Provide Access to the Quarantine Workload Action

By default, users do not have access to the Quarantine Workload action either in the Splunk app or in Adaptive Response Action.

To enable a Splunk user to take the quarantine actions on workloads, grant the user the Illumio_quarantine_workload role and the admin role. Only local users can be granted this role. SAML users cannot, because their roles are constrained by an external system.

Click Settings > Access Control.
Click Users.
Click the username to which the role needs to be granted.
In the Role section of the edit screen, grant the required roles.
Click Save.

Quarantine Actions Using Splunk Core Alert Actions

Quarantine Workloads Using Enterprise Security Suite

Splunk provides the Splunk Enterprise Security Suite (ESS), which leverages Splunk’s Adaptive Response Framework and allows administrators to monitor and manage threats and incidents directly from Splunk apps. It has rich dashboards that help monitor incidents and take actions on these incidents.

Splunk Enterprise Security Suite is extendable by adding a compatible Module App (Adaptive Response Add-ons) for a particular domain or technology. The suite detects configurations in these Adaptive Response Add-ons and helps monitor and take actions on the incidents reported by these Add-ons.

The Illumio Technology Add-On for Splunk is an add-on module for Splunk Enterprise Security Suite. It leverages the Splunk Adaptive Response Framework and empowers system administrators to monitor and take actions on incidents reported by analytics on Illumio PCE events or logs from the Splunk Enterprise Security Suite dashboards.

When using the Splunk Enterprise Security Suite (ES), you can install the Illumio Technology Add-On for Splunk on a single ES Search Head (SH) or on both an ES SH and an associated ES Search Head Cluster (SHC). This allows the Adaptive Response to be invoked from any installed location of the Illumio Technology Add-On for Splunk. The Illumio data is stored on the indexers only, and not on the search head nodes, so the data is not duplicated. If the Illumio Technology Add-On for Splunk is installed on a single ES SH only, the data is normalized for the associated SHC.

The Incident Review dashboard:

As a part of the Adaptive Response Framework, Splunk has enhanced this Incident Review dashboard in the Enterprise Security Suite app, which allows you to take action on notable events.

To view the notable event details, expand the left arrow for the notable event. To execute alert actions manually for each of the notable events, click Run Adaptive Response Actions for the notable event and select the specific Alert Action.