MISP module

macadress.com for MISP.

A hover module that takes a mac-address attribute and returns the vendor identity, device category, virtualization detection, special-use classification, and randomization confidence for it, from the macadress.com API.

What it does

The module registers against the mac-address attribute type. Hover over such an attribute in an event and it calls macadress.com and returns a plain-text summary covering:

• Vendor identity: registered organization, OUI, the exact matched registry prefix, and country of registration.
• Device category: the inferred class of device (router, camera, phone, embedded device, and more) with a confidence level.
• Virtualization: the hypervisor or container network an address belongs to, when it is a virtualized one.
• Special-use: broadcast, multicast, VRRP, HSRP, STP, LACP, 802.1X, or LLDP classification.
• Randomization: whether the address looks like an OS privacy-randomized one, from the locally-administered bit and SLAP quadrant signals.

Set up

1. Get a free API key at macadress.com/signup.
2. Run misp-modules v3.0.10 or newer; the module ships in the package, nothing to install separately.
3. In MISP, under Administration → Server Settings → Plugin Settings → Enrichment (Hover and Expansion) Modules, enable macadress_com and set its api_key.
4. On any event, hover over a mac-address attribute to see the result inline.

Quota

Each enriched attribute is one API call against your macadress.com plan quota, the same as any other lookup: see pricing for the per-plan budgets. The free plan allows 1,000 lookups on a rolling 30-day cycle.

Source and support

Licensed Apache-2.0, maintained in the misp-modules project and listed in the MISP module directory. API reference is at macadress.com/docs. Questions or a bug: get in touch.