MISP module for MAC Vendor Lookup API

MAC address Vendor Lookup API is available as an extension for MISP – Open Source Threat Intelligence Platform. It allows making instant MAC Vendor Lookup for the MAC address attributes. To get vendor details and other information provided by the API, you only need to hover over the MAC address attribute value.

Download the extension: https://github.com/MISP/misp-modules

Prerequisites

1. 1You need a MISP instance up and running. To install and configure it, please refer to the official documentation.
2. 2Ensure that your misp-modules are up-to-date.

Configuring the extension

1. 1Log in to your MISP instance
2. 2Go to Main menu > Administration > Server Settings & Maintenance
3. 3Click on the Plugin settings tab and select the Enrichment option
4. 4Enable the module by setting the Plugin.Enrichment_macaddress_io_enabled option to true
5. 5Provide your API key by setting the Plugin.Enrichment_macaddress_io_api_key value

Using the extension

1. 1Go to Event Actions > Add Event and create an event
2. 2Add a mac-address attribute to the event, and set Value to a sample MAC address
3. 3Move your mouse over the new attribute, and MAC lookup details will pop-up