Quarantine Workloads from the Illumio Splunk App
If you have both the admin role and the Illumio_quarantine_workload role, you can quarantine workloads from the Illumio Splunk App by clicking the Quarantine button, which appears on the following dashboards:
Port Scan (on the Security Operations dashboard)
Firewall Tampering (on the Security Operations dashboard)
If the Quarantine button is greyed out, then you do not have adequate permissions to quarantine workloads. See Access to Quarantine Workload Action.
 |