- Elastic integrations
- Integrations quick reference
- 1Password
- Abnormal Security
- ActiveMQ
- Active Directory Entity Analytics
- Airflow
- Akamai
- Apache
- API (custom)
- Arbor Peakflow SP Logs
- Arista NG Firewall
- Atlassian
- Auditd
- Auth0
- authentik
- AWS
- Amazon CloudFront
- Amazon DynamoDB
- Amazon EBS
- Amazon EC2
- Amazon ECS
- Amazon EMR
- AWS API Gateway
- Amazon GuardDuty
- AWS Health
- Amazon Kinesis Data Firehose
- Amazon Kinesis Data Stream
- Amazon Managed Streaming for Apache Kafka (MSK)
- Amazon NAT Gateway
- Amazon RDS
- Amazon Redshift
- Amazon S3
- Amazon S3 Storage Lens
- Amazon Security Lake
- Amazon SNS
- Amazon SQS
- Amazon VPC
- Amazon VPN
- AWS Bedrock
- AWS Billing
- AWS CloudTrail
- AWS CloudWatch
- AWS ELB
- AWS Fargate
- AWS Inspector
- AWS Lambda
- AWS Logs (custom)
- AWS Network Firewall
- AWS Route 53
- AWS Security Hub
- AWS Transit Gateway
- AWS Usage
- AWS WAF
- Azure
- Activity logs
- App Service
- Application Gateway
- Application Insights metrics
- Application Insights metrics overview
- Application State Insights metrics
- Azure logs (v2 preview)
- Azure OpenAI
- Billing metrics
- Container instance metrics
- Container registry metrics
- Container service metrics
- Custom Azure Logs
- Custom Blob Storage Input
- Database Account metrics
- Event Hub input
- Firewall logs
- Frontdoor
- Functions
- Microsoft Entra ID
- Monitor metrics
- Network Watcher VNet
- Network Watcher NSG
- Platform logs
- Resource metrics
- Spring Cloud logs
- Storage Account metrics
- Virtual machines metrics
- Virtual machines scaleset metrics
- Barracuda
- BeyondInsight and Password Safe Integration
- BitDefender
- Bitwarden
- blacklens.io
- Blue Coat Director Logs
- BBOT (Bighuge BLS OSINT Tool)
- Box Events
- Bravura Monitor
- Broadcom ProxySG
- Canva
- Cassandra
- CEL Custom API
- Ceph
- Check Point
- Cilium Tetragon
- CISA Known Exploited Vulnerabilities
- Cisco
- Cisco Meraki Metrics
- Citrix
- Claroty CTD
- Cloudflare
- Cloud Asset Inventory
- CockroachDB Metrics
- Common Event Format (CEF)
- Containerd
- CoreDNS
- Corelight
- Couchbase
- CouchDB
- Cribl
- CrowdStrike
- Cyberark
- Cybereason
- CylanceProtect Logs
- Custom Websocket logs
- Darktrace
- Data Exfiltration Detection
- DGA
- Digital Guardian
- Docker
- DomainTools Real Time Unified Feeds
- Elastic APM
- Elastic Fleet Server
- Elastic Security
- Elastic Stack monitoring
- Elasticsearch Service Billing
- Envoy Proxy
- ESET PROTECT
- ESET Threat Intelligence
- etcd
- Falco
- F5
- File Integrity Monitoring
- FireEye Network Security
- First EPSS
- Forcepoint Web Security
- ForgeRock
- Fortinet
- Gigamon
- GitHub
- GitLab
- Golang
- Google Cloud
- Custom GCS Input
- GCP
- GCP Audit logs
- GCP Billing metrics
- GCP Cloud Run metrics
- GCP CloudSQL metrics
- GCP Compute metrics
- GCP Dataproc metrics
- GCP DNS logs
- GCP Firestore metrics
- GCP Firewall logs
- GCP GKE metrics
- GCP Load Balancing metrics
- GCP Metrics Input
- GCP PubSub logs (custom)
- GCP PubSub metrics
