Explorer / traffic

Explorer

Traffic Analysis

class illumio.explorer.TrafficQuery[source]

Represents a query against the PCE traffic flow database.

See https://docs.illumio.com/core/22.1/Content/Guides/rest-api/visualization/explorer.htm#TrafficAnalysisQueries

Raises:

IllumioException – if any of the dates provided, the date range, or the policy_decision field value are invalid.

static build(start_date, end_date, include_sources=[[]], exclude_sources=[], include_destinations=[[]], exclude_destinations=[], include_services=[], exclude_services=[], policy_decisions=[], exclude_workloads_from_ip_list_query=True, max_results=100000, query_name=None)[source]

Constructs a TrafficQuery object based on the provided parameters.

Empty include values indicate that all sources/destinations/services should be included, while empty exclude values indicate that none should be excluded.

Parameters:

  • start_date (Optional[Union[str, int, float]]) – starting datetime of the search. Can be provided as a datetime string, or a Unix timestamp integer or float in either seconds or milliseconds.

  • end_date (Optional[Union[str, int, float]]) – ending datetime of the search. Can be provided as a datetime string, or a Unix timestamp integer or float in either seconds or milliseconds.

  • include_sources (list, optional) – sources to include in the search. Provided as a list of Reference objects or strings representing label, IP list, or workload HREFs, FQDNs, IP addresses, or transmission values. Defaults to [].

  • exclude_sources (list, optional) – sources to exclude from the search. Provided as a list of Reference objects or strings representing label, IP list, or workload HREFs, FQDNs, IP addresses, or transmission values. Defaults to [].

  • include_destinations (list, optional) – destinations to include in the search. Provided as a list of Reference objects or strings representing label, IP list, or workload HREFs, FQDNs, IP addresses, or transmission values. Defaults to [].

  • exclude_destinations (list, optional) – destinations to exclude from the search. Provided as a list of Reference objects or strings representing label, IP list, or workload HREFs, FQDNs, IP addresses, or transmission values. Defaults to [].

  • include_services (list, optional) – traffic flow ServicePort objects to include in the search. Defaults to [].

  • exclude_services (list, optional) – traffic flow ServicePort objects to exclude from the search. Defaults to [].

  • policy_decisions (list, optional) – filters the search based on flow policy decision. List elements must be one of allowed, blocked, potentially_blocked, or unknown. Defaults to [].

  • exclude_workloads_from_ip_list_query (bool, optional) – if True, exclude workload traffic when an IP list is included as a source or destination. Defaults to True.

  • max_results (int, optional) – maximum number of results to return from the search. Defaults to 100000.

  • query_name (str, optional) – query name. Required for async queries. Defaults to None.

Returns:

the constructed traffic query.

Return type:

TrafficQuery

class illumio.explorer.TrafficFlow[source]

Represents a traffic flow to a workload in the PCE.

Raises:

IllumioException – if invalid flow_direction, policy_decision, state, or transmission values are provided.