Windows DHCP

Overview

Windows DHCP reads events from Windows DHCP Server event channels.

Supported platforms

• Windows: Logs

Event Channels

Parameter	Type	Default Value	Required	Description
operational	boolean	true	No	Enable reading from the Microsoft-Windows-Dhcp-Server/Operational event channel.
filter_notifications	boolean	false	No	Enable reading from the Microsoft-Windows-Dhcp-Server/FilterNotifications event channel.
dhcp_admin_events	boolean	false	No	Enable reading from the DhcpAdminEvents event channel.

Basic Configuration

Parameter	Type	Default Value	Required	Description
max_reads	integer	100	No	The maximum number of messages to read from the channel.
start_at	string	end	No	Specify whether to start reading from the beginning or end of the channel.
poll_interval	string	1s	No	The time interval between polling attempts (polling mode only).
query	string	none	No	A custom query to filter or retrieve data.

Collection Method (Streaming vs Polling)

By default the receiver polls each channel every poll_interval. Enabling event_driven_scraping switches to streaming: the receiver wakes on Windows API signals as events arrive, lowering latency and avoiding idle wakeups. Streaming is Windows-only.

Parameter	Type	Default Value	Required	Description
event_driven_scraping	boolean	false	No	When true, stream events via Windows API signals instead of polling on a fixed interval.
wait_timeout	string	5s	No	Max time to wait for new events before a safety-net poll while streaming. Ignored when streaming is off.

SID Resolution

When enabled, Windows Security Identifiers (e.g. S-1-5-18) are resolved to human-readable account/domain names. Windows-only. Resolved values are cached (LRU) to limit repeated lookups.

Parameter	Type	Default Value	Required	Description
resolve_sids.enabled	boolean	false	No	Activates SID-to-name resolution.
resolve_sids.cache_size	integer	10000	No	Maximum number of SID-to-name mappings to cache (LRU eviction).
resolve_sids.cache_ttl	string	15m	No	How long cached mappings remain valid. Must not be negative.

Attributes & Resources

Parameter	Type	Default Value	Required	Description
attributes	object	{}	No	A collection of key-value pair attributes for the channel.
resource	object	{}	No	Defines the resource as key-value pairs.

Advanced Settings

Parameter	Type	Default Value	Required	Description
raw	boolean	false	No	When enabled, reads the raw data without any parsing.
suppress_rendering_info	boolean	false	No	Disables the display of rendering information in the output.
include_log_record_original	boolean	false	No	When enabled, adds the log.record.original attribute holding the original event XML (rendered according to suppress_rendering_info).
exclude_providers	array	[]	No	A list of providers to exclude from the data source.
storage	string	none	No	The storage method to use for the data.

Retry Settings

If retry on failure is enabled:

Parameter	Type	Default Value	Required	Description
enabled	boolean	false	Conditional	Activates the retry mechanism on a failed read.
initial_interval	string	1s	Conditional	The first delay before retrying.
max_interval	string	30s	Conditional	The maximum delay between retries.
max_elapsed_time	string	5m	Conditional	The total time to keep retrying.

Remote Connection Settings

Parameter	Type	Default Value	Required	Description
server	string	none	Conditional	The address of the remote server.
username	string	none	Conditional	The username for the remote server.
password	string	none	Conditional	The password for the remote server.
domain	string	none	Conditional	The domain for the remote connection.

Example Configuration

{
  "operational": true, // default: true
  "filter_notifications": false, // default: false
  "dhcp_admin_events": false, // default: false
  "max_reads": 100, // default: 100
  "start_at": "end", // default: "end"
  "poll_interval": "1s", // default: "1s" (polling mode only)

  "event_driven_scraping": false, // default: false (set true for streaming)
  "wait_timeout": "5s", // default: "5s" (used only when streaming)

  "resolve_sids": {
    "enabled": false, // default: false
    "cache_size": 10000, // default: 10000
    "cache_ttl": "15m", // default: "15m"
  },

  "raw": false, // default: false
  "query": "",

  "retry_on_failure": {
    "enabled": false, // default: false
  },

  "remote": {
    "server": "",
  },
}