How to Gain Visibility into the Applications on Your Network

0:01

Hi everyone, my name is Irvin, and I am on the Product Marketing team here at Gigamon.

0:04

It’s very nice to meet you. In this short video, I will show you how you can gain visibility into the applications running in your infrastructure and how you can visualize, filter, and gain a deep understanding into these same applications.

0:15

When it comes to understanding what is happening on the wire in your infrastructure, there isn’t really a simple go-to answer on how to do so. This challenge is all based on an overall lack of ability to gain simple access to context-rich intelligence from the traffic flowing in your infrastructure.

0:29

Without further ado, let’s dive in.

0:33

Here, we see the main Application Intelligence screen within Gigamon Fabric Manager. This provides you a snapshot of what applications are currently running on your network and how much traffic they are generating.

0:43

Application Intelligence is able to instantly identify the digital signatures of more than 3,500 of the most common applications, including your own organization’s custom applications.

0:52

This capability helps you identify applications that shouldn’t be on your network, including unauthorized applications, high-risk applications like file sharing or crypto mining, and gaming and streaming applications.

1:02

There are a few things you can do with this new source of intelligence.

1:09

You can take this intelligence and with Application Filtering Intelligence (AFI), combine traffic that contains specific applications, set rules, and filter low-risk traffic to provide your tools with an effective stream of intelligence.

1:21

You can also set rules for single applications as well.

1:24

AFI has the potential to reduce traffic sent to tools by 50 to 60 percent, since you are now filtering the lowest traffic and intelligence streams up front before it reaches your tools.

1:34

In this example, we are feeding our IDS tool with a stream of intelligence that is currently sending all traffic.

1:41

We can easily filter low-risk traffic—like traffic representing Windows updates—through this simple drop-down menu here.

1:58

Now, we are filtering out the traffic associated with Windows updates from the stream of intelligence that is sent to our IDS tool.

2:09

Efficiency is a word that gets thrown around a lot by various companies, but in this context, we help your tools do less work and, in turn, help you control your tool data consumption and network bandwidth costs.

2:19

On top of negatively affecting your resources, low-risk traffic can also impact your overall security posture by potentially increasing the number of false positives and will take up a significant amount of your storage space.

2:30

Here, you have a solution that directly addresses the various challenges that come with analyzing low-risk traffic as part of your security posture.

2:37

Now, to gain a deep understanding of what’s happening in your infrastructure, let’s take a look at Application Metadata.

2:48

Application Metadata can extract more than 7,500 different attributes from application traffic you’ve identified, sending a context-rich stream of intelligence to various tools that analyze metadata—typically your SIEM and observability tools.

3:00

Here, we see the information of the tool we’re sending intelligence to, the number of applications that we are currently querying from the access traffic, the various application categories you can choose from, the applications within each category that you may be interested in, and the various application attributes that we can extract from the access traffic.

3:32

You can create a search that is as detailed or as broad as you want. As you can see, there’s so much you can choose from to create your own customized stream of intelligence.

3:40

This is all for the sake of sending your tools a deep understanding of what’s currently occurring in your infrastructure.

3:45

Once you have created your stream of intelligence, you can create dashboards like this.

3:50

Here’s an example of a Splunk dashboard powered by Gigamon AMI that identifies all traffic containing weak ciphers.

3:56

Without this deep level of intelligence, there’s a good chance you wouldn’t have been able to identify and address this issue—and, frankly, other issues—in a simple and timely manner.

4:05

With Gigamon Application Metadata, you can now efficiently and effectively identify and address security risks that are currently going undetected.

4:14

To summarize what we just went over, we saw how you can easily visualize, filter, and gain a deep understanding of the applications currently communicating in your infrastructure.

4:22

Altogether, these three components support the creation of a more effective security posture by increasing resource efficiency, prioritizing efforts on high-risk security issues, and potentially saving budget that might otherwise be spent on additional tools or storage.

4:34

If you would like to learn more about the power of Gigamon Application Intelligence, please feel free to contact us here at Gigamon for more information.