Gigamon Insights Post Deployment Configurations in GigaVUE‑FM

After you deploy Gigamon Insights, you must complete a few setups in GigaVUE‑FM before you can start using it. These steps connect Gigamon Insights to a large language model (LLM) and to your data tool. Without them, Gigamon Insights cannot read your prompts or return answers.

You must complete the following tasks:

■   Acquire credentials from a supported LLM provider. You need credentials for AWS Bedrock, Google Vertex and OpenAI. Gigamon Insights uses these models to read your prompts in plain language, expand them with context, and turn them into clear, useful answers. You must set up atleast one LLM provider. If you have setup more than one, you can switch between them at any time from the Gigamon Insights interface.
■   Set up an MCP server on either Elastic or Splunk. The Model Context Protocol (MCP) server lets Gigamon Insights query your data store for the AMI and AMX metadata it needs to answer your questions. You can use only one MCP server at a time, so pick the tool where your metadata is stored.

You add the LLM credentials and MCP server details in GigaVUE‑FM to enable Gigamon Insights. After you finish these tasks, you can enable Gigamon Insights in GigaVUE‑FM and start asking questions.

Refer to the following sections:

■   Acquire Amazon Bedrock Credentials
■   Acquire Google Vertex Credentials
■   Acquire OpenAI Credentials
■   Set up MCP Server
■   Enable Gigamon Insights in GigaVUE‑FM

Acquire Amazon Bedrock Credentials

To acquire Amazon Bedrock credentials, perform the following steps:

Complete Anthropic (FTU) Form

If this is the first time your AWS Account or organization has used an Anthropic LLM you will need to complete the First Time Use form.

1.   Navigate to Bedrock > Model Catalog > Claude Sonnet 4.x .
2. Click Open in playground.
3. If needed you will be prompted to complete the FTU form, otherwise you can continue configuring LLM access for Gigamon Insights.

Access keys

Create IAM Policy

1.   Log in to https://aws.amazon.com/console.
2. Navigate to IAM > Access Management > Policies and click Create policy.
3. Select an AWS service: Bedrock.
4. Filter Actions allowed: Invoke.
5. Select InvokeModel and InvokeModelWithResponseStream.
6. Under Resources, add ARNs to grant access to both the foundation model and the inference profile.
7. Click Add ARNs and add the foundation-model ARN:
o   Resource Region: Select Region (or any)
o   Resource resource: anthropic.claude-sonnet-4-5-20250929-v1:0 (or any other Sonnet 4.x model)
8. To grant inference profile access, click Add permissions.
9. Select Bedrock as the AWS service.
10. Filter Actions by Invoke, and select: InvokeModel and InvokeModelWithResponseStream
a. Under Resources, add the inference-profile ARN.
•   Resource Region: Select Region (or any)
•   Resource resource: us.anthropic.claude-sonnet-4-5-20250929-v1:0 (or any other Sonnet 4.x model)
b. Go to Request conditions > Add another condition for the inference-profile ARN.
•   Condition key: aws:ResourceAccount
•   Operator: StringEquals
•   Value: ${aws:PrincipalAccount}
c. Then click Add Condition, followed by Next
11. Under Policy details, provide a Policy name: insights-llm-access (example).
12. Review all permissions and click Create Policy to save your new policy.

Your IAM policy is created and ready to be attached to the IAM user.

The following is an example JSON template after the required permissions are configured.

Copy 
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowInferenceProfileAccess",
            "Effect": "Allow",
            "Action": [
                "bedrock:InvokeModel",
                "bedrock:InvokeModelWithResponseStream"
            ],
            "Resource": [
                "arn:aws:bedrock:*:*:inference-profile/us.anthropic.claude-sonnet-4-5-20250929-v1:0"
            ],
            "Condition": {
                "StringEquals": {
                    "aws:ResourceAccount": "${aws:PrincipalAccount}"
                }
            }
        },
        {
            "Sid": "AllowFoundationModelAccess",
            "Effect": "Allow",
            "Action": [
                "bedrock:InvokeModel",
                "bedrock:InvokeModelWithResponseStream"
            ],
            "Resource": [
                "arn:aws:bedrock:*::foundation-model/anthropic.claude-sonnet-4-5-20250929-v1:0"
            ]
        }
    ]
}

