Gigamon
Collect logs from Gigamon with Elastic Agent.
Version | 1.0.1 (View all) |
Compatible Kibana version(s) | 8.13.0 or higher |
Supported Serverless project types | Security Observability |
Subscription level | Basic |
Level of support | Partner |
Gigamon leverages deep packet inspection (DPI) to extract over 7500+ app related metadata attributes from the raw packets in the network. Gigamon Elastic Integration delivers intelligent security analytics and threat intelligence across the enterprise, and you get a single solution for attack detection, threat visibility, proactive hunting, and threat response.
Data streams
The Cybereason integration collects the following logs from Gigamon:
- ami
Requirements
Elastic Agent must be installed. For more details and installation instructions, please refer to the Elastic Agent Installation Guide.
Installing and managing an Elastic Agent:
There are several options for installing and managing Elastic Agent:
Install a Fleet-managed Elastic Agent (recommended):
With this approach, you install Elastic Agent and use Fleet in Kibana to define, configure, and manage your agents in a central location. We recommend using Fleet management because it makes the management and upgrade of your agents considerably easier.
Install Elastic Agent in standalone mode (advanced users):
With this approach, you install Elastic Agent and manually configure the agent locally on the system where it’s installed. You are responsible for managing and upgrading the agents. This approach is reserved for advanced users only.
Install Elastic Agent in a containerized environment:
You can run Elastic Agent inside a container, either with Fleet Server or standalone. Docker images for all versions of Elastic Agent are available from the Elastic Docker registry, and we provide deployment manifests for running on Kubernetes.
Please note, there are minimum requirements for running Elastic Agent. For more information, refer to the Elastic Agent Minimum Requirements.
Setup
Gigamon setup
To export data to Gigamon Elastic Integration.
-
From Fabric Manager, Deploy an AMX node with traffic acquisition method as "Customer Orchestrated Source".
-
Create an Monitoring Session with (Rep In ----> AMX ---> Rep Out).
To add AMX application:
-
Drag and drop Application Metadata Exporter from APPLICATIONS to the graphical workspace. The Application quick view appears.
-
Enter the Alias for the application. Enter a port number for the Cloud Tool Ingestor Port. Then, click the Add button for Cloud Tool Exports.
-
You can export your Application Metadata Intelligence output to cloud tools. Enter the following details for the Cloud tool export in the Application quick view:
-
Alias: Enter the alias name for the cloud tool export.
-
Cloud Tool: Select the Cloud tool from the drop-down menu.If it is not available click "others".
-
Endpoint: Give the URL of the cloud tool instance with the correct port number in which the port is listening.
-
Headers: Enter the secret header and enable secure keys
-
Enable Export: Enable the box to export the Application Metadata Intelligence output in JSON format.
-
Zip: Enable the box to compress the output file.
-
Interval: The time interval (in seconds) in which the data should be uploaded periodically. The recommended minimum time interval is 10 seconds and the maximum time interval is 30 minutes.
-
Parallel Writer: Specifies the number of simultaneous JSON exports done.
-
Export Retries: The number of times the application tries to export the entries to Cloud Tool. The recommended minimum value is 4 and the maximum is 10.
-
Maximum Entries: The number of JSON entries in a file. The maximum number of allowed entries is 5000 and the minimum is 10, however 1000 is the default value.
-
Labels: Click Add. Enter the following details:
- Enter the Key.
- Enter the Value.
-
-
Click Deploy to deploy the monitoring session. The Select nodes to deploy the Monitoring Session dialog box appears. Select the GigaVUE V Series Node for which you wish to deploy the monitoring session.
-
After selecting the V Series Node, select the interfaces for the REPs deployed in the monitoring session from the drop-down menu. Then, click Deploy.
Logs Reference
ami
This is the ami
dataset.
