Question

A security operations engineer is onboarding a high-volume Windows DHCP log source into Google SecOps. Analysis shows that roughly 85% of the events are routine lease renewal messages that provide no detection or investigation value, but they still count against the licensed ingestion volume and clutter searches. The team must retain the remaining security-relevant events (lease grants for new MACs, denials, and conflicts) fully parsed and searchable. Which approach best reduces cost and noise while preserving the useful data?

Accepted Answer

Configure a parser-level filter (using the parser's drop/filtering logic) to discard the routine lease-renewal events before they are indexed, while continuing to normalize and store the security-relevant events.

Answer

Set a shorter data retention tier on the entire DHCP log type so the renewal events age out faster than other logs.

Answer

Ingest all DHCP events unchanged and build a reference list of routine renewal patterns that analysts must exclude in every search.

Answer

Disable the DHCP log source entirely and rely on domain controller authentication logs to infer host network activity.