DHCP schema
Use this reference to identify the fields available in the dhcp schema and the parser fields used to populate them.
For a field to be populated in Sophos XDR, the corresponding parser field must be present in the source data.
Schema summary
| Property | Value |
|---|---|
| Schema name | DHCP |
| Parser field prefix | DHCP |
| Supports custom parsers | Yes |
| Schema components | DHCP_Action |
Schema components
Dhcp.DHCP_Action
| Name | Number | Description |
|---|---|---|
| UNKNOWN | 0 | Unused but required for Proto3. |
| DISCOVER | 1 | Client broadcast to discover DHCP servers. |
| OFFER | 2 | Server response to client discovery, which could be several offers. |
| REQUEST | 3 | Client request to a specific server. |
| INFORM | 4 | Client to server, used if a client needs network parameters but not an IP. |
| ACK | 5 | Server responses to REQUEST or INFORM. |
| NACK | 6 | |
| DECLINE | 7 | Optional client response to server's ACK. |
| RELEASE | 8 | Client to server, release of IP lease. |
| LEASE | 9 | Some devices don't report this much detail, only that a lease was obtained. |
Schema fields
| Normalized Field | Type | Parser Field | Description |
|---|---|---|---|
| resource_id | string | resourceId$ | Full resource string identifying the record. |
| tenant_id | string | tenantId$ | ID of the tenant. |
| sensor_type | string | sensorType$ | Type of device that generated this event. |
| sensor_event_id | string | sensorEventId$ | Event ID of original_data assigned by the sensor. |
| sensor_tenant | string | sensorTenant$ | A customer ID supplied by the application that originated the data. |
| sensor_id | string | sensorId$ | An ID for the data supplied by the application that originated it. |
| sensor_cpe | string | sensorCpe$ | CPE of the platform producing the alert. |
| original_data | string | originalData$ | Original, unadulterated data prior to any transformation. |
| event_time_usec | uint64 | eventTimeUsec$ | Event time in microseconds (µs). |
| ingest_time_usec | uint64 | ingestTimeUsec$ | Ingest time in microseconds (µs). |
| event_time_fidelity | TimeFidelity | eventTimeFidelity$ | Specifies the original precision of the time used to populate event_time_usec. |
| client_hostname | string | clientHostname$ | Hostname of the DHCP client machine. |
| client_address | string | clientAddress$ | IP of the DHCP client machine. |
| client_mac | string | clientMac$ | MAC address for the client. |
| server_hostname | string | serverHostname$ | Hostname of the DHCP server. |
| server_address | string | serverAddress$ | IP of the DHCP server. |
| server_mac | string | serverMac$ | MAC address for the server. |
| action | Dhcp.DHCP_Action | action$ | Action for the DHCP event. |
| expiration_time_usec | uint64 | expirationTimeUsec$ | Expiration date for the lease. |
| host_id | string | hostId$ | The host ID that uniquely identifies the host where the event originated, such as IPv(4/6) address or device MAC address. |
| sensor_version | string | sensorVersion$ | The agent version as string. |