Plugger — Plugin Framework for Illumio PCE

Plugins

Install with plugger install <name> · Click any plugin for full documentation

⚠️ Plugins marked preview (and example) may not have been tested against a live PCE or the target integration. Validate them in a non-production environment before relying on them.

AI Security Report

AI new

Comprehensive security posture analysis. 10 categories, scoring, compliance mapping (NIST/CIS/PCI-DSS), environment heatmap, AI narratives, PDF export.

plugger install ai-security-report Docs →

AI Assisted Rules

Policy advisor. Tiered rule generation (ringfencing/app-tiered/high-security), infrastructure detection, label gaps. One-click provisioning to PCE draft.

plugger install ai-assisted-rules Docs →

PCE Health Monitor

daemon

Real-time PCE health dashboard. Checks health, node availability, CPU/memory/disk, and service status with color-coded indicators.

plugger install pce-health-monitor Docs →

Traffic Reporter

daemon

Interactive traffic flow analysis with Chart.js. Top talkers, blocked flows, policy decisions, Sankey diagram for source-service-destination.

plugger install traffic-reporter Docs →

Policy Diff

daemon

Git-like policy change tracker. Field-level diffs between draft and active, history snapshots, user attribution from audit events.

plugger install policy-diff Docs →

Policy Resolver

daemon new

Resolve label-based policy into IP-level firewall rules. Expand labels, label groups, IP lists to concrete IPs. JSON/TSV export per ruleset.

plugger install policy-resolver Docs →

PCE Events

daemon

Real-time event monitoring. 15+ output plugins: Slack, Teams, PagerDuty, Email, webhooks, Jira, ServiceNow, Syslog.

plugger install pce-events Docs →

PCE Posture Report

cron

Scheduled security posture scoring. Enforcement coverage, label coverage, policy rules. Generates HTML + JSON reports.

plugger install pce-posture-report Docs →

PCE Expiry Watch

cron new

Warns before PCE service accounts, pairing keys, license, or TLS certificate expire. Daily checks publish to the reporting bus.

plugger install pce-expiry-watch Docs →

Stale Workloads

daemon

Discover offline, unresponsive, and trafficless workloads. Groups by app|env labels. Optional cleanup (unpair/delete).

plugger install stale-workloads Docs →

Rule Scheduler

daemon

Time-based rule and ruleset scheduling. Business hours, maintenance windows, weekend lockdowns. YAML config, immediate reconciliation.

plugger install rule-scheduler Docs →

Palo Alto DAG Sync

daemon untested

Sync Illumio workload labels to Palo Alto Dynamic Address Groups via PAN-OS XML API. Configurable tag format, dry-run mode.

plugger install palo-alto-dag-sync Docs →

AD Label Sync

daemon untested

Discover AD computers via LDAP and map OU, group, location attributes to Illumio labels. Analytics mode for safe feasibility testing.

plugger install ad-label-sync Docs →

Remedy CMDB Sync

daemon untested

Sync BMC Helix/Remedy CMDB CIs to Illumio labels. Maps business service, environment, location to labels. Analytics + sync modes.

plugger install remedy-cmdb-sync Docs →

ZTNA Sync

daemon untested

Sync Illumio workloads to ZTNA application definitions. Supports Zscaler ZPA, Netskope NPA, Cloudflare Access, Cisco Secure Access. Analytics + sync modes.

plugger install ztna-sync Docs →

Infoblox IPAM Sync

daemon untested

Bi-directional sync between Illumio PCE and Infoblox IPAM/DDI. Maps labels to extensible attributes and vice versa. Analytics + sync modes.

plugger install infoblox-ipam-sync Docs →

Workload Isolator

daemon new

Instant workload quarantine via webhook. Isolate compromised workloads, EDR/SOAR integration, auto-release TTL, full audit trail.

plugger install workload-isolator Docs →

VEN Fleet Manager

daemon new

Fleet-level VEN visibility — enforcement progression pipeline, compatibility check tracking, version distribution, batch progression to visibility.

plugger install ven-fleet-manager Docs →

Policy GitOps

daemon external

Git-based policy management. Sync rulesets, IP lists, services, and label groups as YAML between a Git repo and the PCE. Push/pull workflows with drift detection.

