# Do we have SIEM dashboards and detection anomaly for DHCP logs? **URL:** \ **Category:** SIEM\ **Created:** [May 5, 2020, 1:34pm UTC](https://discuss.elastic.co/t/do-we-have-siem-dashboards-and-detection-anomaly-for-dhcp-logs/231161 "2020-05-05T13:34:27Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![sundar\_elk](https://avatars.discourse-cdn.com/v4/letter/s/db5fbb/32.png) [@sundar\_elk](https://discuss.elastic.co/u/sundar_elk)\ **Post date:** [May 5, 2020, 1:34pm UTC](https://discuss.elastic.co/t/do-we-have-siem-dashboards-and-detection-anomaly-for-dhcp-logs/231161/1 "2020-05-05T13:34:28Z")
Hi Team, I have on boarded DHCP logs into ELK and looking for SIEM detection anomaly for DHCP logs. I didn't seen anything dashboard related for DHCP logs in SIEM DHCP logs example :-1 Fields: ID,Date,Time,Description,IP Address,Host Name,MAC Address,User Name, TransactionID, QResult,Probationtime, CorrelationID,Dhcid,VendorClass(Hex),VendorClass(ASCII),UserClass(Hex),UserClass(ASCII),RelayAgentInformation,DnsRegError. logs :- 24,11/25/16,00:00:36,Database Cleanup Begin,,,,,0,6,,,,,,,,,0 30,11/25/16,00:00:36,DNS Update Request,10.115.0.70,HOSTNAME,,,0,6,,,,,,,,,0 I have converted all fields according ECS format in logstash "%{DATA:id},%{DATE\_US:date},(?%{HOUR}:%{MINUTE}:%{SECOND}),%{DATA:description},%{IPV4:[source][ip]},%{DATA:[source][hostname]},%{DATA:mac},%{DATA:[user][name]},%{INT:[transaction][id]},%{INT:[q][result]},%{DATA:[probation][time]},%{DATA:[correlation][id]},%{DATA:dhcid},%{DATA:[vendorclass][hex]},%{DATA:[vendorClass][ascii]},%{DATA:[userclass][hex]},%{DATA:[userclass][ascii]},%{DATA:[relayagen][information]},%{INT:[dns][reg][error]}"} Can you please suggest me is DHCP logs will work for SIEM module? ---
**Author:** ![Devin\_Hurley](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/devin_hurley/32/62660_2.png) [@Devin\_Hurley](https://discuss.elastic.co/u/Devin_Hurley)\ **Post date:** [May 5, 2020, 7:42pm UTC](https://discuss.elastic.co/t/do-we-have-siem-dashboards-and-detection-anomaly-for-dhcp-logs/231161/2 "2020-05-05T19:42:40Z")
Hi Sundar, Given some caveats, yes, your DHCP logs will work for SIEM anomalies. SIEM anomalies are built on top of Machine Learning jobs in the Elastic stack, which will create anomalies based on data in specific indexes that are specific to certain ML jobs. A list of available jobs can be found [here](https://www.elastic.co/guide/en/machine-learning/7.6/ootb-ml-jobs-siem.html). In order to get your DHCP data analyzed for anomalies with SIEM, you will need to determine which jobs you want running, ensure you have the necessary ECS fields mapped in order for those jobs to run, and have the index the DHCP data is in be compatible with the index pattern in the according ML jobs. The ML jobs were built to analyze data indexed by Beats, so the index pattern for the ML jobs will be mostly representative of Beats index patterns. For example if you wanted to run the job `packetbeat_rare_dns_question` you would ensure the fields - `host.name` - `dns.question.name` - `dns.question.type` - `event.dataset` - `agent.type` are mapped properly and the index which the data resides in matches `packetbeat-*` index pattern. If you want to see which index patterns are needed for which jobs, [this](https://github.com/elastic/kibana/blob/7.6/x-pack/legacy/plugins/ml/server/models/data_recognizer/modules/siem_packetbeat/manifest.json#L7) is