See Everything, Chase Nothing: What's New in Illumio Insights

Security teams have spent years working with limited visibility.

Many security tools focus on the network perimeter. But modern attackers rarely break in through the front door. They move quietly through east-west traffic, jumping from system to system until they reach critical assets.

Illumio Insights was built to solve this problem. It helps security teams see how traffic moves across their environments. With the latest release, the platform becomes even more useful for the teams that depend on it each day.

This update introduces three key improvements:

• VEN Insights provides deeper visibility into traffic inside private data centers. ‍
• Traffic Rules filter out noise so analysts can focus on the activity that matters most. ‍
• Label Insights adds clear business context to threat investigations.

Together, these capabilities help defenders focus on real threats. Security teams spend less time sorting through data and more time stopping attacks.

VEN Insights: illuminating your private data center

For organizations running workloads on-premises, east-west traffic has long been one of the hardest areas to monitor.

Firewall logs show what crosses the network perimeter. But they rarely show how systems communicate inside the environment. That internal traffic is exactly what attackers use to move laterally, escalate privileges, and reach critical systems.

VEN Insights closes this gap by extending Illumio Insights flow telemetry into the private data center.

It ingests data from Illumio virtual enforcement nodes (VENs) and correlates it with firewall flows. This gives security teams the same rich visibility into on-premises environments that they expect in the cloud.

With VEN Insights, analysts can analyze network traffic patterns using flows from VENs and firewalls for full visibility.

Security teams can uncover east-west activity that was previously hidden. For example, production systems may be communicating with non-production environments in ways that violate policy. Critical assets may receive unexpected inbound connections. High-risk services may be running inside the data center without proper awareness.

Instead of relying on firewall logs that only show part of the story, VEN Insights provides a complete view of internal traffic. It also adds the context needed to understand why communication patterns matter.

For security operations teams that struggle to connect on-premises activity with cloud telemetry, VEN Insights creates a unified view of the environment. This makes it far easier to detect risky behavior and investigate potential lateral movement.

Traffic rules: high signal, low noise

Every security platform collects large amounts of network flow data. The challenge isn’t collecting the data but focusing on what matters.  

Without a clear way to filter signals from noise, analysts can easily become overwhelmed.

Insights Traffic Rules address this problem by giving security teams control over which flows appear in their analysis and which ones are hidden.

For example, teams can drop inbound traffic to load balancers and network address translation (NAT) gateways. They can exclude north-to-south flows to keep investigations focused on lateral east-west movement. They can also filter synthetic traffic, scans, or penetration testing flows so Insights only highlights real activity.

This clarity has a direct impact on security operations.  

When analysts trust the data in front of them, they move faster. They spend less time wondering whether alerts are false positives and more time investigating real threats.

Traffic Rules give security teams control over the shape of their data, not just access to it. Investigations become more focused. Escalations become more confident. Response times improve.

When combined with Insights AI-driven threat scoring, this clearer signal helps security teams move from detection to containment much faster.

Label Insights: context is everything

Raw IP addresses and port numbers show where traffic goes. But they don’t show whether the activity matters.

Label Insights closes this gap by adding business details to network activity across hybrid environments. It brings information such as environment tiers, application owners, compliance scope, and location directly into the investigation view.

When an analyst sees a spike in traffic between two workloads, Label Insights shows the labels that describe those systems in clear business terms. For example, it may show Staging talking to Production, PCI systems connecting to Retail apps, or a Marketing system using RDP.

This context turns a basic network anomaly into a clear security story.

Analysts can quickly see the possible blast radius and understand the compliance impact. They can also explain what is happening to business leaders without searching through asset databases or other documentation.

Why these updates matter now

Modern attacks move fast. Once an attacker gains a foothold, they rarely stop at one system.  

They move laterally, searching for the assets that matter most. The longer that movement goes unseen, the larger the breach becomes.

Security teams can’t afford blind spots inside their environments. They need clear visibility into how systems communicate, strong signal in their data, and business context that explains why activity matters.

That is exactly what these Insights updates deliver.

VEN Insights brings visibility into private data centers where east-west movement has long been hard to see. Traffic Rules remove noise so analysts can focus on real activity. Label Insights adds the business context needed to understand risk and act with confidence.

Together, these capabilities help security teams move faster from detection to action. Instead of chasing alerts and guessing at impact, analysts can see the environment clearly and respond with precision.

In modern security operations, clarity is speed. And speed is what stops attacks before they spread.

Ready to see your environment clearly? Experimente o Illumio Insights gratuitamente. to bring full hybrid visibility to your network and security teams.