alerts/plugins/dhcp_assignment.json

{
  "indices_to_search": ["events-*"],
  "search_window_hours": 48
}