Example
An example event for ami
looks as following:
{
"@timestamp": "2023-05-16T15:25:25.000Z",
"agent": {
"ephemeral_id": "0e2836eb-563d-4550-9858-6fc4af32480a",
"id": "931b4c56-94b9-481d-a440-a4d9f31c41fd",
"name": "elastic-agent-58986",
"type": "filebeat",
"version": "8.15.0"
},
"data_stream": {
"dataset": "gigamon.ami",
"namespace": "16851",
"type": "logs"
},
"ecs": {
"version": "8.11.0"
},
"elastic_agent": {
"id": "931b4c56-94b9-481d-a440-a4d9f31c41fd",
"snapshot": false,
"version": "8.15.0"
},
"event": {
"kind": "event",
"agent_id_status": "verified",
"dataset": "gigamon.ami",
"ingested": "2024-08-23T10:00:41Z",
"original": "{\"app_id\":\"32\",\"app_name\":\"dns\",\"device_inbound_interface\":\"0\",\"dns_class\":\"1\",\"dns_flags\":\"0\",\"dns_host\":\"pnstrex-83816.local\",\"dns_host_addr\":\"10.114.82.101\",\"dns_host_class\":\"1\",\"dns_host_raw\":\"706e73747265782d38333831362e6c6f63616c\",\"dns_host_type\":\"PTR\",\"dns_name\":\"a.b.2.b.9.6.c.2.3.9.3.d.6.2.6.a.0.8.0.2.1.0.0.0.0.0.0.0.b.a.c.f. i:p6.arpa\",\"dns_opcode\":\"0\",\"dns_qdcount\":\"4\",\"dns_query\":\"f.7.5.2.e.7.6.2.4.c.1.c.4.c.6.1.0.8.0.2.1.0.0.0.0.0.0.0.b.a.c.f. ip6.arpa\",\"dns_query_type\":\"255\",\"dns_transaction_id\":\"0\",\"dns_ttl\":\"120\",\"dst_bytes\":\"0\",\"dst_ip\":\"224.0.0.251\",\"dst_mac\":\"01:00:5e:00:00:fb\",\"dst_packets\":\"0\",\"dst_port\":\"5353\",\"egress_intf_id\":\"0\",\"end_reason\":\"1\",\"end_time\":\"2023:12:13 15:25:11.181\",\"generator\":\"gs_apps_appInst16_423722da-33ec-1556-b24b-cda2e74a53f6\",\"id\":\"679408454713072647\",\"intf_name\":\"0\",\"ip_version\":\"4\",\"protocol\":\"17\",\"seq_num\":\"656\",\"src_bytes\":\"337\",\"src_ip\":\"10.114.82.101\",\"src_mac\":\"00:50:56:8d:89:41\",\"src_packets\":\"1\",\"src_port\":\"5353\",\"start_time\":\"2023:12:13 15:25:11.181\",\"sys_up_time_first\":\"3497355275\",\"sys_up_time_last\":\"3497355275\",\"ts\":\"Thu May 16 15:25:25 2023\",\"vendor\":\"Gigamon\",\"version\":\"6.5.00\"}"
},
"gigamon": {
"ami": {
"app_id": 32,
"app_name": "dns",
"device_inbound_interface": "0",
"dns_class": "1",
"dns_flags": "0",
"dns_host": "pnstrex-83816.local",
"dns_host_addr": "10.114.82.101",
"dns_host_class": "1",
"dns_host_raw": "706e73747265782d38333831362e6c6f63616c",
"dns_host_type": "PTR",
"dns_name": "a.b.2.b.9.6.c.2.3.9.3.d.6.2.6.a.0.8.0.2.1.0.0.0.0.0.0.0.b.a.c.f. i:p6.arpa",
"dns_opcode": "0",
"dns_qdcount": 4,
"dns_query": "f.7.5.2.e.7.6.2.4.c.1.c.4.c.6.1.0.8.0.2.1.0.0.0.0.0.0.0.b.a.c.f. ip6.arpa",
"dns_query_type": "255",
"dns_query_type_value": "*",
"dns_transaction_id": 0,
"dns_ttl": 120,
"dst_bytes": 0,
"dst_ip": "224.0.0.251",
"dst_mac": "01:00:5e:00:00:fb",
"dst_packets": 0,
"dst_port": 5353,
"egress_intf_id": "0",
"end_reason": "1",
"end_reason_value": "Idle Timeout",
"end_time": "2023-12-13T15:25:11.181Z",
"generator": "gs_apps_appInst16_423722da-33ec-1556-b24b-cda2e74a53f6",
"id": "679408454713072647",
"intf_name": "0",
"ip_version": "4",
"protocol": "17",
"seq_num": 656,
"src_bytes": 337,
"src_ip": "10.114.82.101",
"src_mac": "00:50:56:8d:89:41",
"src_packets": 1,
"src_port": 5353,
"start_time": "2023-12-13T15:25:11.181Z",
"sys_up_time_first": 3497355275,
"sys_up_time_last": 3497355275,
