Illumio PCE

By integrating Illumio Policy Compute Engine (PCE) with ThreatDefence via the Illumio Events API (GET /api/v2/orgs/{org_id}/events), you can seamlessly ingest security and auditing event data into ThreatDefence for centralized monitoring and response.

This integration enhances visibility into:

• Security-related events such as policy changes and enforcement actions

• Administrative and user audit activity

• Workload and agent lifecycle events

It enables more effective detection of unauthorized changes, policy violations, and suspicious administrative activity across your Illumio environment.

---

Requirements

• Access to your Illumio PCE web console with Organization Owner or Admin privileges

• Network connectivity from ThreatDefence to your PCE on the API port (default: 8443)

• A dedicated service account in the PCE (recommended) — the API key only requires read-only access to the Events endpoint

---

Step 1. Generate API Keys

You can create API keys using the Web console with the User Menu:

1. Sign in to the Illumio PCE web console and click on your username in the top-right corner.

2. Select My API Keys from the drop-down menu.

3. Click the Add button to create a new API key.

4. Enter a descriptive Name for the key (e.g., ThreatDefence Integration).

5. Click Create.

6. The console will display the API Authentication Username and the Secret.

Important: Copy and store both values securely. The API Secret is displayed only once and cannot be retrieved later.

Understanding the key format:

• API Authentication Username — displayed as: api_xxxxxxxxxxxxxxxxx

• API Secret — a long random string shown only at creation time.

For more information on API key management and the Events API, refer to the official Illumio documentation: Illumio REST API — API Keys Documentation Illumio REST API — Events Endpoint Reference

---

Step 2. Gather PCE Connection Details

In addition to the API key pair, collect the following connection details from your PCE environment.

PCE Host (FQDN)

The fully qualified domain name used to access your PCE web console. Visible in the browser address bar when logged in. For example, if your URL is https://pce.company.com:8443, the host value is pce.company.com. Do not include the protocol (https://) or port.

Port

The port your PCE API listens on. The default is 8443. If your organization uses a custom port, confirm the value with your PCE administrator.

Organization ID

A numeric identifier for your organization within the PCE. You can find it in the PCE URL after /orgs/. For example: https://pce.company.com:8443/orgs/1/... — the Org ID is 1. For single-organization PCE deployments, this is typically 1.

---

Step 3. Configure ThreatDefence Integration

Provide the following information to your ThreatDefence representative at [e-mail]:

• PCE Host (FQDN)

• Port

• Organization ID

• API Authentication Username (API Key)

• API Secret

---

Support

For questions or assistance, please contact: 📧 [e-mail]