AI is changing more than applications. As organizations adopt cloud AI services, private models, copilots, agents, and automated workflows, they are generating more data in motion across increasingly complex hybrid cloud infrastructure.
At the same time, security and operations teams are collecting more telemetry from more sources and relying on a broad range of tools to understand what is happening across that infrastructure. Simply collecting more data is not the answer. Organizations need the right intelligence, delivered to the right tools, while maintaining control over cost and complexity.
That is where Gigamon and Cribl come together.
The Gigamon Deep Observability Pipeline transforms network traffic into trusted network-derived telemetry, providing an independent view of activity across hybrid cloud infrastructure. Cribl, the AI Platform for Telemetry, gives organizations choice, control, and flexibility over how telemetry is shaped, routed, retained, searched, analyzed, and used.
The new Gigamon Network Observability App for Cribl brings these capabilities together, making rich application-aware network telemetry easier to put to work across security and operations workflows.
See more of what is happening across the network
Network traffic provides a unique source of intelligence about how applications, devices, users, and infrastructure are interacting.
Gigamon Application Metadata Intelligence (AMI) uses deep packet inspection across Layer 4 through Layer 7 traffic to extract application-aware metadata from network traffic. This can include information about DNS activity, TLS sessions, HTTP transactions, database interactions, file operations, and other application behavior.
Figure 1: Gigamon AMI provides application-aware network metadata that teams can explore and analyze through Cribl.
Because this intelligence is derived from the network rather than relying on endpoint agents, it can provide visibility into devices and workloads that may otherwise be difficult to instrument, including IoT and OT devices, appliances, and other unmanaged systems.
This independent view of data in motion broadens the aperture beyond metrics, events, logs, and traces (MELT), providing additional context that security and operations teams can use to uncover previously hidden threats, investigate incidents, and identify performance issues.
But as organizations gain access to richer telemetry, another challenge emerges: how do you preserve its value without sending every piece of data to every tool?
Put the right intelligence in the right place
The complementary strengths of Gigamon and Cribl help address that challenge.
Gigamon transforms network traffic into trusted network-derived telemetry. Cribl helps organizations shape and route that telemetry based on what different teams, tools, and use cases actually need.
With the Gigamon Network Observability App for Cribl, organizations can retain a richer AMI dataset in Cribl Lake while directing selected telemetry to SIEM, observability, and other analytics platforms.
This separates two decisions that are often unnecessarily linked: What intelligence should we retain? And what does each downstream platform need right now?
Security teams need a focused subset of network-derived telemetry for threat detection. SRE and observability teams need different information to identify application or performance issues. Investigators need access to broader historical context to reconstruct activity after an incident.
Organizations can preserve valuable network intelligence without requiring every downstream platform to ingest all of it.
Figure 2: The Gigamon Deep Observability Pipeline transforms network traffic into trusted network-derived telemetry that Cribl can shape, route, retain, search, and analyze.
Make network intelligence easier to find and use
Retaining telemetry has limited value if teams cannot easily find and use it when it matters.
The Gigamon Network Observability App makes AMI accessible through Cribl Search and provides prebuilt parsing, normalization, dashboards, saved searches, and investigation workflows designed around network telemetry.
Teams can search Gigamon network-derived telemetry alongside other security and operational data, including firewall, identity, and cloud telemetry. This gives analysts independent network context without requiring all of the underlying data to reside in the same analytics platform.
The app also helps reduce specialized knowledge traditionally required to work with a large AMI dataset. Instead of knowing which individual attributes to query, analysts can use dashboards, predefined searches, and AI-guided investigation capabilities to explore the underlying data.
The result is easier access to network context for security investigations, performance analysis, troubleshooting, and other operational workflows.
Figure 3: Cribl helps teams use network-derived telemetry to visualize relationships and investigate activity across applications and infrastructure.
Give teams and AI better context
As organizations introduce AI into security and operations workflows, the quality of the output depends on the quality and context of the data available to it.
Network-derived telemetry provides independent evidence of activity across applications and infrastructure. By making that intelligence easier to retain, search, and combine with other security and operational data, the Gigamon Network Observability App gives analysts and AI-driven workflows richer context to accelerate investigation and analysis.
Figure 4: Network-derived telemetry can provide visibility into AI application activity, giving teams additional context for security, governance, and investigation workflows.
Maintain choice, control, and flexibility
Cribl is built around giving organizations choice, control, and flexibility over their telemetry. The integration with Gigamon extends those principles to network-derived intelligence.
Choice means deciding where telemetry goes. Gigamon network-derived telemetry can support multiple destinations, with different data delivered to each based on the use case.
Control means deciding what each platform receives and what to retain. Organizations can shape and normalize telemetry while reducing unnecessary downstream ingestion and preserving richer data for future analysis.
Flexibility means maintaining the freedom to adapt. Teams can add analytics platforms, change destinations, or support new security, observability, and AI workflows without redesigning how network intelligence is collected at the source.
That flexibility helps organizations get more value from existing investments while preserving options as their architectures and requirements evolve.
Keep the intelligence that matters
As AI and hybrid cloud increase the volume and complexity of data in motion, organizations need more than additional telemetry. They need a way to turn that data into useful intelligence and put it to work where it creates the most value.
Gigamon provides an independent view of network traffic and transforms it into trusted network-derived telemetry. Cribl gives organizations the ability to shape, route, retain, search, and reuse that telemetry on their terms.
The Gigamon Network Observability App brings the two together.
Joint customers can preserve richer network intelligence, reduce unnecessary downstream ingestion, increase the value of existing security and observability investments, accelerate investigations, and maintain the flexibility to support new use cases as their infrastructure and AI strategies evolve.
The objective is not to send everything everywhere. It is to keep the intelligence that matters, put it to work where it creates value, and preserve the freedom to put it to work differently tomorrow.
Ready to see your network traffic differently? The Gigamon Network Observability App is available now in the Cribl Marketplace.