- GCP Redis metrics
- GCP Security Command Center
- GCP Storage metrics
- GCP VPC Flow logs
- GCP Vertex AI
- GoFlow2 logs
- Hadoop
- HAProxy
- Hashicorp Vault
- HTTP Endpoint logs (custom)
- IBM MQ
- IIS
- Imperva
- InfluxDb
- Infoblox
- Iptables
- Istio
- Jamf Compliance Reporter
- Jamf Pro
- Jamf Protect
- Jolokia Input
- Journald logs (custom)
- JumpCloud
- Kafka
- Keycloak
- Kubernetes
- LastPass
- Lateral Movement Detection
- Linux Metrics
- Living off the Land Attack Detection
- Logs (custom)
- Lumos
- Lyve Cloud
- Mattermost
- Memcached
- Menlo Security
- Microsoft
- Microsoft 365
- Microsoft Defender for Cloud
- Microsoft Defender for Endpoint
- Microsoft DHCP
- Microsoft DNS Server
- Microsoft Entra ID Entity Analytics
- Microsoft Exchange Online Message Trace
- Microsoft Exchange Server
- Microsoft Graph Activity Logs
- Microsoft M365 Defender
- Microsoft Office 365 Metrics Integration
- Microsoft Sentinel
- Microsoft SQL Server
- Mimecast
- ModSecurity Audit
- MongoDB
- MongoDB Atlas
- MySQL
- Nagios XI
- NATS
- NetFlow Records
- Netskope
- Network Beaconing Identification
- Network Packet Capture
- Nginx
- Okta
- Oracle
- OpenAI
- OpenCanary
- Osquery
- Palo Alto
- pfSense
- PHP-FPM
- PingOne
- PingFederate
- Pleasant Password Server
- PostgreSQL
- Prometheus
- Proofpoint TAP
- Proofpoint On Demand
- Pulse Connect Secure
- Qualys VMDR
- QNAP NAS
- RabbitMQ Logs
- Radware DefensePro Logs
- Rapid7
- Redis
- Rubrik RSC Metrics Integration
- Sailpoint Identity Security Cloud
- Salesforce
- SentinelOne
- ServiceNow
- Slack Logs
- Snort
- Snyk
- SonicWall Firewall
- Sophos
- Spring Boot
- SpyCloud Enterprise Protection
- SQL Input
- Squid Logs
- SRX
- STAN
- Statsd Input
- Sublime Security
- Suricata
- StormShield SNS
- Symantec
- Symantec Endpoint Security
- Sysmon for Linux
- Sysdig
- Syslog Router Integration
- System
- System Audit
- Tanium
- TCP Logs (custom)
- Teleport
- Tenable
- Threat intelligence
- ThreatConnect
- Threat Map
- Thycotic Secret Server
- Tines
- Traefik
- Trellix
- Trend Micro
- TYCHON Agentless
- UDP Logs (custom)
- Universal Profiling
- Vectra Detect
- VMware
- WatchGuard Firebox
- WebSphere Application Server
- Windows
- Wiz
- Zeek
- ZeroFox
- Zero Networks
- ZooKeeper Metrics
- Zoom
- Zscaler
Microsoft DHCP
editMicrosoft DHCP
editVersion |
1.25.0 (View all) |
Compatible Kibana version(s) |
7.14.0 or higher |
Supported Serverless project types |
Security |
Subscription level |
Basic |
Level of support |
Elastic |
This integration collects logs and metrics from Microsoft DHCP logs.
Compatibility
editThis integration has been made to support the DHCP log format from Windows Server 2008 and later.
Logs
editIngest logs from Microsoft DHCP Server, by default logged with the filename format:
%windir%\System32\DHCP\DhcpSrvLog-*.log
Logs may also be ingested from Microsoft DHCPv6 Server, by default logged with the filename format:
%windir%\System32\DHCP\DhcpV6SrvLog-*.log
Relevant documentation for Microsoft DHCP can be found on this location.