"ts": "2023-05-16T15:25:25.000Z",
"vendor": "Gigamon",
"version": "6.5.00"
}
},
"input": {
"type": "http_endpoint"
},
"tags": [
"preserve_original_event",
"forwarded",
"gigamon-ami"
]
}
Exported fields
Field | Description | Type |
---|---|---|
@timestamp | Event timestamp. | date |
data_stream.dataset | Data stream dataset. | constant_keyword |
data_stream.namespace | Data stream namespace. | constant_keyword |
data_stream.type | Data stream type. | constant_keyword |
event.dataset | Event dataset | constant_keyword |
event.module | Event module | constant_keyword |
gigamon.ami.app_id | long | |
gigamon.ami.app_name | keyword | |
gigamon.ami.device_inbound_interface | keyword | |
gigamon.ami.dns_ancount | long | |
gigamon.ami.dns_arcount | long | |
gigamon.ami.dns_class | keyword | |
gigamon.ami.dns_flags | keyword | |
gigamon.ami.dns_host | keyword | |
gigamon.ami.dns_host_addr | keyword | |
gigamon.ami.dns_host_class | keyword | |
gigamon.ami.dns_host_raw | keyword | |
gigamon.ami.dns_host_type | keyword | |
gigamon.ami.dns_name | keyword | |
gigamon.ami.dns_opcode | keyword | |
gigamon.ami.dns_qdcount | long | |
gigamon.ami.dns_query | keyword | |
gigamon.ami.dns_query_type | keyword | |
gigamon.ami.dns_query_type_value | keyword | |
gigamon.ami.dns_reply_code | keyword | |
gigamon.ami.dns_reply_code_value | keyword | |
gigamon.ami.dns_response_time | double | |
gigamon.ami.dns_reverse_addr | ip | |
gigamon.ami.dns_transaction_id | long | |
gigamon.ami.dns_ttl | long | |
gigamon.ami.dst_bytes | long | |
gigamon.ami.dst_ip | ip | |
gigamon.ami.dst_mac | keyword | |
gigamon.ami.dst_packets | long | |
gigamon.ami.dst_port | long | |
gigamon.ami.egress_intf_id | keyword | |
gigamon.ami.end_reason | keyword | |
gigamon.ami.end_reason_value | keyword | |
gigamon.ami.end_time | date | |
gigamon.ami.eventType | keyword | |
gigamon.ami.generator | keyword | |
gigamon.ami.http_code | long | |
gigamon.ami.http_content_len | long | |
gigamon.ami.http_content_type | keyword | |
gigamon.ami.http_host | keyword | |
gigamon.ami.http_method | keyword | |
gigamon.ami.http_mime_type | keyword | |
gigamon.ami.http_request_size | long | |
gigamon.ami.http_rtt | keyword | |
gigamon.ami.http_server | keyword | |
gigamon.ami.http_server_agent | keyword | |
gigamon.ami.http_uri | keyword | |
gigamon.ami.http_uri_decoded | keyword | |
gigamon.ami.http_uri_full | keyword | |
gigamon.ami.http_uri_path | keyword | |
gigamon.ami.http_uri_path_decoded | keyword | |
gigamon.ami.http_uri_path_value | keyword | |
gigamon.ami.http_uri_raw | keyword | |
gigamon.ami.http_user_agent | keyword | |
gigamon.ami.http_version | keyword | |
gigamon.ami.id | keyword | |
gigamon.ami.intf_name | keyword | |
gigamon.ami.ip_version | keyword | |
gigamon.ami.protocol | keyword | |
gigamon.ami.seq_num | long | |
gigamon.ami.smb_version | keyword | |
gigamon.ami.smb_version_value | keyword | |
gigamon.ami.src_bytes | long | |
gigamon.ami.src_ip | ip | |
gigamon.ami.src_mac | keyword | |
gigamon.ami.src_packets | long | |
gigamon.ami.src_port | long | |
gigamon.ami.ssl_cert_ext_authority_key_id | keyword | |
gigamon.ami.ssl_cert_ext_subject_key_id | keyword | |
gigamon.ami.ssl_cert_extension_oid | keyword | |
