...
Log Type | Ingestion label | Preferred Logging Protocol - Format | Log collection method |
|---|---|---|---|
Windows DHCP | WINDOWS_DHCP | SYSLOG | CyberHub |
Port Requirements
Source | Destination | Port |
|---|---|---|
Microsoft Windows DHCP | CyberHub | 10014 (TCP) |
Device Configuration
Configuring Microsoft DHCP:To facilitate secure communication and align with our best practice, we strongly encourage the use of Transport Layer Security (TLS) between your security devices and our Adaptive MxDR platform for event forwarding.
While we understand that TLS support may not be available on all devices, if your devices do support TLS communication, we recommend utilizing port 10014 for seamless integration.
In some cases, the upgraded version of the device might incorporate TLS support without prior notice. If you come across such a scenario or for further assistance in configuring TLS, we kindly ask you to reach out to your dedicated Adaptive MxDR Service Delivery Lead.
Device Configuration
To Configure Microsoft DHCP
By default, Microsoft DHCP audit logging is enabled.
...
Restart the DHCP server by right-clicking the server and clicking All Tasks > Restart.
See http://technet.microsoft.com/library/hh831825 for more details.
Steps to configure To Configure Windows NxLog Agent for TLS TCP Log flow on port 10014:
...
Property | Default Value | Description |
|---|---|---|
IP Address | Microsoft Windows DHCP interface IP address | Hostname or IP address of the device which forwards logs to the CyberHub. |
...