External repo → Docs →

Policy Workflow

daemon external

Approval-based policy workflow engine. Multi-stage approval pipelines, Slack/Teams notifications, and audit logging for policy changes. Integrates with Policy GitOps.

External repo → Docs →

App Dependency Intel

daemon new

Dependency intelligence beyond policy — blast radius, SPOF detection, compliance boundaries, change impact analysis, D3.js dependency graph.

plugger install app-dependency-intel Docs →

FortiGate Sync

daemon new

Sync Illumio workloads to FortiGate via RSSO auth table and/or REST API address objects. Multi-group support, based on illumio-to-fortigate-sync by ruckle-o.

plugger install fortigate-sync Docs →

vCenter Sync

daemon untested

Import VMware VMs as unmanaged workloads with labels from vCenter tags and folder hierarchy. Push Illumio labels back as vCenter tags. Analytics + sync modes.

plugger install vcenter-sync Docs →

Network Discovery

daemon new

Scan traffic for unknown IPs, reverse-DNS resolve hostnames, create unmanaged workloads. Subnet filtering, label inference from hostname patterns, dry-run mode.

plugger install network-discovery Docs →

Vulnerability Maps Handler

daemon untested

Import vulnerability scans into Illumio PCE vmaps. Supports Nessus, Qualys, Tenable file uploads and live API pulls. IP-to-workload matching, batch upload, import history.

plugger install vmaps-handler Docs →

Policy Backup

daemon new

Snapshot PCE policy objects and workload inventory to versioned JSON backups, diff over time, and restore to draft policy with a guarded preview.

plugger install policy-backup Docs →

Dragos Sync

daemon new

Sync OT/ICS asset inventory from the Dragos Platform into Illumio as unmanaged workloads with labels for device type, zone, Purdue level, vendor, and criticality.

plugger install dragos-sync Docs →

Nozomi Sync

daemon new

Sync OT/ICS/IoT asset inventory from Nozomi Networks (Vantage or Guardian) into Illumio as unmanaged workloads with labels for type, zone, Purdue level, vendor, and criticality.

plugger install nozomi-sync Docs →

Meraki Sync

daemon new

Imports Cisco Meraki clients into Illumio as labeled unmanaged workloads for visibility (IoT/BYOD/branch devices). Dry-run by default.

plugger install meraki-sync Docs →

ISE Sync

daemon new

Mirrors Cisco ISE TrustSec context (SGT definitions and host IP-SGT mappings) into Illumio as labels and unmanaged workloads. Read-only on ISE, dry-run by default.

plugger install ise-sync Docs →

FlowPilot

daemon new

Collect NetFlow/IPFIX/sFlow/text flows to the Illumio PCE with an ingestion-health dashboard and silent-exporter alerts — runs the FlowPilot collector, no FlowLink install.

plugger install flowpilot Docs →

Changelog

Recent releases and what shipped in each

v0.15.6 latest

October 29, 2026

New Plugins

ise-sync — mirrors Cisco ISE TrustSec context (SGTs and host IP-SGT mappings) into Illumio as labels and unmanaged workloads

v0.15.5

October 29, 2026

New Plugins

meraki-sync — imports Cisco Meraki clients into Illumio as labeled unmanaged workloads for visibility (IoT/BYOD/branch devices)

v0.15.4

October 29, 2026

Features

Splunk HEC output — new splunk output type delivers reports to the Splunk HTTP Event Collector as structured events, with index/sourcetype routing, newline-delimited batch (digest) delivery, and tlsSkipVerify for self-signed lab HEC. Configurable via plugger output add --type splunk.
mock-hec — a stdlib-only Splunk HEC stand-in under tools/mock-hec/ for testing the Splunk output end-to-end without a real Splunk.

Bug Fixes

Health checker false restarts — daemon plugins no longer restart every ~90s; the health probe now resolves the mapped host port per check instead of a stale container port.
Daemon reload crash — fixed a close of closed channel panic that could take the daemon down on plugger reload.
plugger output test — fixed an IPv6 localhost connection-refused; it now dials IPv4 and accepts an --addr override.