Create IAM User

1.   In the search bar of the AWS Management Console, type IAM, and then select IAM (Identity and Access Management).
2. In the left navigation pane, under Access Management, click Create Users.
3. Enter the following information:
a. User name: insights-llm-user (example)
b. Under Permission options, select Attach policies directly. In the search bar, type the name of your customer‑managed policy (the one you created earlier).
c. Select the policy check box.
d. Select permissions: insights-llm-access and AmazonBedrockReadOnly .

Note:  Use Add Permissions to add the AmazonBedrockReadOnly permission.

4. Click Next, then Create User. Search for user and click on the returned name.
a. Under Summary, click on Create access key.
b. For Use case select: Other.
c. Click Next. Provide a Description tag value: insights-key.
d. Click Create access key, your access key and secret access key is generated. Make a note of these access keys to configure them to enable this LLM for Gigamon Insights.

Acquire Google Vertex Credentials

To acquire Google Vertex credentials, perform the following steps:

Verify Required IAM Roles

1.   In the Google Cloud Console, go to IAM & Admin > IAM.
2. In the IAM page, locate the user account:
o   Use the Filter field to search by the user’s email address.
o   Select the user entry to view assigned roles.
3. Verify that the following roles are assigned:
o   Service Account Admin: Ensures the user can create, delete, and manage service accounts.
o   Project IAM Admin: Ensures the user can assign roles (for example, granting Vertex AI access to service accounts).
o   Service Account Key Admin: Ensures the user can create and manage service account keys.

Verify Organization Policy Setting

1.   In the Google Cloud Console, go to: IAM & Admin > Organization Policies.
2. In the Policies list, use the filter field and search for:
iam.managed.disableServiceAccountApiKeyCreation
3. Select the policy from the list and check the policy status. Ensure the policy is Inactive.

If it is active, follow these steps:

1.   Click Actions > Edit policy. Under Policy source, select Override parent's policy, then click Add a rule.
2. Under Enforcement, select Off. Click Done
3. Click Set policy, then the dialog that pops up, click Set policy again. Gigamon Insights is now enabled to create API key in Google Vertex.

Create Gigamon Insights service account

1.   Go to IAM & Admin > Service Accounts.
2. Click Create service account. Configure the service account as follows:
a. Service account name: gi-vertexai-access
b. Service account ID: gi-vertexai-access
3. Click Create and continue.
4. Under Permissions, click Select a role and choose Agent Platform User from the menu.
5. Click Continue followed by Done.

Create Gigamon Insights Service Account API Key File

1.   In the Google Cloud Console, go to: IAM & Admin > Service Accounts.
2. Click on the service account that you created.
3. In the Keys tab, click Add key, and then select Create new key.
4. In the Create private key dialog, select JSON as the key type.
5. Click Create. The key file is automatically downloaded to your local system.

Open the downloaded JSON file and copy its contents. Use these details when configuring the Gigamon Insights.

Acquire OpenAI Credentials

To acquire OpenAI credentials, perform the following steps:

Before you begin, ensure the following:

You have an OpenAI account. If you don't have one, you can create it at OpenAI Platform.

You have added a payment method in the Billing section of your OpenAI account. This is required to enable API access.

1.   Log in to OpenAI.
2. Open the API Keys page.
3. Click Create new secret key.
4. Give the key a name (optional) and create it.
5. Copy the key immediately and store it securely. For security reasons, you will not be able to view the full key again after closing the dialog.
6. After creating your key, review your usage and rate limits to avoid unexpected interruptions.

Set up MCP Server

Configure either the Splunk MCP server or the Elastic MCP server based on your deployment, and skip the section that does not apply. For detailed steps to obtain the required endpoint and credentials, refer to the:

■   Acquire Splunk MCP Server Endpoint and API Key
■   Acquire Elastic Endpoint and API Key

Acquire Splunk MCP Server Endpoint and API Key

Before you begin, ensure the following:

■   Splunk MCP Server version 1.2.0 is installed in your Splunk deployment.
■   For AMX deployments, Gigamon Deep Observability App - JSON (GDOA - JSON) version 2.3.4 is installed.
■   For CEF deployments, the Gigamon Technology Add-on (TA) is installed.

