Gigamon Insights Post Deployment Configurations in GigaVUE‑FM

After you deploy Gigamon Insights, you must complete a few setups in GigaVUE‑FM before you can start using it. These steps connect Gigamon Insights to a large language model (LLM) and to your data tool. Without them, Gigamon Insights cannot read your prompts or return answers.

You must complete the following tasks:

■   Acquire credentials from a supported LLM provider. You need credentials for AWS Bedrock, Google Vertex and OpenAI. Gigamon Insights uses these models to read your prompts in plain language, expand them with context, and turn them into clear, useful answers. You must set up atleast one LLM provider. If you have setup more than one, you can switch between them at any time from the Gigamon Insights interface.
■   Set up an MCP server on either Elastic or Splunk. The Model Context Protocol (MCP) server lets Gigamon Insights query your data store for the AMI and AMX metadata it needs to answer your questions. You can use only one MCP server at a time, so pick the tool where your metadata is stored.

You add the LLM credentials and MCP server details in GigaVUE‑FM to enable Gigamon Insights. After you finish these tasks, you can enable Gigamon Insights in GigaVUE‑FM and start asking questions.

Refer to the following sections:

■   Acquire Amazon Bedrock Credentials
■   Acquire Google Vertex Credentials
■   Acquire OpenAI Credentials
■   Set up MCP Server
■   Enable Gigamon Insights in GigaVUE‑FM

Acquire Amazon Bedrock Credentials

To acquire Amazon Bedrock credentials, perform the following steps:

Complete Anthropic (FTU) Form

If this is the first time your AWS Account or organization has used an Anthropic LLM you will need to complete the First Time Use form.

1.   Navigate to Bedrock > Model Catalog > Claude Sonnet 4.x .
2. Click Open in playground.
3. If needed you will be prompted to complete the FTU form, otherwise you can continue configuring LLM access for Gigamon Insights.

Choose an authentication method

Decide how Gigamon Insights authenticates to Amazon Bedrock before you configure the provider in GigaVUE‑FM:

■   Use Method 1: To authenticate with a static access key ID and secret access key. This method works on all supported node versions. Refer to Access keys
■   Use Method 2: To authenticate with an IAM role attached to the Gigamon Insights EC2 instance. Use this method to avoid entering or storing long-lived keys. This method requires a node running 6.14.01 or later. Refer to EC2 instance role.

Complete only the method you intend to use.

Access keys

Create IAM Policy

1.   Log in to https://aws.amazon.com/console.
2. Navigate to IAM > Access Management > Policies and click Create policy.
3. Select an AWS service: Bedrock.
4. Filter Actions allowed: Invoke.
5. Select InvokeModel and InvokeModelWithResponseStream.
6. Under Resources, add ARNs to grant access to both the foundation model and the inference profile.
7. Click Add ARNs and add the foundation-model ARN:
o   Resource Region: Select Region (or any)
o   Resource resource: anthropic.claude-sonnet-4-5-20250929-v1:0 (or any other Sonnet 4.x model)
8. To grant inference profile access, click Add permissions.
9. Select Bedrock as the AWS service.
10. Filter Actions by Invoke, and select: InvokeModel and InvokeModelWithResponseStream
a. Under Resources, add the inference-profile ARN.
•   Resource Region: Select Region (or any)
•   Resource resource: us.anthropic.claude-sonnet-4-5-20250929-v1:0 (or any other Sonnet 4.x model)
b. Go to Request conditions > Add another condition for the inference-profile ARN.
•   Condition key: aws:ResourceAccount
•   Operator: StringEquals
•   Value: ${aws:PrincipalAccount}
c. Then click Add Condition, followed by Next
11. Under Policy details, provide a Policy name: insights-llm-access (example).
12. Review all permissions and click Create Policy to save your new policy.

Your IAM policy is created and ready to be attached to the IAM user.

The following is an example JSON template after the required permissions are configured.