Documentation

PCE expiry how-to — end-to-end guide: expiry checks → notification bus → Splunk HEC, with the design rationale for HEC.
Reporting framework — documented the Splunk output and corrected the report-test API endpoint (POST /api/reports/test/{name}).

v0.15.3

October 29, 2026

New Plugins

pce-expiry-watch — warns before PCE service accounts, pairing keys, license, or TLS certificates expire

v0.15.2

October 29, 2026

Features

Global dark/light theme toggle — the Python SDK now injects a light/auto/dark switch into every plugin dashboard. It shares one preference with the management shell (localStorage, same-origin), is framework-independent and idempotent, and can be disabled with Plugin(name, inject_theme=False).
SDK plugins refreshed — dragos-sync, flowpilot, network-discovery, nozomi-sync, policy-backup, stale-workloads, traffic-reporter and vmaps-handler rebuilt to pick up the toggle; their images now publish under ghcr.io/illumio-community.

v0.15.1

October 26, 2026

Bug Fixes

flowpilot collector ports unreachable — the NetFlow/IPFIX/sFlow/syslog UDP ports were published to random host ports, so flows sent to the standard port (e.g. 2055) never reached the collector. They are now published host==container and track their config port (NETFLOW_PORT etc., default 2055/4739/6343/514) — flowpilot 0.2.1.

Features

Manifest portEnv / hostPort — a plugin's metadata.yaml port can now publish on a fixed host port. portEnv makes the port operator-configurable (host==container, tracks the env var, defaults to port); hostPort pins a fixed number. Unset = auto-assign, unchanged for UI/API ports.
Registry self-heal — installs created before the illumio-community move now reconcile the stale official registry URL automatically instead of staying pinned to the old one.

v0.15.0

October 24, 2026

New Plugins

flowpilot — collect NetFlow/IPFIX/sFlow/text flows to the PCE with an ingestion-health dashboard and silent-exporter alerts (preview).

v0.12.1 – v0.14.0

September 14, 2026

Features

vmaps-handler: delete / reset vulnerability data — New dashboard panel + /api/vulns/delete to remove vulnerability data from the PCE (scopes: this plugin's report, all reports, all definitions, or everything), with a confirm guard.
Sync plugins: STALE_ACTION — dragos-sync & nozomi-sync can now report, label (lifecycle=stale), or delete a workload when its asset leaves the leading system.
Prominent extended-docs link — the docs modal now clearly points to each plugin's full README on GitHub (setup, config, troubleshooting).

Bug Fixes

vmaps-handler authoritative — manifests still defaulted AUTHORITATIVE to false (overriding the code), so imports weren't authoritative; now default true everywhere — a scan is the source of truth for its scanned IPs.
pce-posture-report — Slack/email summary read non-existent keys (always showed zeros); now reads the real metrics. Also honors PCE_TLS_SKIP_VERIFY.
pce-health-monitor — /healthz reported healthy regardless of PCE state; now returns the real PCE status in the body (200 kept for liveness).
Maturity correction — palo-alto-dag-sync marked production despite never being validated live → preview.

Documentation

Six expanded plugin READMEs — setup, credentials, full config, troubleshooting for traffic-reporter, palo-alto-dag-sync, pce-health-monitor, stale-workloads, pce-posture-report, rule-scheduler.

v0.12.0

September 9, 2026

New Plugins

nozomi-sync — Sync OT/ICS/IoT asset inventory from Nozomi Networks into Illumio as labeled unmanaged workloads. Supports both Vantage (cloud, API key→JWT, /api/v1/assets) and Guardian/CMC (on-prem, NQL query=assets). Type→role, zone→loc, Purdue level→env, vendor & criticality as custom dimensions; idempotent via external_data_set; DRY_RUN + field-map tuning. preview

Documentation

Per-plugin setup guides — Expanded in-repo READMEs (setup, auth, configuration, troubleshooting) so integrations are easier to stand up and understand.

v0.10.0 – v0.11.0

September 8, 2026

New Plugins

dragos-sync — Sync OT/ICS asset inventory from the Dragos Platform into Illumio as unmanaged workloads with labels (device type→role, zone→loc, Purdue level→env, vendor & criticality as custom dimensions). Idempotent via external_data_set; create-missing labels; DRY_RUN + field-map tuning. preview
policy-backup — Snapshot all PCE policy objects + workload inventory to versioned JSON, diff any two backups (or vs live), and restore to draft policy with a guarded preview (never deletes, never provisions). Retention + optional git push. preview

Features

plugger upgrade --all — Upgrade every outdated plugin in one command; plugger outdated shows how to upgrade one or all.
plugger self-update — Download + checksum-verify the latest CLI release and self-replace; releases now ship SHA256SUMS.
Versioned plugin images — Images tagged with each plugin's own version (immutable), so registry/image/installed version can't drift.

