for the rule. For all workloads provide "ams". Supports comma-separated values. isArray: true name: consumers required: true - defaultValue: workloads description: |- Provider objects the rule should apply to. Supports comma separated values. Supported values are: 'workloads' and 'virtual_services'. isArray: true name: resolve_providers_as - defaultValue: workloads description: |- Consumer objects the rule should apply to. Supports comma separated values. Supported values are: 'workloads' and 'virtual_services'. isArray: true name: resolve_consumers_as - description: Service URIs. Supports comma separated values. isArray: true name: ingress_services description: Creates & assigns rules to a particular ruleset. Added or updated Rules will remain in draft state until their containing Rule Set is provisioned using the "illumio-object-provision" command. name: illumio-rule-create outputs: - contextPath: Illumio.Rule.href description: Label URI. type: String - contextPath: Illumio.Rule.created_at description: Rule creation time. type: Date - contextPath: Illumio.Rule.updated_at description: Rule updated time. type: Date - contextPath: Illumio.Rule.deleted_at description: Rule deleted time. type: Date - contextPath: Illumio.Rule.created_by.href description: URI of the user who has created the rule. type: String - contextPath: Illumio.Rule.updated_by.href description: URI of the user who has updated the rule. type: String - contextPath: Illumio.Rule.deleted_by description: URI of the user who has deleted the rule. type: String - contextPath: Illumio.Rule.update_type description: Type of modification done on the rule. type: String - contextPath: Illumio.Rule.description description: Description of the rule. type: String - contextPath: Illumio.Rule.enabled description: Whether the rule is enabled or not. type: Boolean - contextPath: Illumio.Rule.providers.label.href description: Providers label URI. type: String - contextPath: Illumio.Rule.providers.actors description: All workloads. type: String - contextPath: Illumio.Rule.providers.label_group.href description: Providers label group URI. type: String - contextPath: Illumio.Rule.providers.virtual_server.href description: Providers virtual server URI. type: String - contextPath: Illumio.Rule.providers.virtual_service.href description: Provider virtual service URI. type: String - contextPath: Illumio.Rule.providers.ip_list.href description: Provider ip list URI. type: String - contextPath: Illumio.Rule.providers.workload.href description: Provider workload URI. type: String - contextPath: Illumio.Rule.consumers.label.href description: Consumer label URI. type: String - contextPath: Illumio.Rule.consumers.label_group.href description: Consumer label group URI. type: String - contextPath: Illumio.Rule.consumers.actors description: All workloads. type: String - contextPath: Illumio.Rule.consumers.virtual_service.href description: Consumer virtual service URI. type: String - contextPath: Illumio.Rule.consumers.ip_list.href description: Consumer ip list URI. type: String - contextPath: Illumio.Rule.consumers.workload.href description: Consumer workload URI. type: String - contextPath: Illumio.Rule.consumers.virtual_server.href description: Consumer virtual server URI. type: String - contextPath: Illumio.Rule.consuming_security_principals description: URI of consuming security principals. type: String - contextPath: Illumio.Rule.sec_connect description: Whether a secure connection is established or not. type: Boolean - contextPath: Illumio.Rule.stateless description: Whether packet filtering is stateless for the rule or not. type: Boolean - contextPath: Illumio.Rule.machine_auth description: Whether machine authentication is enabled or not. type: Boolean - contextPath: Illumio.Rule.unscoped_consumers description: Whether the scope for rule consumers is set to all or not. type: Boolean - contextPath: Illumio.Rule.network_type description: Network types to which this rule should apply to. type: String - contextPath: Illumio.Rule.ingress_services.href description: Array of service URI and port/protocol combinations. type: String - contextPath: Illumio.Rule.resolve_labels_as.providers description: Providers resolve labels. type: String - contextPath: Illumio.Rule.resolve_labels_as.consumers description: Consumers resolve labels. type: String dockerimage: demisto/illumio:1.0.0.10133006 runonce: false script: '-' subtype: python3 type: python tests: - No tests (auto formatted) marketplaces: - xsoar - marketplacev2 - platform fromversion: 6.2.0