gigamon.ami.ssl_certif_md5 | keyword | |
gigamon.ami.ssl_certif_sha1 | keyword | |
gigamon.ami.ssl_certificate_dn_issuer | keyword | |
gigamon.ami.ssl_certificate_dn_subject | keyword | |
gigamon.ami.ssl_certificate_issuer_c | keyword | |
gigamon.ami.ssl_certificate_issuer_cn | keyword | |
gigamon.ami.ssl_certificate_issuer_l | keyword | |
gigamon.ami.ssl_certificate_issuer_o | keyword | |
gigamon.ami.ssl_certificate_issuer_ou | keyword | |
gigamon.ami.ssl_certificate_issuer_st | keyword | |
gigamon.ami.ssl_certificate_subject_c | keyword | |
gigamon.ami.ssl_certificate_subject_cn | keyword | |
gigamon.ami.ssl_certificate_subject_key_algo_oid | keyword | |
gigamon.ami.ssl_certificate_subject_key_size | long | |
gigamon.ami.ssl_certificate_subject_l | keyword | |
gigamon.ami.ssl_certificate_subject_o | keyword | |
gigamon.ami.ssl_certificate_subject_ou | keyword | |
gigamon.ami.ssl_certificate_subject_st | keyword | |
gigamon.ami.ssl_cipher_suite_id | keyword | |
gigamon.ami.ssl_cipher_suite_id_protocol | keyword | |
gigamon.ami.ssl_cipher_suite_id_value | keyword | |
gigamon.ami.ssl_cipher_suite_list | keyword | |
gigamon.ami.ssl_client_hello_extension_len | long | |
gigamon.ami.ssl_client_hello_extension_type | keyword | |
gigamon.ami.ssl_common_name | keyword | |
gigamon.ami.ssl_compression_method | keyword | |
gigamon.ami.ssl_content_type | keyword | |
gigamon.ami.ssl_declassify_override | keyword | |
gigamon.ami.ssl_ext_sig_algorithm_hash | keyword | |
gigamon.ami.ssl_ext_sig_algorithm_hash_value | keyword | |
gigamon.ami.ssl_ext_sig_algorithm_scheme | keyword | |
gigamon.ami.ssl_ext_sig_algorithm_scheme_value | keyword | |
gigamon.ami.ssl_ext_sig_algorithm_sig | keyword | |
gigamon.ami.ssl_ext_sig_algorithms_len | long | |
gigamon.ami.ssl_fingerprint_ja3 | keyword | |
gigamon.ami.ssl_fingerprint_ja3s | keyword | |
gigamon.ami.ssl_handshake_type | keyword | |
gigamon.ami.ssl_index | keyword | |
gigamon.ami.ssl_issuer | keyword | |
gigamon.ami.ssl_nb_compression_methods | keyword | |
gigamon.ami.ssl_organization_name | keyword | |
gigamon.ami.ssl_protocol_version | keyword | |
gigamon.ami.ssl_protocol_version_value | keyword | |
gigamon.ami.ssl_request_size | long | |
gigamon.ami.ssl_serial_number | keyword | |
gigamon.ami.ssl_server_hello_extension_len | long | |
gigamon.ami.ssl_server_hello_extension_type | keyword | |
gigamon.ami.ssl_session_id | keyword | |
gigamon.ami.ssl_signalization_override | keyword | |
gigamon.ami.ssl_validity_not_after | date | |
gigamon.ami.ssl_validity_not_before | date | |
gigamon.ami.start_time | date | |
gigamon.ami.sys_up_time_first | long | |
gigamon.ami.sys_up_time_last | long | |
gigamon.ami.tcp_flags | keyword | |
gigamon.ami.ts | date | |
gigamon.ami.vendor | keyword | |
gigamon.ami.version | keyword | |
input.type | Type of Filebeat input. | keyword |
log.offset | Log offset. | long |
tags | User defined tags. | keyword |
Changelog
Version | Details | Kibana version(s) |
---|---|---|
1.0.1 | Bug fix View pull request | 8.13.0 or higher |
1.0.0 | Enhancement View pull request | 8.13.0 or higher |
0.2.0 | Enhancement View pull request | — |
0.1.0 | Enhancement View pull request | — |