Copy 
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowInferenceProfileAccess",
            "Effect": "Allow",
            "Action": [
                "bedrock:InvokeModel",
                "bedrock:InvokeModelWithResponseStream"
            ],
            "Resource": [
                "arn:aws:bedrock:*:*:inference-profile/us.anthropic.claude-sonnet-4-5-20250929-v1:0"
            ],
            "Condition": {
                "StringEquals": {
                    "aws:ResourceAccount": "${aws:PrincipalAccount}"
                }
            }
        },
        {
            "Sid": "AllowFoundationModelAccess",
            "Effect": "Allow",
            "Action": [
                "bedrock:InvokeModel",
                "bedrock:InvokeModelWithResponseStream"
            ],
            "Resource": [
                "arn:aws:bedrock:*::foundation-model/anthropic.claude-sonnet-4-5-20250929-v1:0"
            ]
        }
    ]
}

Create IAM User

1.   In the search bar of the AWS Management Console, type IAM, and then select IAM (Identity and Access Management).
2. In the left navigation pane, under Access Management, click Create Users.
3. Enter the following information:
a. User name: insights-llm-user (example)
b. Under Permission options, select Attach policies directly. In the search bar, type the name of your customer‑managed policy (the one you created earlier).
c. Select the policy check box.
d. Select permissions: insights-llm-access and AmazonBedrockReadOnly .

Note:  Use Add Permissions to add the AmazonBedrockReadOnly permission.

4. Click Next, then Create User. Search for user and click on the returned name.
a. Under Summary, click on Create access key.
b. For Use case select: Other.
c. Click Next. Provide a Description tag value: insights-key.
d. Click Create access key, your access key and secret access key is generated. Make a note of these access keys to configure them to enable this LLM for Gigamon Insights.

EC2 instance role

Use this method when Gigamon Insights runs on an AWS EC2 instance and you want AWS to supply temporary credentials automatically, without entering or storing static keys. The AWS-side setup is performed in your own AWS account and consists of three tasks.

Create the IAM role

1.   In IAM, create a role for the EC2 Instance.
2. Grant the role Bedrock permissions by attaching the AmazonBedrockFullAccess managed policy.
3. Name the role, for example, GigamonInsightsBedrockRole.
4. To attach the role to the Gigamon Insights instance, In the EC2 Console, select the Gigamon Insights instance.
5. Click Actions > Security > Modify IAM role.
6. Select the role you had created for example; GigamonInsightsBedrockRole and click Update.
7. In the Advanced Details, the Metadata Hop Limit must be atleast 2 or you can use the following command using CLI:
Copy 
aws ec2 modify-instance-metadata-options \
  --instance-id i-<EC2instanceID> \
  --http-put-response-hop-limit 2 \
  --http-endpoint enabled

Acquire Google Vertex Credentials

To acquire Google Vertex credentials, perform the following steps:

Verify Required IAM Roles

1.   In the Google Cloud Console, go to IAM & Admin > IAM.
2. In the IAM page, locate the user account:
o   Use the Filter field to search by the user’s email address.
o   Select the user entry to view assigned roles.
3. Verify that the following roles are assigned:
o   Service Account Admin: Ensures the user can create, delete, and manage service accounts.
o   Project IAM Admin: Ensures the user can assign roles (for example, granting Vertex AI access to service accounts).
o   Service Account Key Admin: Ensures the user can create and manage service account keys.

Verify Organization Policy Setting

1.   In the Google Cloud Console, go to: IAM & Admin > Organization Policies.
2. In the Policies list, use the filter field and search for:
iam.managed.disableServiceAccountApiKeyCreation
3. Select the policy from the list and check the policy status. Ensure the policy is Inactive.

If it is active, follow these steps:

1.   Click Actions > Edit policy. Under Policy source, select Override parent's policy, then click Add a rule.
2. Under Enforcement, select Off. Click Done
3. Click Set policy, then the dialog that pops up, click Set policy again. Gigamon Insights is now enabled to create API key in Google Vertex.

Create Gigamon Insights service account

1.   Go to IAM & Admin > Service Accounts.
2. Click Create service account. Configure the service account as follows:
a. Service account name: gi-vertexai-access
b. Service account ID: gi-vertexai-access
3. Click Create and continue.
4. Under Permissions, click Select a role and choose Agent Platform User from the menu.
5. Click Continue followed by Done.

