Alert when a new client connects to LAN?

[foyeddie]

Just getting started with Splunk.
I am using a Synology NAS for my DHCP server, and Asus wireless router (used only as an AP, router is done via a cisco 2851)

I'd like to get an alert when a new client connects to the network.
Any pointers?

(I know that if only looking at DHCP I might miss manually configured, but its a start to get my feet wet.)

TIA

[phil_wang]

Synology can send syslog but I am not sure it can send DHCP server logs or not. Otherwise you might have to hack the box and do some modification. There are some info about how to do it if you find yourself on that path though. That will give you MAC and IP address.

If you have SSO or some sort of log on and log off event logs somewhere, get them in Splunk to then you can correlate with IP address and user ID. Synology can be a proxy and LDAP server too I think.

Cisco router logs can further provide the activities based on IP address once the above are done. These are my two cents. I hope these provide you some food for thought :-).