Bug Fixes

plugger logs — Demultiplex Docker's log stream + inject PYTHONUNBUFFERED so plugin logs are present and clean.
pce-events timeouts — Migrate existing configs to add pce_timeout/pce_port; reinstall-from-registry so version upgrades stick.
Preview disclaimer — Portal + README now note that preview/example plugins may be untested against live systems.

v0.9.8 – v0.9.11

June 26, 2026

Features

plugger upgrade --all — Upgrade every plugin that has a newer version in the registry in one command, with per-plugin success/failure reporting. plugger outdated now shows how to upgrade one or all.
Force-rebuild plugin images — The Build Plugin Images workflow gained a force option to refresh version tags from current source (used to correct legacy stale tags).

Bug Fixes

plugger logs now works — Docker's multiplexed log stream is demultiplexed (was emitting binary frame headers), and PYTHONUNBUFFERED=1 is injected into every container so Python plugins stream logs in real time instead of buffering them.
pce-events read timeouts — Existing pce-events configs are now migrated in place to add pce_timeout (120s) and pce_port; the earlier timeout fix only applied to brand-new configs, so existing installs kept hitting the slow events endpoint at the 30s default.

v0.9.4 – v0.9.7

June 25, 2026

Features

Versioned plugin images — Plugin images are now tagged with the plugin's own version (e.g. plugger-vmaps-handler:0.2.2), not just :latest. The registry points at immutable version tags, so the registry, image, and installed version can never drift. CI auto-discovers and builds each plugin when its version is bumped.
plugger self-update — New command downloads the latest CLI release for your OS/arch, verifies it against published SHA256SUMS, and atomically replaces the running binary. Releases now ship a checksums file.
vmaps-handler scanner auto-detect — Uploads no longer require SCANNER_TYPE: the file's format is sniffed from its content (XML root / CSV header). Nessus, Qualys, Tenable.sc, and Tenable.io are recognized.

Bug Fixes

Self-diagnosing imports — vmaps-handler now warns loudly when a scan file parses to zero detections (wrong format, empty, or mismatched scanner type) instead of silently "succeeding".
Upload hardening — path-traversal guard on uploaded filenames; scanner-type-aware file selection so a stray file isn't parsed as the wrong format.

Testing & CI

Plugin test suites in CI — pytest now runs on every push/PR (auto-discovered per plugin). vmaps-handler test coverage expanded from 20 to 80 tests covering the full import pipeline, scanner detection, and handlers.

v0.9.3

June 24, 2026

Documentation

Where to get Docker — Installation guide and handbook now link Docker Desktop, Docker Engine, Colima, Rancher Desktop, and Podman, with a docker version sanity check. Fixed the stale PCE port default (8443 → 443).

v0.9.1

June 24, 2026

Features

Reinstall from registry — Dashboard Update / Update All and CLI plugger upgrade (alias reinstall) now do a true reinstall: pull the image, re-read the manifest + metadata from it, and persist the new version — preserving env overrides and enabled state. Routed through the owning scheduler so updates stick (no restart race).
Update All button — One click updates every outdated plugin; per-plugin failures are reported without aborting the rest.
Persisted update state — The Plugins page remembers which plugins are updateable across reloads (cached server-side), with version badges and an update count.

Bug Fixes

Version-based update detection — The dashboard now flags registry version bumps, not just image digest changes, so local-image plugins surface correctly.
Scheduler clobber race — The daemon scheduler reloads from the store before stop/start, so external manifest changes (upgrade/reinstall) are no longer reverted.
Windows CLI build — Platform-specific file locking (flock on Unix, LockFileEx on Windows) unblocks the Build & Release pipeline.
plugger init — Default port 443, prompts for port and org ID.

v0.9.0

June 24, 2026

Features

Traffic Reporter: squelch/mute rules — Filter noisy flows by service (port/proto), IP, subnet (CIDR), hostname (regex), or policy decision. Full dashboard UI with add/toggle/remove. Squelch count in stats bar.
Customer branding — Serve logo, CSS, and config from ~/.plugger/brand/ at /brand/*. Plugins opt in with one line. No-op when not configured.

