Splunk extension

macadress.com for Splunk.

Adds a macaddresslookup search command that enriches events with the vendor, country, device category, virtualization platform, and randomization confidence behind any MAC address field, straight from the macadress.com API.

On Splunkbase: macadress.com MAC Address Lookup (app ID 9581). Install it from Splunk Web, or download the .spl and upload it under Apps → Manage Apps → Install app from file. Compatible with standalone, distributed, and search-head-clustered deployments.

What it does

The extension registers one custom streaming search command. Pipe events through it with the field that holds a MAC address, and every matching row comes back with the macadress.com analysis attached as new fields:

index=network sourcetype=dhcp
| macaddresslookup field=src_mac
| stats count by mac_organization, mac_device_category

Lookups are resolved against the same IEEE MA-L/MA-M/MA-S/IAB/CID registry, synced on a recurring schedule, that the REST API and web lookup use. Nothing about the enrichment is a local snapshot that goes stale between app updates.

Set up

Get a free API key at macadress.com/signup.
In Splunk Web, open the app and click Set up, then paste the key. It is stored through Splunk's encrypted storage/passwords endpoint, never written to a plain-text .conf file.
Run a search that pipes a MAC address field into | macaddresslookup field=<fieldname>.

Usage

Argument	Meaning
`field`	Required. Name of the field on each event that contains a MAC address, in any common notation (colon, hyphen, dot, or bare hex).

Example, joining DHCP leads to a vendor and device-type breakdown, then flagging anything that looks like a privacy-randomized address:

index=network sourcetype=dhcp earliest=-24h
| macaddresslookup field=src_mac
| eval randomized=if(mac_potentially_randomized=="true","randomized","")
| stats count values(randomized) as randomized by mac_organization, mac_device_category, mac_country

Fields added

Field	What it holds
`mac_valid`, `mac_registered`	Whether the value parsed as a MAC address, and whether its prefix matches a registered block.
`mac_oui`, `mac_matched_prefix`	The 24-bit OUI, and the exact registry prefix (which may be longer than 24 bits for MA-M/MA-S/IAB).
`mac_organization`, `mac_vendor_slug`	Registered organization name and its macadress.com URL slug.
`mac_country`, `mac_block_type`	Country of registration (ISO 3166-1 alpha-2) and block type (MA-L, MA-M, MA-S, IAB, CID).
`mac_locally_administered`, `mac_administration_type`, `mac_transmission_type`	The U/L and I/G bit reading: locally vs universally administered, unicast vs multicast.
`mac_potentially_randomized`, `mac_randomization_confidence`	Whether the address looks like an OS privacy-randomized one, and how confident that judgment is.
`mac_device_category`, `mac_device_confidence`	Inferred device category (router, smart_tv, phone, embedded_device, and more) and its confidence.
`mac_virtualization_platform`	Hypervisor or container network the OUI belongs to, when the address is a virtualized one.
`mac_special_use_type`	Special-use classification (broadcast, multicast, VRRP, HSRP, STP, LACP, 802.1X, LLDP).
`mac_explanation`	A plain-English summary of the analysis.
`mac_lookup_error`	Set only when a lookup fails, so a bad key or a network problem is visible in results rather than silent.

Batching and quota

The command batches up to 100 addresses per API call, so a search over many events is not one HTTP request per row. Every resolved address counts against your macadress.com plan quota, the same as any other API call: see pricing for the per-plan lookup budgets and rate limits. The free plan's 1,000-lookup allowance is a rolling 30-day cycle.

Source and support

Licensed Apache-2.0. Source is in the macadress repository; API reference is at macadress.com/docs. Questions or a bug: get in touch.