Cortex analyzer

macadress.com for Cortex.

A Cortex analyzer that takes a mac observable from TheHive and returns the vendor identity, device category, virtualization detection, special-use role, and randomization confidence for it, from the macadress.com API.

Merged into Cortex-Analyzers: TheHive Project's official Cortex-Analyzers repository, in PR #1495, shipping from release 3.10.1. Documented in the Cortex Neurons catalog.

What it does

The analyzer accepts the mac data type, plus other for deployments that store MAC addresses that way. Run it on an observable in TheHive and it calls macadress.com and returns:

Summary tags: macadress:Vendor, macadress:Device, macadress:Virtualization, macadress:SpecialUse, and macadress:Randomized (flagged suspicious when randomization is likely).
A full report rendered by the bundled TheHive templates: OUI, matched registry prefix, country, device category, virtualization platform, special-use role, and randomization signal.
Artifacts: the address's macadress.com vendor page, extracted as a url observable.

Set up

Get a free API key at macadress.com/signup.
Update your analyzers to Cortex-Analyzers 3.10.1 or later. With the Docker-based catalog, the cortexneurons/macadress image is pulled automatically.
In Cortex, go to Organization → Analyzers, enable Macadress_1_0, and paste your key into api_key. TLP and PAP checks are on by default (max_tlp: 2), so TLP:RED observables are never sent off-box.
In TheHive, run the analyzer on a mac observable. Import the report templates from the Cortex-Analyzers release if your TheHive version needs them.

Quota

Each analyzed observable is one API call against your macadress.com plan quota, the same as any other lookup: see pricing for the per-plan budgets. The free plan allows 1,000 lookups on a rolling 30-day cycle.

Source and support

Licensed AGPL-3.0, maintained in the Cortex-Analyzers repository. Community-supported. API reference is at macadress.com/docs. Questions or a bug: get in touch.