TL;DR
| Supported data types | 3rd party detection | Hunters detection | IOC search | Search | Table name | Log format | Collection method |
|---|---|---|---|---|---|---|---|
| Illumio Active Directory User Export | ✅ | illumio_active_directory_user_export |
CSV (with header) | S3 |
Overview
Illumio is a micro-segmentation and Zero Trust security platform that controls east-west traffic between workloads based on labels and policies. While Illumio's core product generates PCE (Policy Compute Engine) audit and traffic flow events, this integration ingests a CSV export of Active Directory user object attributes — such as account status, group memberships, organizational unit placement, password state, and SID — likely collected as part of an identity/context data feed used to enrich Illumio's workload and user-based policy decisions. These records capture the full set of AD user properties, including account lockout state, password expiration, distinguished name, group memberships, and employee metadata. Ingesting this data into Hunters allows security teams to correlate user identity, privilege, and organizational context with network and workload activity, detect stale or risky accounts (including service and administrative accounts), and support identity-based segmentation and access reviews.
Supported data types
Illumio Active Directory User Export
Table name: illumio_active_directory_user_export
This data type contains Active Directory user object attributes exported as part of the Illumio identity/context data feed, including account identifiers (SID, GUID, SAM account name), account status flags (enabled, locked out, password expired/never expires), organizational attributes (department, title, manager, distinguished name), and group membership (memberof). It is useful for correlating identity and privilege context with workload and network activity, and for identifying stale, privileged, or risky accounts (e.g., service accounts with non-expiring passwords or administrative accounts).
Expected format
Logs are expected in CSV (with header) format.
"2021-03-02T00:00:00","132591168000000000","2026-10-30T17:38:48","3","True","corp.local/_Disabled/Accounts User/Mailbox Disabled/TMGuest","Microsoft.ActiveDirectory.Management.ADPropertyValueCollection",,"TMGuest",,,"2001-08-18T09:55:59",,"Built-in account for guest access to the computer/domain",,"CN=TMGuest,OU=Mailbox Disabled,OU=Accounts User,OU=_Disabled,DC=corp,DC=local",,,,,"False","TMGuest",,,"2026-10-30T17:38:48","2017-09-29T16:07:08","True",,"","2026-10-30T17:38:48","TMGuest","CN=Person,CN=Schema,CN=Configuration,DC=corp,DC=local","user","c2031425-4657-48a9-1304-152637485960","S-1-5-21-11111111-2222222222-333333333-4010",,,,"False","2017-09-29T16:15:58","True","False","131511753588455237","TMGuest","805306368","S-1-5-21-11111111-2222222222-333333333-4010",,,,,"2026-10-30T17:38:48"
Send data to Hunters
Hunters supports the collection of Illumio Active Directory User Export logs using Amazon S3.
To connect Illumio logs:
- Route Illumio Active Directory User Export (AD identity) CSV logs into an AWS S3 bucket.
- Once logs are in S3, follow the steps in this section.