Bug Fixes

TLS: enabled: false now works — Previously ignored when self-signed certs existed on disk
pce-events: auto-config port — Added pce_port and pce_timeout to auto-generated config (was defaulting to 8443 instead of 443)
vmaps-handler: authoritative default — Changed to true so scan reports clear old findings

v0.8.6 – v0.8.8

June 18–19, 2026

Features

Beta maturity level — New orange badge for feature-complete but untested plugins. vmaps-handler marked as beta.
Windows build — CI now builds plugger-windows-amd64.exe alongside Linux and macOS binaries

Bug Fixes

plugger init — Default port changed from 8443 to 443, now prompts for port and org ID interactively
vmaps-handler qualys.xml — Verified end-to-end import against poc3 PCE (129/129 detections matched). Previous bugs in constructor args, report body, and XML parsing all fixed in v0.8.3-v0.8.5.

v0.8.1 – v0.8.5

June 17–18, 2026

Features

vmaps-handler debug mode — Debug toggle in UI enables verbose logging, before/after IP matching view, sample vulns, upload results, and "Copy for Issue" button
Log download for all plugins — "Download Logs" link on every plugin detail page, downloads last 1000 lines as text file for issue filing
plugger outdated: self-update check — Queries GitHub releases API to detect newer CLI versions
Detailed plugin READMEs — Full documentation for vmaps-handler, network-discovery, and ai-assisted-rules

Bug Fixes

vmaps-handler constructor args — Fixed xorg_id passing, report metadata fields, process() call removal
vmaps-handler report upload — Strip reference_id from PUT body (PCE schema validation)
Qualys XML recovery — lxml recover=True handles broken CDATA in real-world Qualys exports
Portal docs rendering — Escaped </script> in handbook template literal that broke the entire page

Testing

20 tests for vmaps-handler — Covers Nessus/Qualys/Tenable parsers, IP mapping, workload association, payload format, malformed XML recovery

v0.8.0

June 17, 2026

New Plugin

Vulnerability Maps Handler — Import vulnerability scans from Nessus, Qualys, and Tenable into Illumio PCE vulnerability maps. Supports file uploads (Nessus XML, Qualys XML, Tenable CSV) and live API pulls (Qualys API, Tenable.sc API, Tenable.io API). IP-to-workload matching, batch upload of vuln definitions (1000 per batch), import history dashboard.

v0.7.9

June 16, 2026

Bug Fixes

Handbook docs field names — Fixed config examples in chapters 4 and 5 to match actual Go structs (webhook not webhook_url, filter not filters, smtpHost not smtp_host). Added Teams to output types table.

v0.7.7 – v0.7.8

June 16, 2026

Features

Network Discovery v0.2.0 — Checkboxes and Create buttons on all discovered IPs (including unresolved). DNS resolved on-the-fly when creating. Works in dry-run mode for cherry-picking.
JDS Knob — Orange (not) toggle inverts the status filter on the discovered IPs table
plugger outdated --pull — Pulls latest images, compares digests to detect :latest tag updates. Also shows new plugins in registry not yet installed.

Bug Fixes

Plugin docs accordion — Fixed unmatched backtick in ven-fleet-manager template literal that broke all plugin docs into one block
Config reference — Corrected output field names, added full Output Channel Fields table

v0.7.5 – v0.7.6

June 16, 2026

Features

Dashboard update checker — "Check for Updates" button pulls latest images and compares digests. Orange "update available" badge and Update button appear on outdated plugin tiles. One-click pull + restart.

Bug Fixes

SDK: HTTP server before initial poll — Fixed /healthz returning unreachable during long initial scans. Server now starts first, poll runs in background.

v0.7.4

June 16, 2026

Features

plugger outdated --pull — Pulls latest Docker images and compares digests to detect :latest tag updates. Also shows new plugins available in the registry that aren't installed.

