Gigamon Insight Add-on for Splunk
Overview
Details
The Gigamon Insight Splunk Add-on allows administrators to incorporate the network telemetry data collected and analyzed by the Gigamon Insight solution into their Splunk deployment. This add-on leverages Insight’s fully RESTful APIs to interact with the cloud backend to introduce specific data sets into Splunk. With this add-on, the Insight Query Language (IQL) can be used to import specific network events (such as HTTP, DNS, SMB, Kerberos, Suricata, and more) and all the associated metadata into Splunk. After the initial import, the add-on will periodically poll Insight at a specified interval for new match events to import. Detections and reports generated by Insight can also be imported, and the add-on will periodically poll Insight at a specified interval for new detections and reports to import. Enrichment and intelligence can also be imported for specified entities, such as WHOIS information, VirusTotal reports, Passive DNS records, and DHCP records.
Gigamon Insight Add-on for Splunk
Table of Contents
OVERVIEW
- About the Gigamon Insight Add-on for Splunk
- Release notes
- Support and resources
INSTALLATION AND CONFIGURATION
- Hardware and software requirements
- Installation steps
- Deploy to single server instance
USER GUIDE
- Data types
- Lookups
About the Gigamon Insight Add-on for Splunk
| Author | Gigamon |
| Vendor Products | Insight |
| Has index-time operations | true |
| Create an index | true |
| Implements summarization | false |
The Gigamon Insight Add-on for Splunk allows a Splunk® Enterprise administrator to integrate the features and functionality of the Insight solution with their existing Splunk deployment. The add-on leverages Insight’s fully RESTful APIs to interact with the Insight backend to introduce specific data sets into Splunk. This document contains all the necessary information to configure and install the add-on.
Release notes
- Please see add-on documentation here: https://insight.gigamon.com/help/api/apidocs-splunk
New features
- Please see add-on documentation here: https://insight.gigamon.com/help/api/apidocs-splunk
Fixed issues
- Please see add-on documentation here: https://insight.gigamon.com/help/api/apidocs-splunk
Known issues
- Please see add-on documentation here: https://insight.gigamon.com/help/api/apidocs-splunk
Third-party software attributions
- Please see add-on documentation here: https://insight.gigamon.com/help/api/apidocs-splunk
Support and resources
Access questions and answers specific to the Gigamon Insight Add-on for Splunk at https://insight.gigamon.com/help/api/apidocs-splunk.
Support
Contact your Gigamon Insight technical account manager for additional support.
https://insight.gigamon.com/help/api/apidocs-splunk
INSTALLATION AND CONFIGURATION
Hardware and software requirements
Hardware requirements
Gigamon Insight Add-on for Splunk supports the following server platforms in the versions supported by Splunk Enterprise:
- Hardware independent
Software requirements
To function properly, Gigamon Insight Add-on for Splunk requires the following software:
- Splunk 8.0.0 or higher
Splunk Enterprise system requirements
Because this add-on runs on Splunk Enterprise, all of the Splunk Enterprise system requirements apply.
Download
Download the Gigamon Insight Add-on for Splunk at https://insight.gigamon.com/help/api/apidocs-splunk
Installation steps
To install and configure this app on your supported platform, follow these steps:
- Navigate in the Splunk interface to the Manage Apps page.
- Click on the Install app from file button.
- Click the Choose File button and select the Gigamon Insight Add-on for Splunk file.
- Click the Upload button.
- In the Splunk apps list, select the Gigamon Insight Add-on for Splunk app to begin configuration.
Deploy to single server instance
Follow these steps to install the app in a single server instance of Splunk Enterprise:
- Navigate in the Splunk interface to the Manage Apps page.
- Click on the Install app from file button.
- Click the Choose File button and select the Gigamon Insight Add-on for Splunk file.
- Click the Upload button.
- In the Splunk apps list, select the Gigamon Insight Add-on for Splunk app to begin configuration.
USER GUIDE
Configuration Settings
Add-on Global Settings
| API Token | This is a required global parameter that will be used in all input types. It is the API token that can be created on your Insight profile settings page. All Insight API calls require a token for authentication. Tokens never expire and will remain valid until revoked. |
Data types
- Please see add-on documentation here: https://insight.gigamon.com/help/api/apidocs-splunk
Common Information Model Mapping
- Please see add-on documentation here: https://insight.gigamon.com/help/api/apidocs-splunk
Lookups
- The Gigamon Insight Add-on for Splunk does not contain lookup files.
Release Notes
Version 3.0.0
Version 2.4.0
Version 2.4.0
Released: 11/24/2021
Feature Changes
- Removed Python 2 support (supports Python 3 only).
- insight_query input events are generated using timestamp at which traffic for the event began.
- insight_detections input events are generated using most recent timestamp (last_seen) of the device's detections that satisfy the query parameters.
- insight_aggregations and insight_entity input events are generated using current system time.
- Default collect from date in insight_query input changed to 2021-11-01T00:00:00.000Z.
- Default start date in insight_detections input changed to 2021-11-01T00:00:00.000Z.
- Minor bug fixes.
Bug Fixes
- Fixed a bug with the insight_detections input type where duplicate detections could be imported because of a reset date checkpoint on every detection pull.
- Fixed a bug with insight_query input type where user supplied collect from date is not used in some cases.
Version 2.3.7
Version 2.3.7
Released: 3/2/2020
Feature Changes
- API Token global parameter is now encrypted.
Bug Fixes
- Fixed a bug with the insight_detections input type where duplicate detections could be imported because of a reset date checkpoint on every detection pull.