I want to monitor my end users activity for which I have selected Alien Vault as my SIEM solution. Now, when I see logs coming in and I see malicious activity at a certain IP (e.g 10.10.10.4) with host name XYZ, I start investigating and I see that this IP is now showing Host name BFU. Because 10.10.10.4 has been assigned to a new user by DHCP.
What I see as a solution is that I should correlate the end user logs with DHCP logs to monitor / investigate the malicious attack at a certain period.
Can some one assist me here, how to go about it? If there is any other solution I'd love to know about it.