MISP module

macadress.com for MISP.

A hover and expansion module that takes a mac-address attribute and returns the vendor identity, device category, virtualization detection, special-use classification, and randomization confidence for it, from the macadress.com API.

Official module: merged into MISP's misp-modules in PR #804 and shipping in the next misp-modules release. On an up-to-date install it is already present as macadress_com, no separate download.

What it does

The module registers against the mac-address attribute type. When you run enrichment on such an attribute (or just hover over it), it calls macadress.com and returns a plain-text summary covering:

Vendor identity: registered organization, OUI, the exact matched registry prefix, and country of registration.
Device category: the inferred class of device (router, camera, phone, embedded device, and more) with a confidence level.
Virtualization: the hypervisor or container network an address belongs to, when it is a virtualized one.
Special-use: broadcast, multicast, VRRP, HSRP, STP, LACP, 802.1X, or LLDP classification.
Randomization: whether the address looks like an OS privacy-randomized one, from the locally-administered bit and SLAP quadrant signals.

Set up

Get a free API key at macadress.com/signup.
Run a misp-modules version that includes the module (the next release, or install misp-modules from git in the meantime).
In MISP, under Administration → Server Settings → Plugin settings, enable the macadress_com enrichment module and set its api_key.
On any event, run enrichment on a mac-address attribute, or hover over one to see the result inline.

Quota

Each enriched attribute is one API call against your macadress.com plan quota, the same as any other lookup: see pricing for the per-plan budgets. The free plan allows 1,000 lookups on a rolling 30-day cycle.

Source and support

Licensed Apache-2.0, maintained in the misp-modules project. API reference is at macadress.com/docs. Questions or a bug: get in touch.