What Changed
New CCF-based Data Connector for Illumio Insights Graph that ingests AI-powered threat discovery and anomaly reports generated by the Illumio Insights Agent.
Data Source
- Product: Illumio Insights Graph (Illumio zero-trust segmentation platform)
- API Endpoint: https://gw.console.illum.io/api/v1/resource-insights
- Ingestion Frequency: 15-minute polling intervals
Ingestion Mechanism
- Framework: CCF (Codeless Connector Framework) with DCR
- Target Table: IllumioInsightsGraph_CL
- Authentication: API Key authentication with tenant-specific headers
- Data Transformation: Custom KQL transform parses JSON insights into structured network flow data
Detection Surface Unlocked
The connector provides comprehensive network traffic analysis capabilities including:
Network Flow Intelligence
- Source/destination IP addresses, ports, and protocols
- Resource identification and internal IDs
- Network byte counts (sent/received)
- Flow frequency analysis
Geographic and Threat Context
- Geographic location data (city, region, country) for source and destination
- Threat level scoring for endpoints
- Virtual network identification (Azure VNet IDs)
- Well-known service identification
Enhanced Visibility
- Network traffic patterns between segmented resources
- Anomalous communication flows flagged by Illumio AI
- Cross-regional and cross-VNet communication analysis
- Service-level traffic breakdown with port/protocol details
This connector fills a critical gap in zero-trust network monitoring by providing AI-enhanced visibility into micro-segmented network flows, enabling detection of lateral movement and policy violations within segmented environments.
Affected Files
Solutions/Illumio Insight/Data Connectors/IllumioInsightsGraph_CCP/IllumioInsightsGraph_ConnectorDefinition.json
Solutions/Illumio Insight/Data Connectors/IllumioInsightsGraph_CCP/IllumioInsightsGraph_DCR.json
Solutions/Illumio Insight/Data Connectors/IllumioInsightsGraph_CCP/IllumioInsightsGraph_PollingConfig.json
Solutions/Illumio Insight/Data Connectors/IllumioInsightsGraph_CCP/table_IllumioInsightsGraph.json
(packaging artefacts: 3.3.3.zip, ReleaseNotes.md, Solution_IllumioInsights.json, createUiDefinition.json, mainTemplate.json)