MAC Vendors

Query MAC Vendors for vendor names when providing a MAC address. MAC Vendors maintains a list of vendors provided directly from the IEEE Standards Association and is updated multiple times each day. The IEEE is the registration authority and provides data on over 16,500 registered vendors.

Utilities · MAC Vendors

Details

ID	`MAC Vendors`
Provider	Nivel Technologies
Category	Utilities
From Version	6.0.0
Docker Image	`demisto/python3:3.12.8.3296088`
Supported Modules	Agentix XSIAM

README

Query MAC Vendors for vendor names when providing a MAC address.
MAC Vendors maintains a list of vendors provided directly from the IEEE Standards Association and is updated multiple times each day. The IEEE is the registration authority and provides data on over 16,500 registered vendors.

This integration was integrated and tested with the latest verison of MAC Vendors API as of 31st January 2022.

Configure MAC Vendors in Cortex

Parameter	Description	Required
API Key	No API key is required for up to 1,000 requests per day at 1 request per second. For higher limits, please use an API key.	False
Trust any certificate (not secure)		False
Use system proxy settings		False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

macvendors-lookup-mac

Resolves a MAC address to a vendor name.

Base Command

macvendors-lookup-mac

Input

Argument Name	Description	Required
mac	MAC address to lookup. Can be any of the formats; 00-11-22-33-44-55, 00:11:22:33:44:55, 00.11.22.33.44.55, 001122334455, 0011.2233.4455.	Required

Context Output

Path	Type	Description
MACVendors.mac	string	MAC Address
MACVendors.vendor	string	Vendor Name

Configuration parameters

apiKey — API Key
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings

Commands (1)

macvendors-lookup-mac
Resolves a MAC address to a vendor name.

Source

macvendors.py macvendors.yml macvendors_description.md

Download History Raw

import urllib.parse
from typing import Any

import demistomock as demisto
import urllib3
from CommonServerPython import *  # noqa # pylint: disable=unused-wildcard-import

from CommonServerUserPython import *  # noqa

# Disable insecure warnings
urllib3.disable_warnings()  # pylint: disable=no-member


""" CONSTANTS """


# =========================================== Helper Functions ===========================================#


# ========================================== Generic Query ===============================================#


def test_module(client: BaseClient):
    try:
        test_mac = urllib.parse.quote("00:0c:29:00:00:00")
        client._http_request("GET", resp_type="response", url_suffix=test_mac, ok_codes=[200])
        return_results("ok")
    except Exception as err:
        raise DemistoException(err)


def lookup_mac_command(client: BaseClient, args: dict[str, Any]):
    mac_address = args.get("mac")
    res = client._http_request("GET", url_suffix=urllib.parse.quote(str(mac_address)), ok_codes=[200, 404], resp_type="response")
    command_results = CommandResults(outputs_prefix="MacVendors", outputs_key_field="address")
    if res.status_code == 200:
        command_results.outputs = {"address": mac_address, "vendor": res.text}
        command_results.readable_output = f"{mac_address} - {res.text}"
    else:
        command_results.outputs = {"address": mac_address, "vendor": "Unknown"}
        command_results.readable_output = f"{mac_address} - Unknown"
    return_results(command_results)


# =========================================== Built-In Queries ===========================================#


""" MAIN FUNCTION """


def main() -> None:
    params = demisto.params()
    args = demisto.args()
    base_url = "https://api.macvendors.com"
    verify_cert = not params.get("insecure", False)
    proxy = params.get("proxy", False)
    command = demisto.command()
    demisto.debug(f"Command being called is {command}")
    try:
        client = BaseClient(
            base_url=base_url,
            verify=verify_cert,
            proxy=proxy,
        )
        if command == "test-module":
            test_module(client)
        elif command == "macvendors-lookup-mac":
            lookup_mac_command(client, args)

    # Log exceptions and return errors
    except Exception as e:
        demisto.error(traceback.format_exc())  # print the traceback
        return_error(f"Failed to execute {command} command.\nError: {e!s}")


""" ENTRY POINT """

if __name__ in ("__main__", "__builtin__", "builtins"):
    main()