Create Gigamon Insights Service Account API Key File

1.   In the Google Cloud Console, go to: IAM & Admin > Service Accounts.
2. Click on the service account that you created.
3. In the Keys tab, click Add key, and then select Create new key.
4. In the Create private key dialog, select JSON as the key type.
5. Click Create. The key file is automatically downloaded to your local system.

Open the downloaded JSON file and copy its contents. Use these details when configuring the Gigamon Insights.

Acquire OpenAI Credentials

To acquire OpenAI credentials, perform the following steps:

Before you begin, ensure the following:

You have an OpenAI account. If you don't have one, you can create it at OpenAI Platform.

You have added a payment method in the Billing section of your OpenAI account. This is required to enable API access.

1.   Log in to OpenAI.
2. Open the API Keys page.
3. Click Create new secret key.
4. Give the key a name (optional) and create it.
5. Copy the key immediately and store it securely. For security reasons, you will not be able to view the full key again after closing the dialog.
6. After creating your key, review your usage and rate limits to avoid unexpected interruptions.

Set up MCP Server

Configure either the Splunk MCP server or the Elastic MCP server based on your deployment, and skip the section that does not apply. For detailed steps to obtain the required endpoint and credentials, refer to the:

■   Acquire Splunk MCP Server Endpoint and API Key
■   Acquire Elastic Endpoint and API Key
■   Configure Gigamon Insights MCP Server only when you want to connect an MCP-compatible client or AI agent to Gigamon Insights.

Acquire Splunk MCP Server Endpoint and API Key

Before you begin, ensure the following:

■   Splunk MCP Server version 1.2.0 is installed in your Splunk deployment.
■   For AMX deployments, Gigamon Deep Observability App - JSON (GDOA - JSON) version 2.3.4 is installed.
■   For CEF deployments, the Gigamon Technology Add-on (TA) is installed.

Refer to Prerequisites for Gigamon Insights Deployment

Make sure the Splunk user account you use has the required capabilities. Add the following capabilities to the user role:

■   mcp_tool_execute
■   mcp_tool_admin

Note:  Gigamon Insights requires a 10-minute server‑side timeout in Splunk MCP Server 1.2.0. If this value is not configured, long‑running queries can time out before Gigamon Insights receives a response. Configure the server‑side timeout to 10 minutes before connecting to Gigamon Insights.

To acquire Splunk credentials, perform the following steps:

1.   Log in to your Splunk Web UI as a user who has the required capabilities.
2. Navigate to Apps > Find More Apps > Splunk MCP Server.
3. If you are installing Splunk MCP Server for the first time, enter your Splunk user name and password when prompted, and install the app.
4. If Splunk MCP Server is already installed, open the Splunk MCP Server app.
5. On the Splunk MCP Server page, click Create MCP Encrypted Token.
6. In the Create MCP Encrypted Token dialog:
a. From User, select the user account for which you want to create the token.
b. Audience - enter mcp.
c. Expiration - Specify when the token should expire.
d. Select Create.
e. Copy the displayed token—it will only appear once.
f. Copy the endpoint URL displayed in the Endpoint.

Use the copied endpoint URL and API key in GigaVUE‑FM.

Acquire Elastic Endpoint and API Key

Note:  Support for the local Elastic MCP server is discontinued. If you previously used a local MCP server, you must migrate to the Elastic Agent Builder (remote MCP server) before connecting Gigamon Insights.

Gigamon Insights supports Elastic versions 9.3.0 through 9.4.2, available for both on premises (self‑managed) deployments and Elastic Cloud. All Elastic deployments use the remote MCP server (Elastic Agent Builder), which reached General Availability (GA) in Elastic 9.3.0.

Before you begin, make sure you have an Elastic account with either of the following privileges:

■   manage_api_key
■   admin

Acquire Elastic credentials (Remote MCP Server)

To acquire credentials from Elastic 9.2 or later (Remote MCP Server), refer to the detailed steps in Elastic Agent Builder MCP server.

Use the endpoint URL and API key in GigaVUE‑FM

Configure Gigamon Insights MCP Server

Starting in release 6.14.02, Gigamon Insights includes a Model Context Protocol (MCP) server that enables external tools and AI agents to access Gigamon Insights prompts through MCP-compatible clients.