Example
An example event for log
looks as following:
{ "@timestamp": "2001-01-01T01:01:01.000-05:00", "agent": { "ephemeral_id": "599c360c-711b-41f0-8b3b-03101ce1808b", "id": "0874c904-40cc-4817-b0f8-557b17245c75", "name": "docker-fleet-agent", "type": "filebeat", "version": "8.8.0" }, "data_stream": { "dataset": "microsoft_dhcp.log", "namespace": "ep", "type": "logs" }, "ecs": { "version": "8.11.0" }, "elastic_agent": { "id": "0874c904-40cc-4817-b0f8-557b17245c75", "snapshot": false, "version": "8.8.0" }, "event": { "action": "dhcp-dns-update", "agent_id_status": "verified", "category": [ "network" ], "code": "35", "dataset": "microsoft_dhcp.log", "ingested": "2023-10-24T00:08:40Z", "kind": "event", "original": "35,01/01/01,01:01:01,DNS update request failed,192.168.2.1,host.test.com,000000000000,", "outcome": "failure", "reason": "DNS update request failed.", "timezone": "America/New_York", "type": [ "connection", "denied" ] }, "host": { "ip": [ "192.168.128.7" ], "mac": [ "02-42-C0-A8-80-07" ], "name": "docker-fleet-agent" }, "input": { "type": "log" }, "log": { "file": { "path": "/tmp/service_logs/test-dhcp.log" }, "offset": 2407 }, "message": "DNS update request failed", "observer": { "hostname": "docker-fleet-agent", "ip": [ "192.168.128.7" ], "mac": [ "02-42-C0-A8-80-07" ] }, "source": { "address": "host.test.com", "domain": "host.test.com", "ip": "192.168.2.1", "mac": "00-00-00-00-00-00" }, "tags": [ "preserve_original_event", "forwarded", "microsoft_dhcp" ] }
Exported fields
Field | Description | Type |
---|---|---|
@timestamp |
Event timestamp. |
date |
data_stream.dataset |
Data stream dataset. |
constant_keyword |
data_stream.namespace |
Data stream namespace. |
constant_keyword |
data_stream.type |
Data stream type. |
constant_keyword |
ecs.version |
ECS version this event conforms to. |
keyword |
event.action |
The action captured by the event. This describes the information in the event. It is more specific than |
keyword |
event.category |
This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. |
keyword |
event.code |
Identification code for this event, if one exists. Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. |
keyword |
event.dataset |
Event dataset |
constant_keyword |
event.ingested |
Timestamp when an event arrived in the central data store. This is different from |
date |
event.kind |
This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. |
keyword |
event.module |
Event module |
constant_keyword |
event.original |
Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from |
keyword |
event.outcome |
This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy. |
keyword |
event.reason |
Reason why this event happened, according to the source. This describes the why of a particular action or outcome captured in the event. Where |
keyword |
event.timezone |
This field should be populated when the event’s timestamp does not include timezone information already (e.g. default Syslog timestamps). It’s optional otherwise. Acceptable timezone formats are: a canonical ID (e.g. "Europe/Amsterdam"), abbreviated (e.g. "EST") or an HH:mm differential (e.g. "-05:00"). |
keyword |
event.type |
This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. |
keyword |
host.domain |
Name of the domain of which the host is a member. For example, on Windows this could be the host’s Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host’s LDAP provider. |
keyword |
host.ip |
Host ip addresses. |
ip |
host.mac |
Host MAC addresses. The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. |
keyword |
host.name |
Name of the host. It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host. |
keyword |
input.type |
keyword |
|
log.file.path |
Full path to the log file this event came from, including the file name. It should include the drive letter, when appropriate. If the event wasn’t read from a log file, do not populate this field. |
keyword |
log.offset |
long |
|
message |
For log events the message field contains the log message, optimized for viewing in a log viewer. For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. If multiple messages exist, they can be combined into one message. |
match_only_text |
microsoft.dhcp.correlation_id |
The NAP correlation ID related to the client/server transaction. |
keyword |
microsoft.dhcp.dhc_id |
The related DHCID (DHC DNS record). |
keyword |