an example of the manifest that you could check to see which jobs require which indexes. The docs to the jobs should provide information on which ECS fields you need. Also, I do find it helpful to look at the "inspect" button [1] on the tables in the SIEM as that can be helpful in finding what ECS fields I should have mapped so the data I want to see in the tables is visible. [1]: ![Screen Shot 2020-05-05 at 3.37.29 PM](https://us1.discourse-cdn.com/elastic/original/3X/6/b/6b7f8d57f4494bf149e656cef29efe7f500bb3dc.png) ---
**Author:** ![sundar\_elk](https://avatars.discourse-cdn.com/v4/letter/s/db5fbb/32.png) [@sundar\_elk](https://discuss.elastic.co/u/sundar_elk)\ **Post date:** [May 6, 2020, 4:56am UTC](https://discuss.elastic.co/t/do-we-have-siem-dashboards-and-detection-anomaly-for-dhcp-logs/231161/3 "2020-05-06T04:56:17Z")
Thanks Devin for quick response. I agree with you for DNS query logs. looks like no predefined jobs for DHCP logs. I can able to get all hosts table data for dhcp. Apart from that no SIEM dashboards. Is nay correlation between DHCP and other logs? Do we need to follow any mandatory field for DHCP logs? DHCP logs are providing log format is **Fields** : ID,Date,Time,Description,IP Address,Host Name,MAC Address,User Name, TransactionID, QResult,Probationtime, CorrelationID,Dhcid,VendorClass(Hex),VendorClass(ASCII),UserClass(Hex),UserClass(ASCII),RelayAgentInformation,DnsRegError **log** :- 30,11/25/16,00:00:36,DNS Update Request,10.115.0.70,HOSTNAME,,,0,6,,,,,,,,,0 **Below one is our json data and following ECS format** :- ```auto { "_index": "test-dhcp-2020.05.06", "_type": "_doc", "_id": "6fJN6HEBoMLvblKuJ75v", "_version": 1, "_score": null, "_source": { "vendorclass": { "hex": "0x4D53465420352E30" }, "@version": "1", "_@timestamp": 1588740298.96666, "type": "test-windows-dhcp", "vendorClass": { "ascii": "MSFT 5.0" }, "transaction": { "id": "3393005611" }, "date_field": "05/06/20 08:44:58", "@timestamp": "2020-05-06T04:44:58.000Z", "time": "08:44:58", "dns": { "reg": { "error": "0" } }, "event": "A lease was renewed by a client", "source": { "ip": "10.115.1.16", "hostname": "host" }, "tailed_path": "C:\\Windows\\System32\\dhcp\\DhcpSrvLog-Wed.log", "id": "11", "mac": "00505691E822", "q": { "result": "0" }, "date": "05/06/20", "message": "11,05/06/20,08:44:58,Renew,10.115.1.16,test,00505691E822,,3393005611,0,,,,0x4D53465420352E30,MSFT 5.0,,,,0", "description": "Renew" }, "fields": { "@timestamp": [ "2020-05-06T04:44:58.000Z" ] }, "sort": [ 1588740298000 ] } ``` ---
**Author:** ![richcollier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/richcollier/32/115035_2.png) [@richcollier](https://discuss.elastic.co/u/richcollier)\ **Post date:** [May 6, 2020, 5:27pm UTC](https://discuss.elastic.co/t/do-we-have-siem-dashboards-and-detection-anomaly-for-dhcp-logs/231161/4 "2020-05-06T17:27:10Z")
I'm curious as to what kinds of anomalies you think would be useful to detect on this data - because obviously you could just create your own custom ML jobs! 🙂 ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 3, 2020, 5:27pm UTC](https://discuss.elastic.co/t/do-we-have-siem-dashboards-and-detection-anomaly-for-dhcp-logs/231161/5 "2020-06-03T17:27:20Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.