원클릭으로 Manus에서 모든 스킬 실행

mac-vendors-integration

스타1

포크0

업데이트2026년 4월 26일 19:43

MAC address OUI vendor lookup via Analysi mac_vendors integration for device identification during SOC investigations. Use when triaging alerts involving MAC addresses, identifying device manufacturers, detecting rogue/unauthorized hardware, or enriching network-layer IOCs with vendor context.

설치

Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.

Manus에서 실행

출처

open-analysi

open-analysi/analysi-app

GitHub 저장소 열기 Creator 저장소 보기

다운로드

Manus에서 실행

MAC Vendors Integration

Resolve MAC addresses to device manufacturers via OUI lookup. Use during network-layer investigations to identify device types, detect virtualization (VMware, Hyper-V), spot IoT/OT hardware, or flag unknown vendors.

Reference Loading

Reference	Read when	Consult for
`references/actions-reference.md`	Calling any mac_vendors action	Parameters, return schemas, Cy examples, edge cases, format normalization
`references/investigation-patterns.md`	Building investigation workflows	Device classification, rogue device detection, MAC randomization handling, Cy task templates, multi-source corroboration

Decision Path

Single MAC lookup — call app::mac_vendors::lookup_mac(mac=addr), check vendor_found boolean
Batch MAC enrichment — iterate MACs in a for-in loop (auto-parallelized); deduplicate by OUI prefix to conserve rate limit
Device classification — map vendor string to device category (corporate, VM, IoT, networking) via LLM or keyword matching
Connectivity check — call app::mac_vendors::health_check() before batch operations

Guardrails

No reverse lookup: Cannot search by vendor name to find MAC ranges — only MAC-to-vendor direction.
OUI only: Returns the manufacturer registered to the OUI prefix — not device model, firmware, or serial number.
Rate limit: Free tier allows 1,000 requests/day. No rate-limit headers are returned — track usage in your workflow. Exceeding the limit causes errors (handle via try/catch).
No historical data: Returns current OUI registration only — cannot determine if a MAC prefix was reassigned.
MAC randomization: vendor_found: false is most commonly caused by randomized MACs (iOS 14+, Android 10+, Windows 10+), not rogue devices. See investigation-patterns.md § MAC Address Randomization before escalating.

이 저장소의 다른 Skills

같은 저장소

abuseipdb-integration

open-analysi/analysi-app

AbuseIPDB IP reputation lookups for SOC alert triage via Analysi. Use when checking IP abuse confidence scores, investigating brute force or scanning activity, or enriching alerts with crowd-sourced threat intelligence.

2026-04-261

ad-ldap-integration

open-analysi/analysi-app

Active Directory LDAP user attribute lookups and identity context queries during SOC alert triage. Use when investigating user accounts, group memberships, authentication anomalies, lockouts, privileged access, or correlating alerts with AD data via Analysi.

2026-04-261

cy-language-programming

open-analysi/analysi-app

Write and debug Cy language scripts for automation and workflow composition. Use when working with .cy files, Security Tasks, writing Cy programs, or debugging Cy syntax errors.

2026-04-261

cybersecurity-analyst

open-analysi/analysi-app

Investigate security alerts, analyze IOCs, triage incidents, and perform threat analysis. Covers SIEM alerts, SOC workflows, malware, phishing, brute force, web attacks, network traffic, and log analysis. Use when building cybersecurity Tasks/Workflows or performing incident response.

2026-04-261

echo-edr-integration

open-analysi/analysi-app

Echo EDR endpoint detection and response for SOC alert triage. Use when investigating endpoint threats, checking process activity, retrieving host attributes, analyzing behavioral indicators, or correlating endpoint telemetry with alert data via Analysi.

2026-04-261

global-dns-integration

open-analysi/analysi-app

DNS resolution, reverse lookups, and mail/TXT/NS/SOA queries via Analysi's Global DNS for SOC triage. Use when investigating suspicious domains, resolving IPs to hostnames, checking SPF/DKIM/DMARC in phishing analysis, or correlating network indicators with domain infrastructure.

2026-04-261

name	mac-vendors-integration
description	MAC address OUI vendor lookup via Analysi mac_vendors integration for device identification during SOC investigations. Use when triaging alerts involving MAC addresses, identifying device manufacturers, detecting rogue/unauthorized hardware, or enriching network-layer IOCs with vendor context.
version	0.1.0

MAC Vendors Integration

Reference Loading

Reference	Read when	Consult for
`references/actions-reference.md`	Calling any mac_vendors action	Parameters, return schemas, Cy examples, edge cases, format normalization
`references/investigation-patterns.md`	Building investigation workflows	Device classification, rogue device detection, MAC randomization handling, Cy task templates, multi-source corroboration

Decision Path

Single MAC lookup — call app::mac_vendors::lookup_mac(mac=addr), check vendor_found boolean
Batch MAC enrichment — iterate MACs in a for-in loop (auto-parallelized); deduplicate by OUI prefix to conserve rate limit
Device classification — map vendor string to device category (corporate, VM, IoT, networking) via LLM or keyword matching
Connectivity check — call app::mac_vendors::health_check() before batch operations

Guardrails

No reverse lookup: Cannot search by vendor name to find MAC ranges — only MAC-to-vendor direction.
OUI only: Returns the manufacturer registered to the OUI prefix — not device model, firmware, or serial number.
Rate limit: Free tier allows 1,000 requests/day. No rate-limit headers are returned — track usage in your workflow. Exceeding the limit causes errors (handle via try/catch).
No historical data: Returns current OUI registration only — cannot determine if a MAC prefix was reassigned.
MAC randomization: vendor_found: false is most commonly caused by randomized MACs (iOS 14+, Android 10+, Windows 10+), not rogue devices. See investigation-patterns.md § MAC Address Randomization before escalating.