Documentation Index

Fetch the complete documentation index at: https://docs.hunters.ai/llms.txt

Use this file to discover all available pages before exploring further.

📢 Read the latest Release Notes to learn what's new on Hunters! 💡

Windows DHCP Audit Logs

  • Published on Aug 10, 2026
Prev Next
Self Service Ingestion

Connect this data source on your own, using the Hunters platform.

TL;DR

Supported data types

3rd party detection

Hunters detection

IOC search

Search

Table name

Log format

Collection method

windows-dhcp-audit-logs

✅

✅

✅

windows_dhcp_audit_logs

nested-json-csv

S3

Overview

Windows is a family of operating systems developed by Microsoft to manage computers, applications, users, networking, and system resources. In a Windows Server environment, the operating system provides various server roles and services that support essential enterprise infrastructure functions, including Active Directory, DNS, DHCP, file services, and network management.

Windows Server also provides comprehensive logging mechanisms that capture system and service-related activities. These logs enable administrators to monitor system operations, troubleshoot issues, investigate failures, and analyze events occurring within the IT environment.

For network infrastructure, DHCP (Dynamic Host Configuration Protocol) is an important Windows Server role. The DHCP Server service automatically assigns network configuration parameters to DHCP clients, including IP addresses, subnet masks, default gateways, and DNS server settings. This automated configuration simplifies network administration and ensures that devices receive the appropriate network settings required for communication.

Supported data types

Windows DHCP Audit Logs

Table name: windows_dhcp_audit_logs

DHCP (Dynamic Host Configuration Protocol) audit logs capture IP address lease events on the network, including assignments, renewals, releases, and DNS updates. These logs are valuable for IP-to-hostname correlation, network forensics, and lateral movement detection. Windows DHCP Server writes audit logs as CSV files which can be collected via Cribl and shipped to S3 in gzipped newline-delimited JSON format.

Learn more here.

Send data to Hunters

Hunters supports the collection of logs from Stripe through an intermediary AWS S3 bucket.

To connect Windows DHCP Audit Logs:

  1. Export your logs from Windows DHCP Audit to an AWS S3 bucket by following this guide.

  2. Once the export is completed and the logs are collected to S3, follow the steps in this section.

Expected format

Logs are expected in nested-json-csv format.

# EventID 11 - Renew
{"_raw":"11,07/26/26,20:11:36,Renew,10.0.0.1,HOSTNAME.domain.local,AABBCCDDEEFF,,1234567890,0,,,,0x4D53465420352E30,MSFT 5.0,,,0x0104090100000000000000000000,0","_time":1785114699.293,"host":"DHCP-SERVER-01","source":"C:\\Windows\\System32\\dhcp\\DhcpSrvLog-Sun.log","cribl_breaker":"fallback"}
# EventID 30 - DNS Update Request
{"_raw":"30,07/26/26,20:12:16,DNS Update Request,10.0.0.2,HOSTNAME2.domain.local,,,0,6,,,,,,,,,0","_time":1785114999.527,"host":"DHCP-SERVER-01","source":"C:\\Windows\\System32\\dhcp\\DhcpSrvLog-Sun.log","cribl_breaker":"fallback"}
# EventID 32 - DNS Update Successful
{"_raw":"32,07/26/26,22:46:52,DNS Update Successful,10.0.0.2,HOSTNAME2.domain.local,,,0,6,,,,,,,,,0","_time":1785124302.947,"host":"DHCP-SERVER-01","source":"C:\\Windows\\System32\\dhcp\\DhcpSrvLog-Sun.log","cribl_breaker":"fallback"}