Gigamon Introduces New Integrations with Splunk and Phantom, Bringing Its Defender Lifecycle Model to Life
If you use the Splunk or Phantom platforms, then you’ll want to know about new integrations that enable security operation teams to accelerate and automate threat detection and containment.
- The Gigamon® IPFIX Metadata Application for Splunk.
- The Gigamon Adaptive Response Application for Splunk.
- The Gigamon App for Phantom.
These solutions empower SecOps and DevOps teams to take immediate action and effectively combat rapidly evolving and persistent cybersecurity threats.
The Defender Lifecycle Model
These three Gigamon integrations bring to life the Defender Lifecycle Model, a new approach to security that addresses the increasing speed, volume and polymorphic nature of cyber threats. The model is based on a foundational layer of pervasive visibility across the four key pillars of prevention, detection, prediction and containment that are essential in a modern cybersecurity infrastructure.
The model leverages the GigaSECURE® Security Delivery Platform and enables the integration of machine learning, artificial intelligence (AI) and security workflow automation to shift control away from the attacker and back to the defender.
“The integrated solutions speed threat identification and mitigation by automating what is often a time‐consuming and complex manual process.”
- Ananda Rajagopal, vice president of products at Gigamon
Splunk Integration Capabilities Overview
For SecOps teams who are challenged with managing an overwhelming amount of data, incidents and potential threats, the new Gigamon integrations for Splunk deliver the visibility and control required to quickly and effectively identify critical incidents and threats and automatically take steps to mitigate them.
- The Gigamon IPFIX Metadata Application for Splunk allows Splunk customers to ingest network metadata generated by the GigaSECURE Security Delivery Platform.
- The Gigamon Adaptive Response Application for Splunk enables security operations center (SOC) teams to automate actions on the GigaSECURE platform in response to threats detected in Splunk ES.
The solutions can be used for a variety of use cases including:
- The isolation of an infected host trying to resolve high‐entropy domain names or block rogue DNS servers.
- The detection and mitigation of malware attacks such as the recent WannaCry ransomware cyberattack.
- The redirection of traffic to a recorder or a specific security tool chain for advanced analysis can be performed when usual network traffic activity is seen.
Phantom Integration Capabilities Overview
The Gigamon App for Phantom provides SecOps teams with automated and orchestrated security operations and case management. The application utilizes REST APIs provided by the GigaSECURE Security Delivery Platform and enables Phantom users to trigger workflows or remediation actions on the GigaSECURE Security Delivery Platform in response to specific events.
Key benefits of the Gigamon App for Phantom include automating common security operations tasks through predefined playbooks, and orchestrating network threat detection and mitigation to reduce mean time to resolution.
“Gigamon provides an innovative, extensible and pervasive platform for visibility that integrates with Phantom to orchestrate and automate critical security operations tasks,” says Oliver Friedrichs, CEO and founder, Phantom. “Our integrated solutions allow SecOps teams to work smarter, respond faster and strengthen their network defense postures.”
The Gigamon IPFIX Metadata Application for Splunk and the Gigamon Adaptive Response Application for Splunk are available for free download from Splunkbase. The Gigamon App for Phantom is available for free download from the Phantom Apps online community.