一键在 Manus 中运行任何 Skill

mac-vendors-integration

星标1

分支0

更新时间2026年4月26日 19:43

MAC address OUI vendor lookup via Analysi mac_vendors integration for device identification during SOC investigations. Use when triaging alerts involving MAC addresses, identifying device manufacturers, detecting rogue/unauthorized hardware, or enriching network-layer IOCs with vendor context.

安装

用 Codex 或 Claude 帮你安装复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。

在 Manus 中运行

来源

open-analysi

open-analysi/analysi-app

打开 GitHub 仓库查看创作者相关仓库

下载

在 Manus 中运行

MAC Vendors Integration

Resolve MAC addresses to device manufacturers via OUI lookup. Use during network-layer investigations to identify device types, detect virtualization (VMware, Hyper-V), spot IoT/OT hardware, or flag unknown vendors.

Reference Loading

Reference	Read when	Consult for
`references/actions-reference.md`	Calling any mac_vendors action	Parameters, return schemas, Cy examples, edge cases, format normalization
`references/investigation-patterns.md`	Building investigation workflows	Device classification, rogue device detection, MAC randomization handling, Cy task templates, multi-source corroboration

Decision Path

Single MAC lookup — call app::mac_vendors::lookup_mac(mac=addr), check vendor_found boolean
Batch MAC enrichment — iterate MACs in a for-in loop (auto-parallelized); deduplicate by OUI prefix to conserve rate limit
Device classification — map vendor string to device category (corporate, VM, IoT, networking) via LLM or keyword matching
Connectivity check — call app::mac_vendors::health_check() before batch operations

Guardrails

No reverse lookup: Cannot search by vendor name to find MAC ranges — only MAC-to-vendor direction.
OUI only: Returns the manufacturer registered to the OUI prefix — not device model, firmware, or serial number.
Rate limit: Free tier allows 1,000 requests/day. No rate-limit headers are returned — track usage in your workflow. Exceeding the limit causes errors (handle via try/catch).
No historical data: Returns current OUI registration only — cannot determine if a MAC prefix was reassigned.
MAC randomization: vendor_found: false is most commonly caused by randomized MACs (iOS 14+, Android 10+, Windows 10+), not rogue devices. See investigation-patterns.md § MAC Address Randomization before escalating.

同仓库更多 Skills

同仓库

abuseipdb-integration

open-analysi/analysi-app

AbuseIPDB IP reputation lookups for SOC alert triage via Analysi. Use when checking IP abuse confidence scores, investigating brute force or scanning activity, or enriching alerts with crowd-sourced threat intelligence.

2026-04-261

ad-ldap-integration

open-analysi/analysi-app

Active Directory LDAP user attribute lookups and identity context queries during SOC alert triage. Use when investigating user accounts, group memberships, authentication anomalies, lockouts, privileged access, or correlating alerts with AD data via Analysi.

2026-04-261

cy-language-programming

open-analysi/analysi-app

Write and debug Cy language scripts for automation and workflow composition. Use when working with .cy files, Security Tasks, writing Cy programs, or debugging Cy syntax errors.

2026-04-261

cybersecurity-analyst

open-analysi/analysi-app

Investigate security alerts, analyze IOCs, triage incidents, and perform threat analysis. Covers SIEM alerts, SOC workflows, malware, phishing, brute force, web attacks, network traffic, and log analysis. Use when building cybersecurity Tasks/Workflows or performing incident response.

2026-04-261

echo-edr-integration

open-analysi/analysi-app

Echo EDR endpoint detection and response for SOC alert triage. Use when investigating endpoint threats, checking process activity, retrieving host attributes, analyzing behavioral indicators, or correlating endpoint telemetry with alert data via Analysi.

2026-04-261

global-dns-integration

open-analysi/analysi-app

DNS resolution, reverse lookups, and mail/TXT/NS/SOA queries via Analysi's Global DNS for SOC triage. Use when investigating suspicious domains, resolving IPs to hostnames, checking SPF/DKIM/DMARC in phishing analysis, or correlating network indicators with domain infrastructure.

2026-04-261

name	mac-vendors-integration
description	MAC address OUI vendor lookup via Analysi mac_vendors integration for device identification during SOC investigations. Use when triaging alerts involving MAC addresses, identifying device manufacturers, detecting rogue/unauthorized hardware, or enriching network-layer IOCs with vendor context.
version	0.1.0

MAC Vendors Integration

Reference Loading

Reference	Read when	Consult for
`references/actions-reference.md`	Calling any mac_vendors action	Parameters, return schemas, Cy examples, edge cases, format normalization
`references/investigation-patterns.md`	Building investigation workflows	Device classification, rogue device detection, MAC randomization handling, Cy task templates, multi-source corroboration

Decision Path

Single MAC lookup — call app::mac_vendors::lookup_mac(mac=addr), check vendor_found boolean
Batch MAC enrichment — iterate MACs in a for-in loop (auto-parallelized); deduplicate by OUI prefix to conserve rate limit
Device classification — map vendor string to device category (corporate, VM, IoT, networking) via LLM or keyword matching
Connectivity check — call app::mac_vendors::health_check() before batch operations

Guardrails

No reverse lookup: Cannot search by vendor name to find MAC ranges — only MAC-to-vendor direction.
OUI only: Returns the manufacturer registered to the OUI prefix — not device model, firmware, or serial number.
Rate limit: Free tier allows 1,000 requests/day. No rate-limit headers are returned — track usage in your workflow. Exceeding the limit causes errors (handle via try/catch).
No historical data: Returns current OUI registration only — cannot determine if a MAC prefix was reassigned.
MAC randomization: vendor_found: false is most commonly caused by randomized MACs (iOS 14+, Android 10+, Windows 10+), not rogue devices. See investigation-patterns.md § MAC Address Randomization before escalating.