Policy Advisor Overview
The Policy Advisor analyzes traffic in your environment and generates security policy recommendations based on compliance frameworks and Illumio best practices. It translates observed traffic into rules that you can review, save as drafts, edit, and provision to enforce segmentation across your workloads. The Policy Advisor continuously monitors new unique connections to applications and updates it's recommendations automatically.
The Policy Advisor generates two categories of policy recommendations:
Guardrail policies block known-risky traffic based on compliance frameworks. Guardrail policies primarily contain Deny rules that target specific services and protocols identified as security risks (such as FTP, Telnet, or NetBIOS). These policies apply to all workloads, including workloads that have no labels assigned.
Application policies permit observed traffic between specific applications in your environment. Policy Advisor groups workloads into applications using a label pairing you define (for example, App + Environment) and recommends Allow rules that reflect the traffic patterns it observes between those applications.
Both categories of recommendations share the same lifecycle and both are available from the Policy Advisor page.
Policy Advisor Key Concepts
Term | Definition |
|---|---|
Framework | A compliance or security standard whose controls drive the rules that Policy Advisor generates. Illumio Best Practices is the built-in framework and is always active. You can also select industry frameworks such as PCI DSS, ISO 27001, HIPAA, and others. |
Guardrail rule | A rule derived from a compliance framework control. Guardrail rules codify expected network security posture and are evaluated against traffic in your environment to identify violations. |
Application definition | The label pairing (for example, App + Environment) that Policy Advisor uses to group workloads into applications for application-scoped recommendations. |
Broad Deny rule | A Deny rule whose source or destination is All Workloads or Any (0.0.0.0/0 and ::/0). Broad Deny rules block traffic across wide scopes rather than between specific labeled applications. |
The Policy Recommendation Lifecycle
Each policy recommendation moves through a defined lifecycle. Summary tiles at the top of the Policy Advisor page show the count of recommendations in each status.
Policy Recommendations. New policies that the Policy Advisor has generated but you have not yet reviewed or saved as drafts.
Draft Policies. Recommendations that you have reviewed and saved as drafts. Draft policies appear on the Policies page where you can edit rules, add exceptions, and provision them when ready.
Drafts with New Rule Recommendations. Existing draft policies for which the Policy Advisor has generated new rules. New rules can result from updated traffic analysis, changes to Network Posture Frameworks, or user-added policy exceptions that appear as Allow rules. You can review the new rules and push them to the existing draft.
Creating a draft does not enforce any rules. Rules take effect only after you provision the policy from the Policies page.
Review Guardrail Policy Recommendations
Guardrail policy recommendations analyze traffic in your environment against your selected compliance frameworks and recommend deny rules to block traffic that violates those frameworks. Each recommended rule references the framework control it addresses so you can trace every recommendation back to a specific compliance requirement.
To view guardrail recommendations, go to Policies > Policy Advisor. On the Policy Recommendations tab, select the Guardrail Violations view.
The table lists each guardrail policy by name along with its associated framework, rule count, violating flow count, and status. The recommended rules table groups rules by type (Allow and Deny). Each rule row shows the guardrail rule name, source, destination, destination services, and (for Deny rules) the number of violating traffic flows.
Guardrail Recommendations for Unlabeled Workloads
The Policy Advisor generates guardrail recommendations for workloads that have no labels or no labels matching the active application definition. These recommendations use Broad Deny rules scoped to All Workloads or Any (0.0.0.0/0 and ::/0) rather than to label pairs. This provides security coverage as soon as workloads are managed before your labeling strategy is in place.
For example, the Policy Advisor may generate a Deny rule that blocks insecure protocols (such as FTP, Telnet, and HTTP) between all workloads, or a rule that blocks NetBIOS traffic from any IP address.
As a workload acquires labels over time, its existing broad-scope policies are preserved in the stage they have reached (Recommended, Draft, or Provisioned). On the next scheduled run, the Policy Advisor generates separate, label-based recommendations for the now-labeled workload. Both sets of recommendations coexist. The Policy Advisor does not duplicate a workload across both paths: a workload that qualifies for label-based recommendations is excluded from broad-scope recommendations.
