Forum Discussion

ddaniel's avatar
ddaniel
Icon for Staying Involved rankStaying Involved
17 hours ago

Is there any way to expose/export DHCP logs from Cato SDP clients?

is there any way (events / API) to see DHCP events for our SDP users?  Our security vendors (Rapid7 and Defender for Identity) are doing correlation based on DNS and DHCP events and sometimes see SDP...
API
monitoring
network
sdp
security
michaelsaw's avatar
michaelsaw
Icon for Cato Professional Services rankCato Professional Services
8 hours ago

Hi ddaniel,

This is an interesting point.
For Cato Clients, there are 2 IPs to note: LAN connected IP and the Cato Client tunnel IP.

For the "user-to-IP-mapping", would you looking at any of the following options?
Option 1: Map user with LAN IP. e.g. Alan, LAN IP: 192.168.100.1
Option 2: Map user with Cato Client tunnel IP. e.g. Alan, tunnel IP: 10.41.0.1
Option 3: Map user with both LAN and Cato Client tunnel IP. e.g. Alan, LAN IP: 192.168.100.1 & tunnel IP: 10.41.0.1

For an operations perspective, based on the DHCP IP address gathered, would option 1, 2 or 3 work for the mentioned scenario?

Would Eventfeed API work for you, based on the event logging requirement?
https://api.catonetworks.com/documentation/

Cheers