v0.7.3

June 15, 2026

Features

Network Discovery: selectable workload creation — Checkboxes on discovered IPs table, per-row Create button, bulk Create Selected with confirmation. Works in dry-run mode for cherry-picking.
JDS Knob — Orange (not) toggle on the filter dropdown inverts the selection. Filter "Pending" + (not) = everything except pending.
Config reference fix — Corrected output field names in docs, added full Output Channel Fields table with all 4 types (Slack, Teams, email, webhook)

v0.7.1 – v0.7.2

June 15, 2026

Features

Microsoft Teams output — Adaptive Card format with severity colors, fact sets, and batch digest. CLI: plugger output add --type teams --webhook ...
SMTP authentication — Email output now supports authenticated SMTP (user + password via env var). Auth is optional for open relay setups.
Portal updates — Reporting & Outputs and Python SDK featured as top-level capabilities on the landing page

v0.7.0

June 14, 2026

New: Python SDK

plugger_sdk.py — Single-file Python SDK (392 lines) that eliminates ~100-230 lines of boilerplate per plugin. Decorator-based API: @app.poll, @app.api, @app.dashboard
Built-in features — PCE connection, label cache, HTTP server with /healthz, thread-safe state, signal handling, poller loop, report publishing, CORS, PCE console linking
3 plugins migrated — traffic-reporter (673→318 lines, 53% reduction), stale-workloads (591→421, 29%), network-discovery (1161→1012, 13%)

Features

Handbook Ch. 7 — Publishing Your Own Plugin Registry: create registry.json, host via GitHub Pages, register with plugger repo add

v0.6.2

June 13, 2026

Features

Output management via CLI — plugger output add/list/remove/test for Slack, email, and webhook channels with filters, dry-run, and header configuration
Output management via dashboard — Add Output Channel form on /reports page with type-aware fields, stored in outputs.json
4 plugins wired to reporting — network-discovery, pce-posture-report, ai-security-report, and stale-workloads now publish reports to configured output channels
Shared plugger_report.py helper — One-function SDK for plugins to publish reports (fire-and-forget HTTP POST)

v0.6.1

June 13, 2026

Features

Reports dashboard enhanced — Per-output health indicators (green/red), delivery stats (delivered/failed/filtered), Send Test Message button per channel
Unified config page — Edit all plugin settings at /config in one form with Save All & Restart Changed

Documentation

Developer Handbook — 6-chapter guide on the portal: Getting Started, Working with Plugins, Building Your Own, Reporting Framework, Configuration Reference, Operating in Production

Bug Fixes

Fixed config page template crash — State type comparison

v0.6.0

June 13, 2026

New: Reporting & Output Framework

Shared output bus — Plugins publish reports via POST, plugger routes to configured channels. No per-plugin delivery code needed.
Slack output — Block Kit formatted webhooks with severity emoji, plugin context, and tag display
Email output — SMTP with HTML rendering (Catppuccin-styled), supports scheduled digest mode via cron
Webhook output — Generic HTTP with configurable method, headers, and env var expansion
Filters — Route reports by severity, plugin name, and tags (AND logic)
Retry & aggregation — 3x exponential backoff, aggregate buffer for scheduled email digests
Dashboard /reports page — Output health indicators, delivery stats, Send Test Message button per channel

Features

Unified config page — Edit all plugin settings at /config in one form, Save All & Restart Changed
Plugin env injection — PLUGGER_PLUGIN_NAME, PLUGGER_URL, PLUGGER_WEBHOOK_TOKEN auto-injected into every container
Extensible output interface — Implement Output{Name, Type, Send, SendBatch} to add new channel types

Documentation

Developer Handbook — 6-chapter guide from zero to production: Getting Started, Working with Plugins, Building Your Own, Reporting Framework, Configuration Reference, Operating in Production
Reporting framework docs — Full plugin-side and config-side documentation in CLAUDE.md

v0.5.0

June 12, 2026

New Plugin

Network Discovery — Scans traffic flows for bare IPs without workloads, reverse-DNS resolves hostnames, creates unmanaged workloads. Configurable subnet filtering (RFC1918 default), hostname-based label inference via regex rules, dry-run/auto-create modes. Dashboard with discovery funnel, subnet breakdown, DNS performance stats.