Note
This feature does not auto-label or suggest labels for unlabeled workloads and it does not change how existing label-based recommendations are generated.
Filter Guardrail Recommendations
Use the filters to narrow the list of guardrail recommendations:
Frameworks: Display only policies associated with the selected compliance frameworks.
Status: Display policies at one or more selected stages of the recommendation lifecycle.
Violating Flows: Filter by the number of guardrail violations. Select a comparison operator and specify a value to prioritize policies with the most violations or to isolate policies at a specific threshold.
Accept a Guardrail Policy Recommendation
In the Guardrail Violations table, select a policy with Recommended status.
Review the Policy Details section.
Review the Recommended Rules. Rules are grouped by type (Allow and Deny).
Select an individual rule to view its details in a slideout panel.
The Violating Flows section shows the compliance percentage and a breakdown of the traffic in your environment that matches the rule.
Expand Policy Analysis to review the AI-generated assessment.
Click Create Policy in Draft.
In the confirmation dialog, review the policy details.
Click Create Policy to create the draft, or Cancel to return to the recommendation.
After you create the draft, you are redirected to the Policies page. You can edit rules, add exceptions, and provision the policy when you are ready to enforce it.
Caution
If the policy contains only deny rules, verify that none of the affected traffic flows are required for business operations before provisioning. Mark required flows as exceptions in Network Posture before provisioning or add allow rules from the Policies page.
Accept New Rules on an Existing Guardrail Draft
When the Policy Advisor identifies a new guardrail rule that applies to a policy you have already saved as a draft, the policy appears in the Guardrail Violations table with a Draft status and a rule-suggested count. A banner at the top of the policy detail page indicates how many new rules have been recommended.
In the Guardrail Violations table, select the policy with the new rule indication.
Review the new recommended rule under Recommended Rules.
Select the rule to review its severity, compliance reference, and violating flow data in the detail panel.
Click Push Rule to Draft to add the new rule to your existing draft policy.
To view the current draft on the Policies page without accepting the new rule, click View on Policies.
Review Application Policy Recommendations
Application policy recommendations generate Allow rules based on observed traffic between labeled applications. Policy Advisor groups workloads into applications using the active application definition and recommends rules that permit the traffic patterns it observes.
To view application recommendations, go to Policies > Policy Advisor. On the Policy Recommendations tab, select the Applications view.
The table lists each application that has generated recommendations.
Note
Application recommendations require workloads to have labels matching the active application definition. Workloads without labels receive guardrail recommendations instead. See the Guardrail Recommendations for Unlabeled Workloads section.
Filter Application Recommendations
Use the filters above the table to narrow the list.
Accept an Application Policy Recommendation
In the Applications table, select an application with Recommended status.
Review the recommended rules.
Expand Policy Analysis to review the AI-generated assessment.
Click Create Policy in Draft.
In the confirmation dialog, review the policy details.
Click Create Policy to create the draft.
The draft policy appears on the Policies > Application Policies page where you can review and edit rules before provisioning.
Accept New Rules on an Existing Application Draft
When new traffic analysis produces additional rule recommendations for an application you have already saved as a draft, the application appears in the table with a Drafts with New Rule Recommendations status.
Select the application with the new rule indication.
Review the new recommended rules.
Click Push Rules to Draft to add the rules to your existing draft policy.
AI Generated Policy Analysis
Policy Advisor provides an AI-generated analysis for each recommended policy. Expand the Policy Analysis section on any policy detail view to review the following:
An assessment of the policy's overall security posture, including whether gaps or conflicting rules exist.
Key Protections: the services and protocols the policy blocks, with explanations of why blocking them reduces risk.
Allowed but Risky Traffic: observed traffic that the policy permits to avoid disrupting application functionality, with notes on potential risk.
Use this analysis to assess the security impact of a recommendation before creating a draft.