Data Points

🔌 MAC Address

🔗 Analyst pivots

🔌 Sources that yield MAC Address (1)

🧭 Disciplines

🎯 Mission Domains

🔍 Lookup

📜 Playbook — MAC Address exploitation

1. Direction — frame the requirement for MAC Address: what decision does this support, by when?
2. Collection — pull the 1 mapped sources (0 free) and the native workbench; capture provenance and observe OPSEC.
3. Processing — normalize, de-duplicate and enrich the collected data.
4. Analysis — correlate against local holdings; apply ACH; assign confidence.
5. Dissemination — open a case, draft a report, share via STIX/MISP.
6. Feedback — set an alert rule / watchlist to monitor for change.

⚡ AI Skills & Automation

Automate unattended via the cron pipeline (collect → ingest → resolve → enrich → score → alert).

🗃 Data Management

🧩 Advanced Capabilities

✨ Enrichment pathways

🎫 MAC Address

A MAC address is a 48-bit layer-2 hardware identifier assigned to a network interface, structured as a vendor OUI plus a device-specific portion. In investigations it fingerprints and tracks physical devices on a LAN, attributes hardware to a manufacturer, and detects spoofing, rogue devices, and randomized-privacy addresses.

Format: 48-bit, 12 hex digits as XX:XX:XX:XX:XX:XX (or -/. separators). First 24 bits = OUI; U/L bit and I/G bit in first octet flag locally-administered and multicast; x2/6/A/E second nibble = randomized.

📡 How it is collected

• ARP tables and DHCP lease logs
• Switch CAM / MAC-address tables
• Wi-Fi association / probe frames
• Packet captures (Ethernet/802.11 headers)
• NAC / 802.1X authentication logs
• Endpoint inventory agents

📚 Enrichment & validation sources

🔗 Pivot to

🧩 Analysis & hunting techniques

• OUI-to-vendor resolution
• Randomized (locally-administered) address detection
• MAC-spoofing / duplicate detection
• Device-type inference from OUI
• MAC-to-IP correlation via ARP/DHCP
• Rogue-device identification
• Temporal presence tracking
• 802.11 probe-request device fingerprinting

🔧 Tools

• Wireshark
• nmap
• arp-scan
• aircrack-ng suite
• tcpdump
• Kismet
• ettercap

⚡ Workbench actions

• Resolve OUI to vendor
• Flag randomized/locally-administered
• Correlate to IP via ARP/DHCP
• Detect duplicate/spoofed MAC
• Infer device type
• Map to switch port
• Track presence timeline
• Pivot to associated BSSID

📊 Dashboard KPIs

📂 Open