macadress

OpenCTI connector

macadress.com for OpenCTI.

An internal enrichment connector that takes a Mac-Addr observable and adds the vendor identity, device category, virtualization detection, and randomization confidence for it, from the macadress.com API.

Official connector: merged into OpenCTI's connectors repository in PR #7463, shipping from release 7.260901.0. Listed on the Filigran Hub under Infrastructure & Attack Surface Visibility.

What it does

The connector registers as an internal enrichment connector for the Mac-Addr observable type. Run it from the enrichment menu, or on autopilot, and it calls macadress.com and:

  • Updates the observable with a description, a confidence score, and labels drawn from the lookup.
  • Links a vendor Organization: creates or reuses an Organization identity for the registered vendor and relates it to the observable.
  • Adds a summary Note with the full analysis: OUI, matched registry prefix, country, inferred device category, virtualization platform, and randomization signal.
  • Adds an external reference pointing back to the address's macadress.com lookup page.

Set up

  1. Get a free API key at macadress.com/signup.
  2. Deploy the connector from internal-enrichment/macadress in the connectors repository (Docker Compose or standalone), on OpenCTI ≥ 7.260722.0.
  3. Set MACADRESS_API_KEY in the connector's config. Everything else has a default: MACADRESS_API_BASE_URL, MACADRESS_MAX_TLP (TLP:AMBER), MACADRESS_DEFAULT_SCORE (30), MACADRESS_CREATE_NOTE and MACADRESS_CREATE_VENDOR_IDENTITY (both true).
  4. Right-click a Mac-Addr observable and run the macadress.com enrichment, or set CONNECTOR_AUTO=true to enrich every new one automatically.

Quota

Each enriched observable is one API call against your macadress.com plan quota, the same as any other lookup: see pricing for the per-plan budgets. The free plan allows 1,000 lookups on a rolling 30-day cycle.

Source and support

Licensed Apache-2.0, maintained in the OpenCTI connectors monorepo. Community-supported. API reference is at macadress.com/docs. Questions or a bug: get in touch.