I’m investigating a security alert and need vendor context for a MAC address to prioritize the incident.

This feature helps you look up vendor context associated with a MAC address while investigating a security alert. It supports faster triage by adding manufacturer information you can use to assess whether the device identity is expected or suspicious.

When investigating a security alert, you may only have a MAC address and limited context about the device involved. This feature provides vendor context for a MAC address so you can quickly understand which manufacturer is associated with it. By adding this context to your investigation workflow, you can more easily judge whether the device appears legitimate for your environment. Vendor details can help differentiate common corporate hardware from unknown or unexpected device types. This can reduce time spent manually searching external references during triage. It can also help you prioritize incidents by highlighting devices that do not match expected vendors for a given network segment or asset category. The feature is useful when alerts involve unmanaged endpoints, newly observed devices, or potential spoofing attempts that require additional validation. It supports analysts who need to enrich alert context quickly to make a better-informed decision on escalation and next steps.