@Cloudhawk I'd start with dchp logs or flow data if you have it. Schedule a query to return allocated IP from osquery hosts. Then it's just a diffing problem. iPs from DHCP that don't show up in osquery logs