MAC to Vendor

Hi, 

Parser would be perfect. Want to use it for a customised DHCP Parser and see which Vendor gets DHCPNACK.

Regards
Manuel-------------------------------------------
Original Message:
Sent: Mar 15, 2021 09:38 AM
From: Daniel Hanman
Subject: MAC to Vendor

Hi Manuel,

I checked on this internally, this list is not used within FortiSIEM currently. I am looking into a workaround using parser customization and the code attribute lookups.

Thanks

Dan

------------------------------
Daniel
FortiSIEM Product Manager
------------------------------

Original Message:
Sent: Feb 12, 2021 06:01 AM
From: Manuel Rodriguez
Subject: MAC to Vendor

Hi there,

is there any chance to show the mac vendor of a mac inside an event?

I can see there is a MACByVendor.csv, a MACByVendor.txt and a MACByVendorGroup.csv under /opt/phoenix/data-definition, but have no clue if or how to use it.

Wonder why this is not correlated by default, like i.e. GEO IP.

Regards
Manuel