microsoft.dhcp.dns_error_code |
DNS error code communicated to client. |
keyword |
microsoft.dhcp.duid.hex |
The related DHCP Unique Identifier (DUID) for the host (DHCPv6). |
keyword |
microsoft.dhcp.duid.length |
The length of the DUID field. |
keyword |
microsoft.dhcp.error_code |
DHCP server error code. |
keyword |
microsoft.dhcp.probation_time |
The probation time before lease ends on specific IP. |
keyword |
microsoft.dhcp.relay_agent_info |
Information about DHCP relay agent used for the DHCP request. |
keyword |
microsoft.dhcp.result |
The DHCP result type in numerical value, for example "NoQuarantine" is 0, "Quaratine" is 1, "Drop Packet" is 2 etc. |
keyword |
microsoft.dhcp.result_description |
The DHCP result type from numerical value, for example, 0 is "NoQuarantine", 1 is "Quarantine", 2 is "Drop Packet" etc. |
keyword |
microsoft.dhcp.subnet_prefix |
The number of bits for the subnet prefix. |
keyword |
microsoft.dhcp.transaction_id |
The DHCP transaction ID. |
keyword |
microsoft.dhcp.user.hex |
Hex representation of the user. |
keyword |
microsoft.dhcp.user.string |
String representation of the user. |
keyword |
microsoft.dhcp.vendor.hex |
Hex representation of the vendor. |
keyword |
microsoft.dhcp.vendor.string |
String representation of the vendor. |
keyword |
observer.hostname |
Hostname of the observer. |
keyword |
observer.ip |
IP addresses of the observer. |
ip |
observer.mac |
MAC addresses of the observer. The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. |
keyword |
source.address |
Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the |
keyword |
source.domain |
The domain name of the source system. This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. |
keyword |
source.ip |
IP address of the source (IPv4 or IPv6). |
ip |
source.mac |
MAC address of the source. The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. |
keyword |
tags |
List of keywords used to tag each event. |
keyword |
user.name |
Short name or login of the user. |
keyword |
user.name.text |
Multi-field of |
match_only_text |
Changelog
editChangelog
Version | Details | Kibana version(s) |
---|---|---|
1.25.0 |
Enhancement (View pull request) |
7.14.0 or higher |
1.24.3 |
Bug fix (View pull request) |
7.14.0 or higher |
1.24.2 |
Enhancement (View pull request) |
7.14.0 or higher |
1.24.1 |
Bug fix (View pull request) |
7.14.0 or higher |
1.24.0 |
Enhancement (View pull request) |
7.14.0 or higher |
1.23.0 |
Enhancement (View pull request) |
7.14.0 or higher |
1.22.0 |
Enhancement (View pull request) |
7.14.0 or higher |
1.21.0 |
Enhancement (View pull request) |
7.14.0 or higher |
1.20.0 |
Enhancement (View pull request) |
7.14.0 or higher |
1.19.0 |
Enhancement (View pull request) |
7.14.0 or higher |
1.18.0 |
Enhancement (View pull request) |
7.14.0 or higher |
1.17.0 |
Enhancement (View pull request) |
7.14.0 or higher |
1.16.0 |
Enhancement (View pull request) |
7.14.0 or higher |
1.15.0 |
Enhancement (View pull request) |
7.14.0 or higher |
1.14.0 |
Enhancement (View pull request) |
7.14.0 or higher |
1.13.0 |
Enhancement (View pull request) |
7.14.0 or higher |
1.12.0 |
Enhancement (View pull request) |
7.14.0 or higher |
1.11.0 |
Enhancement (View pull request) |
7.14.0 or higher |
1.10.1 |
Enhancement (View pull request) |
7.14.0 or higher |
1.10.0 |
Enhancement (View pull request) |
7.14.0 or higher |
1.9.0 |
Enhancement (View pull request) |
7.14.0 or higher |
1.8.0 |
Enhancement (View pull request) |
7.14.0 or higher |
1.7.1 |
Enhancement (View pull request) |
7.14.0 or higher |
1.7.0 |
Enhancement (View pull request) |
7.14.0 or higher |
1.6.0 |
Enhancement (View pull request) |
7.14.0 or higher |
1.5.0 |
Enhancement (View pull request) |
7.14.0 or higher |
1.4.2 |
Bug fix (View pull request) |
7.14.0 or higher |
1.4.1 |
Bug fix (View pull request) |
7.14.0 or higher |
1.4.0 |
Enhancement (View pull request) |
7.14.0 or higher |
1.3.1 |
Enhancement (View pull request) |
7.14.0 or higher |
1.3.0 |
Enhancement (View pull request) |
7.14.0 or higher |
1.2.0 |
Enhancement (View pull request) |
— |
1.1.0 |
Enhancement (View pull request) |
7.14.0 or higher |
1.0.0 |
Enhancement (View pull request) |
— |
0.2.1 |
Bug fix (View pull request) |
— |
0.2.0 |
Enhancement (View pull request) |
— |
0.1.1 |
Enhancement (View pull request) |
— |
0.1.0 |
Enhancement (View pull request) |
— |
On this page