Refer to Prerequisites for Gigamon Insights Deployment

Make sure the Splunk user account you use has the required capabilities. Add the following capabilities to the user role:

■   mcp_tool_execute
■   mcp_tool_admin

Note:  Gigamon Insights requires a 10-minute server‑side timeout in Splunk MCP Server 1.2.0. If this value is not configured, long‑running queries can time out before Gigamon Insights receives a response. Configure the server‑side timeout to 10 minutes before connecting to Gigamon Insights.

To acquire Splunk credentials, perform the following steps:

1.   Log in to your Splunk Web UI as a user who has the required capabilities.
2. Navigate to Apps > Find More Apps > Splunk MCP Server.
3. If you are installing Splunk MCP Server for the first time, enter your Splunk user name and password when prompted, and install the app.
4. If Splunk MCP Server is already installed, open the Splunk MCP Server app.
5. On the Splunk MCP Server page, click Create MCP Encrypted Token.
6. In the Create MCP Encrypted Token dialog:
a. From User, select the user account for which you want to create the token.
b. Audience - enter mcp.
c. Expiration - Specify when the token should expire.
d. Select Create.
e. Copy the displayed token—it will only appear once.
f. Copy the endpoint URL displayed in the Endpoint.

Use the copied endpoint URL and API key in GigaVUE‑FM.

Acquire Elastic Endpoint and API Key

Note:  Support for the local Elastic MCP server is discontinued. If you previously used a local MCP server, you must migrate to the Elastic Agent Builder (remote MCP server) before connecting Gigamon Insights.

Gigamon Insights supports Elastic versions 9.3.0 through 9.4.2, available for both on premises (self‑managed) deployments and Elastic Cloud. All Elastic deployments use the remote MCP server (Elastic Agent Builder), which reached General Availability (GA) in Elastic 9.3.0.

Before you begin, make sure you have an Elastic account with either of the following privileges:

■   manage_api_key
■   admin

Acquire Elastic credentials (Remote MCP Server)

To acquire credentials from Elastic 9.2 or later (Remote MCP Server), refer to the detailed steps in Elastic Agent Builder MCP server.

Use the endpoint URL and API key in GigaVUE‑FM

Enable Gigamon Insights in GigaVUE‑FM

After you acquire the LLM and MCP server credentials, follow these steps to enable Gigamon Insights in GigaVUE‑FM:

Note:  To enable Gigamon Insights, you must be a member of the fm_admin or fm_super_admin user group in GigaVUE‑FM.

1.   Sign in to GigaVUE‑FM. Navigate to Settings > Systems > Gigamon Insights.
2. Select the Gigamon Insights instance configured for this GigaVUE-FM and, under the Actions drop-down list, click Configure.
3. Before configuring LLM and server settings, you need to confirm your terms with the Gigamon AI Usage Telemetry Data Collection & Usage Notice.

Note:  In this LA release, accepting AI usage telemetry is required to use Gigamon Insights. If you do not accept the usage terms, you cannot enable or access this feature.

4. [Optional] Enter your Customer ID when you accept the terms and conditions.
5. Click Next. The Add LLM Provider page appears. On the Add LLM Provider page, enter the following:
a. Select an LLM provider (Amazon Bedrock, OpenAI, or Google Vertex AI).
•   Access Keys - Enter the Access Key, Secret Key, and Session Token, then set the Region. Enter the required credentials and endpoint details.
b. Click Test Connection to validate connectivity to the provider. Select one or more supported LLM models. If you select multiple models, choose a Default LLM Model. Only one model can be set as the default. If proxy is enabled, the connection test validates connectivity through the configured proxy.
6. Click Next. On the Add MCP Server page, enter the following:
a. Select a data tool (Elastic or Splunk).
b. Enter the endpoint URL and API key from your MCP server.
7. Click Save to apply the configuration.

What to do next

Refer to Get Started with Gigamon Insights.