MAC to Vendor

[ManRod]

Hi there,

is there any chance to show the mac vendor of a mac inside an event?

I can see there is a MACByVendor.csv, a MACByVendor.txt and a MACByVendorGroup.csv under /opt/phoenix/data-definition, but have no clue if or how to use it.

Wonder why this is not correlated by default, like i.e. GEO IP.

Regards
Manuel

[FSM_FTNT]

Hi Manuel,

I checked on this internally, this list is not used within FortiSIEM currently. I am looking into a workaround using parser customization and the code attribute lookups.

Thanks

Dan

------------------------------
Daniel
FortiSIEM Product Manager
------------------------------

[ManRod]

Hi, 

Parser would be perfect. Want to use it for a customised DHCP Parser and see which Vendor gets DHCPNACK.

Regards
Manuel