[New Log Source] DHCP Scopes

Currently we have DHCP logs (via Windows DHCP integration) for devices renewing their IP addresses, releasing, etc.

However, we don't have the current up to date scope of what DHCP contains.

For example, I want to use DHCP as a lookup source directly instead of relying on the last renew or changes via DHCP event logs.

Using AD Tools on Windows with PowerShell: Get-DhcpServerv4Scope -ComputerName "192.168.7.7" (IP of DHCP server) we can directly pull in the current DHCP scopes and then use those for enrichments instead of the constantly changing DHCP logs. Plus this will also contain descriptions and other meta data to what lives in DHCP.

This will help further use cases such as getting count of computers based on IP subnet and also add to our inventorying efforts for improving our Entity Analytics and having more context to networks around the organization.

POC:

Install RSAT on Windows using PowerShell:
```PowerShell
Get-WindowsCapability -Name RSAT* -Online | where State -EQ NotPresent | Add-WindowsCapability –Online
```

Then query the DHCP server:
```PowerShell
$data = Get-DhcpServerv4Scope -computername 192.168.7.7 | Select-Object -Property *
```

Then make a nice object with the details in an object:
```PowerShell
#Convert Subnet mask to CIDR - https://d-fens.ch/2013/11/01/nobrainer-using-powershell-to-convert-an-ipv4-subnet-mask-length-into-a-subnet-mask-address/
function Convert-IpAddressToMaskLength([string] $dottedIpAddressString) {
$result = 0;
# ensure we have a valid IP address
[IPAddress] $ip = $dottedIpAddressString;
$octets = $ip.IPAddressToString.Split('.');
foreach($octet in $octets) {
while(0 -ne $octet) {
$octet = ($octet -shl 1) -band [byte]::MaxValue
$result++;
}
}
return $result;
}
$basicDHCP = @()
$missing = @()
$data | ForEach-Object {
$cidrLength = Convert-IpAddressToMaskLength $_.SubnetMask
$basicDHCP += [PSCustomObject]@{
subnet = $($_.ScopeId+"/"+$cidrLength)
description = $_.Description
name = $_.name
}
}
```

From there, you should have a nice object to convert to JSON to use to index.

```PowerShell
$basicDHCP | ConvertTo-Json
{
"subnet": "192.168.8.0/21",
"description": "Classified Secret Network",
"name": "SECRET-CLASS"
}
```

Perhaps there are other ways to pull in this data, but the RSAT module in Windows seems to be the easiest. Time for a PowerShell integration to run any code?? :) Perhaps that is for another time.