Illumio Community Hub

I recently connected my local personal agent (Openclaw.. named him Jarvis (Yeah I am not very orignal) to the API of my Illumio lab.

Rather than giving it a prewritten script, I asked a simple natural-language question:

The agent located the existing integration, authenticated using a scoped API identity and queried the PCE in read-only mode.

Within seconds, it reported:

• 6 managed workloads
• 0 unmanaged workloads
• 6 workloads in Selective Enforcement
• 2 active rule sets
• 3 draft rule sets
• 90 services in the draft policy
• 138 configured label values across five dimensions

It then examined actual label usage.

All six workloads had Location, Environment and Application labels, but only four had a Role label. Two Windows workloads also used my custom winos label.

That produced a more interesting question than the inventory itself:

The agent did not create or provision anything. It only inspected the PCE and returned sanitized aggregate information-no credentials, IP addresses or workload names.

The workflow was approximately:

Natural-language request
        ↓
Agent interprets intent
        ↓
Scoped, read-only PCE API queries
        ↓
Sanitization and aggregation
        ↓
Findings and follow-up questions

API automation is obviously not new. What I find interesting is the agent's ability to move beyond returning raw JSON.

It can examine the result, identify incomplete label coverage and suggest the next questions:

• Which workloads are missing a Role?
• Are all 138 label values still required?
• Which labels are actually useful for policy?
• What would change if these workloads moved into Full Enforcement?
• Can the agent propose a correction while keeping it in draft?

This is still a home-lab experiment. 
But it is really powerful to be able to do changes to my lab with a few simple queries, lastly when I did a demo for a customer, I knew he was in the financial industry, so I simply asked my Agent to rename some of the labels to showcase different PCI requirements.

After 3 min, I had new labels, and they where deployed on several of my demo workloads, to make the demo make sense. No manual steps outside of me giving it a simple prompt.

It might not be viable for most production systems at the moment, but with proper guardrails it can be very powerful for installations that is on-prem.