Plugger is the agent-native Illumio plugin framework: it is designed to be built and operated by AI coding agents as well as humans. Agents like Claude Code scaffold and author plugins through the build-plugin skill, drive the dashboard, HTTP APIs and reporting bus, and the Python SDK keeps a working plugin to roughly 50 lines.
Concretely, Plugger is a Go CLI that manages Illumio PCE extensions as Docker containers — install, schedule, health-check, auto-restart, and expose them through a unified web dashboard. Includes a Python SDK for rapid plugin development and a shared reporting bus (Slack/Teams/email/webhook). No patch cycles. No custom integrations hardwired into your environment. Just plugger install <name> && plugger run.
An Illumio community project, created by Alex Goller, Illumio Solutions Architect.
Quick Start
# 1. Build
git clone https://github.com/illumio-community/illumio-plugger
cd illumio-plugger && make build
# 2. Initialize — writes ~/.plugger/config.yaml with PCE connection details
plugger init
# 3. Install a plugin and start everything
plugger install ai-security-report
plugger run
Dashboard opens at http://localhost:8800. Registry browser at http://localhost:8800/registry.
Plugin Highlights
AI Security Report
Connects to your PCE, analyzes workload posture across 10 security dimensions, maps findings to NIST CSF and PCI-DSS controls, and produces a scored HTML report with a remediation roadmap. No manual data gathering — point it at your PCE and read the output.
plugger install ai-security-report && plugger run
# Report appears at http://localhost:8800/ai-security-report
Workload Isolator
Exposes a webhook endpoint. When CrowdStrike, Splunk SOAR, or any EDR signals a compromise, it flips the workload into selective enforcement, cutting lateral movement in seconds. Optional TTL auto-releases after investigation.
plugger install workload-isolator
# POST /isolate {"hostname": "web-prod-07"} → quarantined
Policy Resolver
Translates Illumio's label-based policy into concrete IP-level firewall rules your network team can read. Useful for audits, firewall migration projects, and proving to a skeptical network engineer that your segmentation policy actually does what you think it does.
App Dependency Intelligence
Analyzes PCE traffic flows to build an application dependency graph. Surfaces blast radius (what breaks if this service goes down), single points of failure, compliance boundary crossings, and resiliency scores. Built on D3.js — the visualization is interactive.
All 31 Plugins
⚠️ Maturity note: plugins marked preview (and example) may not have been tested against a live PCE or the target integration. Validate them in a non-production environment before relying on them.
Monitoring & Visibility
| Plugin | Description | Mode |
|---|
| pce-health-monitor | Real-time PCE health dashboard — endpoint checks, CPU/memory/disk | Daemon + UI |
| traffic-reporter | Interactive traffic flow analysis — top talkers, blocked flows, Sankey diagram | Daemon + UI |
| policy-diff | Git-like policy change tracker — field-level diffs, user attribution, audit trail | Daemon + UI |
| pce-events | Real-time PCE event fan-out — Slack, Teams, PagerDuty, Email, 15+ outputs | Daemon + UI |
| ven-fleet-manager | VEN fleet visibility — enforcement progress, compatibility, version distribution, upgrade readiness | Daemon + UI |
| pce-expiry-watch | Warns before PCE service accounts, pairing keys, license, or TLS certificate expire — daily checks publish to the reporting bus | Cron |
| stale-workloads | Find offline, unresponsive, and traffic-silent workloads — with optional cleanup | Daemon + UI |
| network-discovery | Scan traffic for bare IPs, reverse-DNS, create unmanaged workloads | Daemon + UI |
AI & Security Analysis
| Plugin | Description | Mode |
|---|
| ai-security-report | AI-powered security posture scoring across 10 categories — NIST/PCI mapping, heatmap, roadmap | Daemon + UI |
| ai-assisted-rules | Policy advisor — blocked traffic analysis, tiered rule generation, label gap detection, LLM recommendations | Daemon + UI |
| pce-posture-report | Enforcement coverage, label coverage, policy rules scoring — HTML+JSON output | Cron |
| app-dependency-intel | Application dependency graph — blast radius, SPOF detection, resiliency scoring, D3.js visualization | Daemon + UI |
| vmaps-handler | Import vulnerability scans into PCE vmaps — Nessus, Qualys, Tenable | Daemon + UI |
Policy Management
| Plugin | Description | Mode |
|---|
| policy-resolver | Resolve label-based policy to IP-level firewall rules — JSON export, searchable dashboard | Daemon + UI |
| rule-scheduler | Time-based rule scheduling — business hours, maintenance windows, weekend lockdowns | Daemon + UI |
| workload-isolator | Webhook-triggered workload quarantine — EDR/SOAR integration, TTL auto-release, audit trail | Daemon + UI |
