Illumio and Zeek NDR: Automated Workload Quarantine
This integration connects Zeek's network detection capability to Illumio's workload policy enforcement. When Zeek detects a port scan against a monitored host, it automatically calls the Illumio PCE API to quarantine that workload; no manual intervention required.
How it works
AWS VPC Traffic Mirroring copies packets from the monitored workload to the Zeek sensor over VXLAN (UDP 4789). Zeek analyzes that traffic stream and, when the bro-simple-scan plugin raises a Scan::Port_Scan notice, a policy hook triggers a script that calls the Illumio PCE API. The API applies a Quarantine label to the targeted workload and sets enforcement to Full. The workload stays quarantined until an administrator releases it explicitly, either via command line or the Zeek status dashboard.
What changes at enforcement time
The targeted workload moves to Full enforcement with no allow rules, which blocks all inbound and outbound traffic including SSH. All other workloads are unaffected. The quarantine is not time-limited and does not self-release.
Releasing a quarantine
sudo /usr/local/bin/quarantine_workload.py --release <workload-ip>
This removes the Quarantine label and restores visibility_only enforcement.