Finding if a users IP changes

[gsmith]

Hello && Welcome

@darrinh

how would I go about create an alert that could be triggered by that scenario?

This is possible but unfortunately I don’t know how you set up you environment for us to proceed.
This would require how you are ingesting logs, configuration, etc…
Maybe this post could help

How to Post a Question in the Community that Gets Responses

This platform is made with love for community discussions on the open source tool Graylog, it components and usage. Here’s a Graylog support-inspired template (thank you, @aaronsachs ) that’ll get responses: Description of your problem <!-- Use this section to describe the problem that you're encountering. Please include any screenshots or recordings of the problem you're running into.--> Description of steps you’ve taken to attempt to solve the issue <!-- Use this section to provide detail…

EDIT: Those are completely two different networks 192.168.1.1 and 10.92.1.1 . I personally never had a node switch networks even if I had DHCP enabled.