VEN Firewall Tampering Detection

The VEN Firewall Tampering Detection feature monitors host firewalls for unauthorized changes. Whether and when the VEN alerts the PCE about signs of tampering differs by VEN version (as detailed below). In all VEN versions, the VEN checks whether tampering occurred, and if tampering is verified, restores the policy. If the VEN can't communicate with the PCE while attempting to report suspected firewall tampering or during the rule restoration process, it attempts to recover the last-known good copy of its locally-stored policy.

What Triggers a Tampering Event

A host firewall tampering event occurs when another administrator or an attacker:

Adds a firewall rule to the Illumio firewall compartment.
Modifies a firewall rule added by Illumio.
Deletes a firewall rule added by Illumio.
Deletes all firewall rules (flush) added by Illumio.

How Tampering Detection Works

The VEN detects host firewall tampering on several operating systems, typically within seconds. For all supported OSs, the VEN checks whether runtime firewall rules have changed. Reporting detected tampering to the PCE can take up to 10 minutes but is typically much faster. When the VEN alerts the PCE differs by VEN release.

Table 3. Alert Timing and Format

VEN version	Alert order and format	Notes
VEN releases 26.2.20 and later	Detect signs of possible tampering. Alert the PCE. Determine if tampering occurred. Restore rules if tampering verified.	If possible tampering is detected, the VEN sends an alert to the PCE immediately (pre-verification). `agent.tampering`: severity = Warning (Settings > Troubleshoot > Events)
VEN releases pre-26.2.20	Detect signs of possible tampering. Determine if tampering occurred. Alert the PCE. Restore rules if tampering verified.	The VEN doesn't alert the PCE unless and until tampering is verified. `agent.tampering`: severity = Information (Settings >Troubleshoot > Events)

Table 4. Tampering Detection by Host OS

OS	Monitoring	Detection	Rule restoration process starts if tampering is verified?
Linux	Continuous	Looks for changes in the runtime firewall policy to `iptables`, `ipset`, or `IPsec` compared to the PCE-generated Illumio policy.	Yes
Windows	Continuous	Looks for changes in the runtime firewall policy to `WFP` or `IPsec` compared to the PCE-generated Illumio policy.
AIX	Periodic (every 10 mins.)	Compares periodic snapshots of the runtime firewall policy with the PCE-generated Illumio policy.
Solaris	Periodic (every 10 mins.)	Compares periodic snapshots of the runtime firewall policy with the PCE-generated Illumio policy.

Firewall Change History

Changes to the firewall on a workload are historically recorded for an audit trail. Up to 10 changes to the firewall history are saved. On-prem customers can view the history via the PCE Support Reports (Settings > Troubleshoot).

View Tampering Alerts

You can view tampering alerts in the following locations:

On the host VEN
In the PCE web console
Via the /eventsIllumio Segmentation for Data Centers REST API
In Splunk or other SIEM software: query for agent.tampering events in accordance with the SIEM vendor's query procedures.

On the VEN Host

Workload OS	Procedure
Linux	As root, separately execute the following commands: Tail the VEN log file to see suspected tampering events and hash comparisons: tail -f /opt/illumio_ven_data/log/platform.log INFO: Possible tamper detected... INFO: FW iptables checksums ... (compares security policy hashes to see if anything changed)
Windows	Check `\programdata\illumio\log\platform.log` and search "`!!!Tampering detected`" Note This alert displays "Filtering Platform Policy Change" when a tampering event is detected. Double-click the alert for detailed information.

Workload OS

Procedure

Linux

As root, separately execute the following commands:

Tail the VEN log file to see suspected tampering events and hash comparisons:

tail -f /opt/illumio_ven_data/log/platform.log

INFO: Possible tamper detected...
INFO: FW iptables checksums ... (compares security policy hashes to see if anything changed)

Windows

Check \programdata\illumio\log\platform.log and search "!!!Tampering detected"

Note

This alert displays "Filtering Platform Policy Change" when a tampering event is detected. Double-click the alert for detailed information.

Via the PCE UI

To view agent.tampering events in the PCE web console, navigate to Settings > Troubleshoot > Events.
Double-click an agent.tampering event to see its details.

Via the REST API

To return all tampering events for an organization, execute one of the following commands using your organization URI. (For more information, see Events in the REST API Developer Guide

Example Curl Command to Get Information for All agent.tampering Events:

curl -i -X GET https://pce.example.com:8443/api/v2/orgs/1/events/?event_type=agent.tampering -H "Accept: application/json" -u $KEY:$TOKEN

Example Curl Command to Get Information for a Specific agent.tampering Event:

curl -i -X GET https://pce.example.com:8443/api/v2/orgs/1/events/some_event_ID -H "Accept: application/json" -u $KEY:$TOKEN

Example JSON Response Body from Getting an agent.tampering Event:

{
    "href": "/orgs/1/events/some_event_ID",
    "timestamp": "2019-06-17T05:42:10.419Z",
    "pce_fqdn": "someName.someDomain",
    "created_by": {
        "agent": {
            "href": "/orgs/1/agents/xxxxx",
            "hostname": "someHostname"
        }
    },
    "event_type": "agent.tampering",
    "status": "success",
    "severity": "err",
    "action": {
        "uuid": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
        "api_endpoint": "FILTERED",
        "api_method": "PUT",
        "http_status_code": 204,
        "src_ip": "xx.xxx.xx.xx"
    },
    "resource_changes": [],
    "notifications": [
        {
            "uuid": "yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy",
"notification_type": "workload.oob_policy_changes",
            "info": {
                "tampering_revert_succeeded": true,
                "beginning_timestamp": "2019-06-17T05:42:10Z",
                "ending_timestamp": "2019-06-17T05:42:10Z",
                "num_events": 1
            }
        }
    ]
}

Illumio Administration Guide 26.x