Features

Plugin maturity ratings — Four levels (example/preview/prototype/production) for all 24 plugins, with color-coded badges and filter pills on the portal
Breach radius dropdown — Replaced free-text input with live app|env tuples from PCE workloads
VEN Fleet Manager — Idle-to-visibility switch with three modes: compatible only, no known issues, force all
PCE object linking — HREF-to-console URL mapping pattern added to plugin creation guide and Python template

Bug Fixes

Plugin store corruption — Added fsync before rename, flock for cross-process locking, auto-recovery from backup
Stale PCE credentials — Containers now auto-restart when API keys change in config
pce-events auto-config — Generates config.yaml from plugger PCE credentials when none exists

Documentation

Full plugin creation guide (CLAUDE.md) — plugin.yaml, metadata.yaml, Dockerfile, PCE connection, poll intervals, dashboard patterns, Illumio policy concepts

v0.4.0 – v0.4.1 June 11, 2026

New Plugins

FortiGate Sync — Sync Illumio workloads to FortiGate via RSSO (RADIUS SSO) and/or REST API address objects. Based on illumio-to-fortigate-sync by ruckle-o.
vCenter Sync — Bi-directional VMware vCenter sync. Import VMs as unmanaged workloads with labels from tags/folders, push labels back as vCenter tags.

Features

AI Policy Engine — Evolved ai-assisted-rules into full engine: deny layer catalog, breach radius simulation, blocked traffic classification, segmentation maturity model
CI validation — Automated checks for plugin.yaml, metadata.yaml, registry.json, Dockerfile consistency, and CI matrix coverage
Plugin manifests in images — All Dockerfiles now include plugin.yaml for registry install support
Full plugin documentation — README.md for all plugins with configuration, API, and usage details

Bug Fixes

Fixed GHCR image names for external plugins (policy-gitops, policy-workflow)
Added missing workload-isolator to CI build matrix

v0.3.0 June 10, 2026

New Plugins

App Dependency Intel — Dependency analysis beyond policy: blast radius, SPOF detection, compliance boundaries, change impact, resiliency scoring with D3.js force graph
VEN Fleet Manager — Fleet-level VEN visibility with enforcement progression pipeline, compatibility checks, version distribution, and batch operations
Workload Isolator — Instant workload quarantine via webhook API. EDR/SOAR integration, auto-release TTL, audit trail

Features

API authentication — Proxy-level API keys with per-plugin read/write permissions, session cookies, HMAC-signed sessions
Config reload — SIGHUP re-reads config and restarts all plugins with new credentials
Plugger logo — PNG and SVG logo embedded in dashboard and portal

v0.1.0 – v0.2.0 April – May 2026

Initial Release

Go CLI with Cobra/Viper, Docker SDK container management
Plugin lifecycle: install, start, stop, restart, uninstall, list, search
Web dashboard with htmx + Tailwind, reverse proxy to plugin UIs
Health checks with auto-restart, cron scheduling, daemon mode
Plugin registry with GHCR image distribution
Multi-arch Docker builds (amd64/arm64) via GitHub Actions
15 initial plugins: health monitor, traffic reporter, policy diff, posture report, events, AI rules, stale workloads, PAN-OS DAG sync, AD label sync, rule scheduler, AI security report, Remedy CMDB sync, policy resolver, ZTNA sync, Infoblox IPAM sync
Policy GitOps and Policy Workflow as external repo plugins

Plugin Framework forIllumio PCE

Everything you need

plugger run

Web Dashboard

AI-Powered Analysis

Plugin Registry

Reporting & Outputs

Python SDK

How it works

Initialize

Install plugins

Run

Plugins

AI Security Report

AI Assisted Rules

PCE Health Monitor

Traffic Reporter

Policy Diff

Policy Resolver

PCE Events

PCE Posture Report

PCE Expiry Watch

Stale Workloads

Rule Scheduler

Palo Alto DAG Sync

AD Label Sync

Remedy CMDB Sync

ZTNA Sync

Infoblox IPAM Sync

Workload Isolator

VEN Fleet Manager

Policy GitOps

Policy Workflow

App Dependency Intel

FortiGate Sync

vCenter Sync

Network Discovery

Vulnerability Maps Handler

Policy Backup

Dragos Sync

Nozomi Sync

Meraki Sync

ISE Sync

FlowPilot

Changelog

New Plugins

New Plugins

Features

Bug Fixes

Documentation

New Plugins

Features

Bug Fixes

Features

New Plugins

Features

Bug Fixes

Documentation

New Plugins

Documentation

New Plugins

Features

Bug Fixes

Features

Bug Fixes

Features

Bug Fixes

Testing & CI

Documentation

Features

Bug Fixes

Features

Bug Fixes

Features

Bug Fixes

Features

Bug Fixes

Testing

New Plugin

Bug Fixes

Plugin Framework for
Illumio PCE