Before you begin

To connect to the MCP server, you need a Gigamon Insights API token. For information about creating and managing API tokens, refer to the Manage API Token.

Connect to the MCP server

The MCP server supports HTTP transport and uses bearer token authentication.

Use the following example configuration to add the Gigamon Insights MCP server to your MCP client:

Copy 
{
  "mcpServers": {
    "gigamonInsights": {
      "command": "npx",
      "args": [
        "mcp-remote",
        "https://<GI_URL>/mcp/gigamoninsights",
        "--header",
        "Authorization: Bearer ${GI_TOKEN}"
      ]
    }
  }
}

The MCP server provides tools that enable you to run Gigamon Insights prompts from an MCP client.

Available tools include:

■   Execute Custom Prompt (execute_custom_prompt) to run custom prompts.
■   Get Tasks Result (get_tasks_result) to retrieve task results.
■   Get Current Rate Limit Status (get_current_rate_limit_status) to view the current rate-limit status.
■   Additional prompt-based tools for supported Gigamon Insights use cases, such as:
o   Port activity analysis
o   Insecure protocol detection
o   PCI DSS compliance assessment
o   DNS response-time analysis
■   Rate limits: MCP prompt execution tool calls are rate-limited per user. Each user can have up to three concurrent tool calls running at a time. Use the get_current_rate_limit_status tool to view the current rate-limit status.

The MCP server uses the default LLM model configured in Gigamon Insights.

Enable Gigamon Insights in GigaVUE‑FM

After you acquire the LLM and MCP server credentials, follow these steps to enable Gigamon Insights in GigaVUE‑FM:

Note:  To enable Gigamon Insights, you must be a member of the fm_admin or fm_super_admin user group in GigaVUE‑FM.

1.   Sign in to GigaVUE‑FM. Navigate to Settings > Systems > Gigamon Insights.
2. Select the Gigamon Insights instance configured for this GigaVUE-FM and, under the Actions drop-down list, click Configure.
3. Before configuring LLM and server settings, you need to confirm your terms with the Gigamon AI Usage Telemetry Data Collection & Usage Notice.

Note:  In this LA release, accepting AI usage telemetry is required to use Gigamon Insights. If you do not accept the usage terms, you cannot enable or access this feature.

4. [Optional] Enter your Customer ID when you accept the terms and conditions.
5. [Optional] On the Network Settings page, enable the proxy only if your environment requires outbound traffic to route through a proxy server, and enter the proxy URL. Leave the proxy disabled if it is not required.
o   Enable the proxy only if your environment requires outbound traffic to pass through a proxy server.
o   Enter a single HTTP or HTTPS proxy URL. Gigamon Insights uses this value as the shared outbound proxy for supported LLM connections for the selected instance.
o   If proxy is enabled, make sure the Gigamon Insights IP address is whitelisted on the proxy server.
o   If your deployment uses Amazon Bedrock and requires controlled routing, use deployment-level DNS or host alias redirection.
6. Click Next. The Add LLM Provider page appears. On the Add LLM Provider page, enter the following:
a. Select an LLM provider (Amazon Bedrock, OpenAI, or Google Vertex AI). For AWS Bedrock, choose an Authentication Method. When you select Amazon Bedrock as the provider, an Authentication Method option appears with two choices:
•   Access Keys - Enter the Access Key, Secret Key, and Session Token, then set the Region. Enter the required credentials and endpoint details.
•   EC2 Instance Role - When you select EC2 Instance Role, the Access Key, Secret Key, and Session Token fields are hidden because no credentials are entered. Set the Region. Add the LLM models.
b. Click Test Connection to validate connectivity to the provider. Select one or more supported LLM models. If you select multiple models, choose a Default LLM Model. Only one model can be set as the default. If proxy is enabled, the connection test validates connectivity through the configured proxy.
7. Click Next. On the Add MCP Server page, enter the following:
a. Select a data tool (Elastic or Splunk).
b. Enter the endpoint URL and API key from your MCP server.
8. Click Save to apply the configuration.

What to do next

Refer to Get Started with Gigamon Insights.