Use AI Labeling

Overview

Through machine learning, Illumio recommends day-one labels for select resources. The following are points to consider:

  • At time of writing, CloudSecure​​ supports AI labeling on AWS resources only. At time of writing, this feature is available for US cloud resources only Contact your Customer Success or Account team to request access to this feature.

  • At time of writing, AI label recommendations are for role labels only
  • The first time you use this feature, you need to acknowledge the dialog that appears
  • Optionally, you can accept, deny, or ignore the label recommendation, which can be in an Accepted, Denied, or Pending state

Use AI Labeling

To get started from the left navigation pane, browse to Labels > AI Labels tab.

The tab presents tiles listing your application and non-application resources that have pending AI recommended labels. The tile for application resources provides context about which resources belong to the applications that have the recommendation. The tile for non-application resources suggests labels for resources that do not yet belong to applications, which can help with visibility and rule-writing. The recommendations update every 24 hours.

The tab also presents a table listing the individual recommendations. You can filter by application to narrow the list of visible recommendations. You can also filter by Pending, Approved, or Denied, by clicking the respective buttons above the filter dropdown menu.

  1. For the application of interest, hover over the label to view the label details, including the reason for the recommendation. You can also hover over the resource to see its details. You can copy the details of the resource or the label from the hover dialog. Note that a listed resource may have more than one entry, with each one recommending a different label.
  2. Select the application/resource listings with the recommended labels that you want to apply.
  3. For bulk approval or denial, click Approve or Deny above the filter dropdown menu. Note that you can bulk approve only pending recommendations. For individual approval or denial, you do not need to select the application/resource listing. Instead, click the vertical breadcrumb icon at the end of the row and click Approve or Deny.
  4. If you click Approve, a message notifies you that the label has been applied to the resource, and the recommendation moves to the end of the list. Note that if you approve a label, CloudSecure will cease recommending that specific label for that resource.

    If you have an existing label on the resource, a confirmation dialog lets you approve overriding the existing label. See Guidelines below for more information.
  5. If you click Deny, a message notifies you that the label has been denied for the resource, and the recommendation moves to the end of the list.
    You can review a denied label by clicking Denied above the filter dropdown menu.

Guidelines

Keep the following guidelines in mind when you use the AI labeling feature:

  • You can revise your decisions
    • If you approved a label that you later decide to deny, click Approved above the filter dropdown menu. Then select the label and click Deny.
    • If you denied a label that you later decide to approve, click Denied above the filter dropdown menu. Then select the label and click Approve.

  • ​You can hover over AI recommended labels to see details such as who denied or approved it, when they did so, why it may have been recommended, etc.

  • If a resource already has a role label created by Tag to Label Mapping, and CloudSecure recommends a new role label for it, a yellow exclamation point displays for that recommendation. This exclamation point provides the context for the existing and recommended Role label value to inform your approval decisions. (Before making the approval decision, you must take into account whether existing policies are using the existing label.) If you choose to approve the recommendation, a dialog tells you that approving the recommendation removes the existing label in the process of applying the recommended one. Once the approval action is taken, the AI will not recommend the role label for the resource again.