Introducing the Gigamon Network Observability App: Network-Derived Metadata Built on Cribl’s AI Platform for Telemetry

Artificial intelligence (AI) is changing more than applications. As organizations adopt cloud AI services and private models, they are generating more data in motion across increasingly complex hybrid cloud infrastructure. Copilots, agents, and automated workflows add to that flow.

At the same time, security and operations teams are collecting more telemetry from more sources. They rely on a broad range of tools to understand what is happening across that infrastructure. Simply collecting more data is not the answer. Organizations need the right intelligence delivered to the right tools while maintaining control over cost and complexity.

That is where Gigamon^® and Cribl come together.

The Gigamon Deep Observability Pipeline transforms network traffic into trusted network-derived telemetry. It provides an independent view of activity across hybrid cloud infrastructure. Cribl, the AI Platform for Telemetry, gives organizations choice and control over how telemetry is shaped, routed, retained, searched, analyzed, and used. It also gives them flexibility.

The new Gigamon Network Observability App for Cribl brings these capabilities together. It makes rich application-aware network telemetry easier to put to work across security and operations workflows.

See More of What Is Happening Across the Network

Network traffic provides a unique source of intelligence about how applications interact with devices, users, and infrastructure.

Gigamon Application Metadata Intelligence (AMI) uses deep packet inspection across Layer 4 through Layer 7 traffic to extract application-aware metadata from network traffic. This can include domain name system (DNS) activity, transport layer security (TLS) sessions, and hypertext transfer protocol (HTTP) transactions. It can also include database interactions, file operations, and other application behavior.

Because this intelligence is derived from the network rather than relying on endpoint agents, it can provide visibility into devices and workloads that may otherwise be difficult to instrument. This includes internet of things (IoT) devices and operational technology (OT) devices. It can also cover appliances and other unmanaged systems.

This independent view of data in motion broadens the aperture beyond metrics, events, logs, and traces (MELT). It provides additional context that security and operations teams can use to uncover previously hidden threats, investigate incidents, and identify performance issues.

But as organizations gain access to richer telemetry, another challenge emerges: How do you preserve its value without sending every piece of data to every tool?

Put the Right Intelligence in the Right Place

The complementary strengths of Gigamon and Cribl help address that challenge.

Gigamon transforms network traffic into trusted network-derived telemetry. Cribl helps organizations shape and route that telemetry based on what different teams, tools, and use cases actually need.

With the Gigamon Network Observability App for Cribl, organizations can retain a richer AMI dataset in Cribl Lake. They can direct selected telemetry to security information and event management (SIEM), observability, and other analytics platforms.

This separates two decisions that are often unnecessarily linked: What intelligence should we retain? What does each downstream platform need right now?

Security teams need a focused subset of network-derived telemetry for threat detection. Site reliability engineering (SRE) and observability teams need different information to identify application or performance issues. Investigators need access to broader historical context to reconstruct activity after an incident.

Organizations can preserve valuable network intelligence without requiring every downstream platform to ingest all of it.

Make Network Intelligence Easier to Find and Use

Retaining telemetry has limited value if teams cannot easily find and use it when it matters.

The Gigamon Network Observability App makes AMI accessible through Cribl Search. It provides prebuilt parsing and normalization. It also provides dashboards, saved searches, and investigation workflows designed around network telemetry.

Teams can search Gigamon network-derived telemetry alongside other security and operational data. That includes firewall and identity telemetry. It also includes cloud telemetry. This gives analysts independent network context without requiring all of the underlying data to reside in the same analytics platform.

The app also helps reduce the specialized knowledge traditionally required to work with a large AMI dataset. Instead of knowing which individual attributes to query, analysts can use dashboards and predefined searches. They can also use AI-guided investigation capabilities to explore the underlying data.

The result is easier access to network context for security investigations and performance analysis. It also supports troubleshooting and other operational workflows.

Give Teams and AI Better Context

As organizations introduce AI into security and operations workflows, the quality of the output depends on the quality and context of the data available to it.

Network-derived telemetry provides independent evidence of activity across applications and infrastructure. By making that intelligence easier to retain and search, the Gigamon Network Observability App gives analysts and AI-driven workflows richer context to accelerate investigation and analysis. It can also be combined with other security and operational data.

Maintain Choice, Control, and Flexibility

Cribl is built around giving organizations choice and control over their telemetry. It also gives them flexibility. The integration with Gigamon extends those principles to network-derived intelligence.

Choice means deciding where telemetry goes. Gigamon network-derived telemetry can support multiple destinations, with different data delivered to each based on the use case.

Control means deciding what each platform receives and what to retain. Organizations can shape and normalize telemetry while reducing unnecessary downstream ingestion and preserving richer data for future analysis.

Flexibility means maintaining the freedom to adapt. Teams can add analytics platforms or change destinations. They can also support new security, observability, and AI workflows without redesigning how network intelligence is collected at the source.

That flexibility helps organizations get more value from existing investments while preserving options as their architectures and requirements evolve.

Keep the Intelligence That Matters

As AI and hybrid cloud increase the volume and complexity of data in motion, organizations need more than additional telemetry. They need a way to turn that data into useful intelligence and put it to work where it creates the most value.

Gigamon provides an independent view of network traffic and transforms it into trusted network-derived telemetry. Cribl gives organizations the ability to shape and route that telemetry. It also lets them retain, search, and reuse telemetry on their terms.

The Gigamon Network Observability App brings the two together.

Joint customers can preserve richer network intelligence and reduce unnecessary downstream ingestion. They can increase the value of existing security and observability investments. They can also accelerate investigations while maintaining the flexibility to support new use cases as their infrastructure and AI strategies evolve.

The objective is to keep the intelligence that matters. Put it to work where it creates value. Preserve the freedom to put it to work differently tomorrow.

Ready to see your network traffic differently? The Gigamon Network Observability App is available now in the Cribl Marketplace.

CONTINUE THE DISCUSSION

People are talking about this in the Gigamon Community’s Networking group.

Share your thoughts today