Gigamon Metadata Application For Splunk

The Gigamon Metadata Application for Splunk allows customers to easily select, index and display network metadata generated by the GigaSECURE Security Delivery Platform. The GigaSECURE Security Delivery Platform allows users to extract and consolidate metadata from any monitored network traffic flows, package them into NetFlow v5, v9, IPFIX and CEF records, then send them to Splunk Enterprise for indexing. Gigamon has enriched the Metadata records with information including URL information, HTTP/HTTPS return codes, and DNS query/response information, all of which provide the ability to rapidly diagnose security events for use cases such as, identifying rogue DNS services, spotting potential Command and Control server communications using high entropy domains and detecting use of non trusted or self-signed certificates for SSL-decrypted traffic that could indicate nefarious activity.