> For the complete documentation index, see [llms.txt](https://docs.threatdefence.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.threatdefence.com/siem-integrations/firewalls/cisco-meraki-1.md).

# Illumio PCE

By integrating **Illumio Policy Compute Engine (PCE)** with **ThreatDefence** via the **Illumio Events API** (`GET /api/v2/orgs/{org_id}/events`), you can seamlessly ingest security and auditing event data into ThreatDefence for centralized monitoring and response.

This integration enhances visibility into:

* Security-related events such as policy changes and enforcement actions
* Administrative and user audit activity
* Workload and agent lifecycle events

It enables more effective detection of unauthorized changes, policy violations, and suspicious administrative activity across your Illumio environment.

***

## Requirements

* Access to your **Illumio PCE web console** with **Organization Owner** or **Admin** privileges
* Network connectivity from ThreatDefence to your PCE on the API port (default: **8443**)
* A dedicated **service account** in the PCE (recommended) — the API key only requires **read-only** access to the Events endpoint

***

## Step 1. Generate API Keys

You can create API keys using the Web console with the User Menu:

1. Sign in to the Illumio PCE web console and click on your **username** in the top-right corner.
2. Select **My API Keys** from the drop-down menu.
3. Click the **Add** button to create a new API key.
4. Enter a descriptive **Name** for the key (e.g., *ThreatDefence Integration*).
5. Click **Create**.
6. The console will display the **API Authentication Username** and the **Secret**.

**Important:** Copy and store both values securely. The API Secret is displayed only once and cannot be retrieved later.

**Understanding the key format:**

* **API Authentication Username** — displayed as: `api_xxxxxxxxxxxxxxxxx`
* **API Secret** — a long random string shown only at creation time.

For more information on API key management and the Events API, refer to the official Illumio documentation:\
[Illumio REST API — API Keys Documentation](https://product-docs-repo.illumio.com/Tech-Docs/Core/23.5/REST-APIs/out/en/core-rest-apis-23-5/authentication-and-api-user-permissions/api-keys.html)\
[Illumio REST API — Events Endpoint Reference](https://product-docs-repo.illumio.com/Tech-Docs/Core/23.5/REST-APIs/REST_API_23.5/index.html#get-events)

***

## Step 2. Gather PCE Connection Details

In addition to the API key pair, collect the following connection details from your PCE environment.

#### PCE Host (FQDN)

The fully qualified domain name used to access your PCE web console. Visible in the browser address bar when logged in. For example, if your URL is `https://pce.company.com:8443`, the host value is **`pce.company.com`**. Do not include the protocol (https\://) or port.

#### Port

The port your PCE API listens on. The default is **`8443`**. If your organization uses a custom port, confirm the value with your PCE administrator.

#### Organization ID

A numeric identifier for your organization within the PCE. You can find it in the PCE URL after `/orgs/`. For example: `https://pce.company.com:8443/orgs/1/...` — the Org ID is **1**. For single-organization PCE deployments, this is typically **1**.

***

## Step 3. Configure ThreatDefence Integration

Provide the following information to your ThreatDefence representative at **<support@threatdefence.com>**:

* PCE Host (FQDN)
* Port
* Organization ID
* API Authentication Username (API Key)
* API Secret

***

## Support

For questions or assistance, please contact:\
📧 **<support@threatdefence.com>**


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.threatdefence.com/siem-integrations/firewalls/cisco-meraki-1.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.