| policy-gitops | Policy-as-code — sync rulesets/IP lists/services as YAML to Git with drift detection (standalone repo) | Daemon + UI |
| policy-workflow | Approval workflow engine — multi-stage pipelines, Slack/ServiceNow integration, audit log | Daemon + UI |
| policy-backup | Snapshot PCE policy objects and workload inventory to versioned JSON backups, diff over time, restore to draft with guarded preview | Daemon + UI |
Integrations
| Plugin | Description | Mode |
|---|
| palo-alto-dag-sync | Sync Illumio labels to Palo Alto Dynamic Address Groups via PAN-OS XML API | Daemon + UI |
| ztna-sync | Sync workloads to ZTNA apps — Zscaler ZPA, Netskope NPA, Cloudflare Access, Cisco Secure Access | Daemon + UI |
| infoblox-ipam-sync | Bi-directional sync between Illumio labels and Infoblox extensible attributes | Daemon + UI |
| remedy-cmdb-sync | Sync BMC Helix/Remedy CMDB CIs to Illumio labels — analytics mode for feasibility testing | Daemon + UI |
| ad-label-sync | Discover AD computers via LDAP, map OU/group/location attributes to Illumio labels | Daemon + UI |
| fortigate-sync | Sync to FortiGate via RSSO + REST API | Daemon + UI |
| vcenter-sync | Bi-directional VMware vCenter sync | Daemon + UI |
| dragos-sync | Sync OT/ICS asset inventory from the Dragos Platform to labeled unmanaged workloads | Daemon + UI |
| nozomi-sync |
Plugin Registry
plugger search # List all available plugins
plugger search monitoring # Filter by keyword
plugger install pce-health-monitor # Install from registry
plugger outdated # Check for updates
plugger upgrade traffic-reporter # Pull latest, restart
plugger repo add myco https://internal.example.com/registry.json # Custom registry
The web dashboard at http://localhost:8800/registry lets you browse, filter, and install with one click.
Custom registries: host a registry.json at any URL using the same format as the official registry.
Building Plugins
Scaffold a new plugin in any supported language:
plugger create -t python my-plugin # Python (most existing plugins)
plugger create -t go my-plugin # Go with Illumio SDK
plugger create -t shell my-plugin # Shell script
Each template includes a plugin.yaml manifest, health endpoint, Illumio credential injection, and a working Dockerfile. See Plugin Development.
Python SDK
Plugins written in Python can use plugger_sdk.py to eliminate boilerplate:
from plugger_sdk import Plugin
app = Plugin("my-plugin")
@app.poll(interval_env="POLL_INTERVAL", default=3600)
def work(pce):
app.state["data"] = pce.get("/workloads").json()
@app.api("GET", "/api/data")
def get_data(request):
return app.state
@app.dashboard
def render():
return "<html>...</html>"
app.run()
The SDK handles PCE connection, health endpoints, state management, scheduled polling, API routing, and report publishing via the shared output bus.
Reporting & Outputs
Plugins publish reports to a shared bus. Plugger routes to Slack, Teams, email, or webhooks.
plugger output add my-slack --type slack --webhook https://hooks.slack.com/...
plugger output add my-teams --type teams --webhook https://outlook.office.com/...
plugger output list
plugger output test my-slack
How It Works
Plugger runs each plugin as a Docker container with a declarative manifest:
# plugin.yaml
apiVersion: plugger/v1
name: my-plugin
schedule:
mode: daemon # daemon | cron | event
env:
- name: POLL_INTERVAL
default: "3600"
health:
endpoint: /healthz
port: 8080
plugger run reads all installed manifests, starts containers, injects PCE credentials, proxies plugin UIs under a single port, streams logs, and restarts failed containers with exponential backoff.
Three scheduling modes:
daemon — runs continuously, auto-restart on crashcron — runs on a schedule (e.g., nightly reports)event — ephemeral container triggered by webhook (incident response, PCE events)
Documentation
| Guide | Description |
|---|
| Getting Started | First-time setup walkthrough |
| Installation & Configuration | Prerequisites, config options, Docker socket, networking |
| CLI Reference | All commands and flags |
| Plugin Development | Manifests, templates, health checks, publishing |
| Operations Guide | Production deployment, monitoring, troubleshooting |
| Event-Driven Architecture | Webhook triggers, pce-events integration, auth |
| PCE Expiry Monitoring | How-to: alert on expiring service accounts, pairing keys, license, TLS cert via Slack and Splunk |
| Meraki Device Visibility | How-to: bring IoT, BYOD and branch devices seen by Meraki into the Illumio map as labeled unmanaged workloads |
| ISE TrustSec Sync | How-to: mirror Cisco ISE SGTs as Illumio labels and host IP-SGT mappings as workloads |
Plugin Portal: illumio-community.github.io/illumio-plugger
Policy-as-Code (standalone): illumio-policy-gitops
License
Apache 2.0
