Introducing Integration Between Gigamon and Google Security Operations

Gigamon introduces a new integration with Google Security Operations to help security teams close critical visibility gaps across hybrid cloud environments. As organizations rapidly adopt AI applications, new traffic patterns and shadow AI activity are making those gaps harder to detect and investigate.

Security operations teams are not short on tools. What they often lack is complete, reliable visibility into what is happening across their infrastructure. As environments become more distributed and encrypted, key activity increasingly lives in East-West traffic, encrypted communications, and areas where agents are limited or inconsistent.

This week at Google Cloud Next 2026, we will showcase how Google Security Operations provides the analytics and automation to detect and respond to threats at scale. Our new integration extends those capabilities by bringing high-fidelity network-derived telemetry from the Gigamon Deep Observability Pipeline directly into Google Security Operations. This gives teams the context they need to detect threats earlier and investigate with greater precision.

What’s New: Integration With Google Security Operations

The new integration enables Gigamon to deliver enriched network-derived telemetry into Google Security Operations, where it is ingested and normalized for use across detections, dashboards, investigations, and response workflows.

At the center of this integration is Gigamon Application Metadata Intelligence (AMI).

AMI extracts application-level insights from network traffic, including packets, flows, and encrypted sessions. Using Gigamon Application Metadata Exporter (AMX), this data is converted into structured metadata and delivered via API into Google Security Operations. It can then be searched, correlated, and operationalized alongside existing log and endpoint telemetry.

The goal is not to send more data. It is to send data that adds context so security teams can act on it without additional processing.

Why AMI Matters for Security Operations Teams

Most security operations platforms depend heavily on logs and agent-based telemetry. While essential, those signals do not always capture what is happening within the network.

Gigamon AMI provides a complementary perspective by turning network activity into actionable metadata. It reveals how systems communicate, how applications behave, and where activity starts to deviate from expected patterns across North-South and East-West traffic, including encrypted communications.

Because this metadata is already structured and enriched before it reaches Google Security Operations, analysts can work with it immediately. They do not need to reconstruct context from raw data or pivot across multiple tools.

This is especially important in environments where:

• Traffic is encrypted
• Workloads are dynamic and distributed
• Agent coverage is incomplete or inconsistent

By bringing AMI-derived telemetry into Google Security Operations, organizations gain visibility into areas that are often difficult to monitor. This helps teams validate alerts, uncover hidden activity, and build a more complete picture of what is happening across their environment.

Key Use Cases: Applying Gigamon AMI Within Google Security Operations

1. Detecting Lateral Movement and Hidden Threats

Attackers often move laterally across systems using legitimate pathways, making their activity difficult to distinguish from normal behavior. AMI exposes communication patterns across the network by capturing interactions between systems at the application level.

Within Google Security Operations, teams can identify unusual connections, correlate activity across environments, and strengthen detection across internal traffic flows.

2. Gaining Insight Into Encrypted Traffic and Certificate Posture

Encrypted traffic now makes up the majority of network activity, but it can limit visibility for traditional tools. AMI extracts metadata from encrypted sessions, including certificate and protocol details. This provides insight into traffic behavior without requiring full decryption in every case. Teams can identify weak configurations, detect anomalies, and improve encryption posture within Google Security Operations workflows.

3. Accelerating Investigation and Root-Cause Analysis

When alerts are triggered, the first challenge is quickly understanding what happened. AMI adds context that helps analysts trace activity across systems, including where traffic originated, how it moved, and which applications were involved. By correlating this data within Google Security Operations, teams can validate alerts faster, reduce investigation time, and move to response with greater confidence.

4. Discovering AI Applications and Shadow AI Activity

AMI enables security teams to identify and classify AI applications running on the network, including unmanaged or unauthorized usage. This provides visibility into shadow AI activity and supports stronger governance and risk management.

Gigamon Provides Network Visibility to Improve Security Operations

As security teams continue to scale their use of Google Security Operations, incorporating high-fidelity network-derived telemetry becomes increasingly important.

The integration with Gigamon and Google Security Operations  brings this capability directly into the platform, using AMI to transform network traffic into structured, actionable security context. The result is broader visibility across hybrid environments, stronger detections, and faster investigations. To learn more, explore the joint solution brief and deployment guide in the Gigamon Resource Library.

CONTINUE THE DISCUSSION

People are talking about this in the Gigamon Community’s Security group.

Share your thoughts today