Skip to content

Windows DHCP


Every device on a TCP/IP-based network must have a unique unicast IP address to access the network and its resources. Without DHCP, IP addresses for new computers or computers that are moved from one subnet to another must be configured manually; IP addresses for computers that are removed from the network must be manually reclaimed. With DHCP, this entire process is automated and managed centrally. The DHCP server maintains a pool of IP addresses and leases an address to any DHCP-enabled client when it starts up on the network. Because the IP addresses are dynamic (leased) rather than static (permanently assigned), addresses no longer in use are automatically returned to the pool for reallocation. (Windows DHCP)

Product Details

Vendor URL: Windows DHCP

Product Type: DHCP

Product Tier: Tier I

Integration Method: Syslog

Integration URL: Windows DHCP - Cyderes Documentation

Log Guide: NXLog Reference Page

Parser Details

Log Format: Syslog, KV, and JSON

Expected Normalization Rate: Near 100%


UDM Fields (list of all UDM fields leveraged in the Parser):

Log File Field UDM Field
AccountName principal.user.userid
additional_field additional.fields
ASCIIUserClass metadata.ingestion_labels
ASCIIVendorClass metadata.ingestion_labels
bytes network.dhcp.client_identifier
Category EventID metadata.product_event_type
Channel principal.process.file.full_path
Channel EventID metadata.product_event_type
ClientID principal.user.product_object_id
ClientName principal.user.userid
Description metadata.description
Dhcid network.dhcp.client_identifier
Domain principal.administrative_domain
EventID metadata.product_event_type
EventID security_result.rule_name
EventType security_result.summary
EventType Opcode security_result.summary
formatted_mac network.dhcp.chaddr
formatted_mac principal.mac
Hostname network.dhcp.client_hostname
Hostname principal.hostname
HWType network.dhcp.htype
ID metadata.product_event_type
ID security_result.rule_name
IPAddress network.dhcp.ciaddr
IPAddress network.dhcp.yiaddr
MACAddress principal.mac
Message metadata.description
Opcode security_result.summary
operation security_result.description
options network.dhcp.options
PartnerServer target.hostname
PhysicalAddress principal.mac
resource_type target.resource.resource_type
ScopeName principal.namespace
Server target.hostname
severity security_result.severity
sourcemodulename metadata.ingestion_labels
sourcemoduletype metadata.ingestion_labels
target.ip Server
target.ip tempPartnerIP
tempIP principal.ip
TransactionID metadata.product_log_id
TransactionID network.dhcp.transaction_id

Product Event Types

Description metadata.event_type
If ID = 10, 11, 12, 13, 14, 15, 16, 17, 18, 20, 21, 22, 23 NETWORK_DHCP
If any of HostName, IPAddress, MACAddress, and UserName are not provided SYSTEM_AUDIT_LOG_UNCATEGORIZED


<13>1 2021-12-10T07:53:19.026537-06:00 servername01 - - - [NXLOG@123456 EventReceivedTime="2021-12-10 07:53:19" SourceModuleName="dhcp" SourceModuleType="im_file"] 10,12/10/21,07:53:18,Assign,,,112233445566,,123456789,0,,,,,,,,,0  

NETWORK_DHCP Sample Parsing

metadata.event_timestamp.seconds= 1639122798
metadata.product_log_id= "123456789"
metadata.event_type= NETWORK_DHCP
metadata.vendor_name= "Microsoft"
metadata.product_name= "Windows DHCP"
metadata.product_event_type= "EventID= 10"
metadata.description= "Assign"
principal.ip= ""
principal.mac= "11=22=33=44=55=66"
intermediary.hostname= "servername01"
security_result.rule_name= "EventID= 10"
security_result.action= ALLOW
network.direction= OUTBOUND
network.application_protocol= DHCP
network.dhcp.transaction_id= 123456789
network.yiaddr= ""
network.chaddr= "11=22=33=44=55=66"
network.type= ACK
network.client_hostname= ""

Windows Eventlog Log Sample

<11>1 2021-12-10T08:08:23.572248+00:00 host.domain.local Microsoft-Windows-DHCP-Server 3684 - [NXLOG@14506 Keywords="1234567890" EventType="ERROR" EventID="20287" ProviderGuid="{95c8fda2-59f5-11ec-bf63-0242ac130002}" Version="0" TaskValue="0" OpcodeValue="0" RecordNumber="1242711" ExecutionThreadID="1122" Channel="DhcpAdminEvents" Domain="NT AUTHORITY" AccountName="NETWORK SERVICE" UserID="S-1-2-33" AccountType="Defined Group" Opcode="Info" ClientID="00A0B1C23D45" ScopeName="SCOPE_NAME_HERE" EventReceivedTime="2021-12-10 08:08:25" SourceModuleName="dhcp_server_eventlog" SourceModuleType="im_msvistalog"] DHCP client request from 00A0B1C23D45 was dropped since the applicable IP address ranges in scope/superscope SCOPE_NAME_HERE are out of available IP addresses. This could be because of IP address ranges of a policy being out of available IP addresses.  

Windows Eventlog Sample Parsing

metadata.event_timestamp.seconds= 1639123705
metadata.event_type= GENERIC_EVENT
metadata.vendor_name= "Microsoft"
metadata.product_name= "Windows DHCP"
metadata.product_event_type= "EventID= 20287"
metadata.description= "DHCP client request from 00A0B1C23D45 was dropped since the applicable IP address ranges in scope/superscope SCOPE_NAME_HERE are out of available IP addresses. This could be because of IP address ranges of a policy being out of available IP addresses."
metadata.ingestion_labels.key= "SourceModuleType"
metadata.ingestion_labels.value= "im_msvistalog"
metadata.ingestion_labels.key= "SourceModuleName"
metadata.ingestion_labels.value= "dhcp_server_eventlog"
principal.user.product_object_id= "00A0B1C23D45"
principal.user.userid= "NETWORK SERVICE"
principal.user.windows_sid= "S-1-2-33" "{95c8fda2-59f5-11ec-bf63-0242ac130002}" "Defined Group" "1122"
principal.process.file.full_path= "DhcpAdminEvents"
principal.administrative_domain= "NT AUTHORITY"
principal.namespace= "SCOPE_NAME_HERE"
intermediary.hostname= "host.domain.local"
security_result.rule_name= "EventID= 20287"
security_result.summary= "EventType= ERROR | Opcode= Info"
security_result.action= UNKNOWN_ACTION

Parser Alerting

This product currently does not have any Parser-based Alerting


Coming Soon