Browse Live Discover and Response Queries by Category
Approved

Live Discover Query - MAC address list

 REVIEWED by Sophos 

A simple one for listing the interfaces of devices and their MAC addresses. Potentially handy if you need to check DHCP logs, firewall logs, or update your WIFI MAC filtering list.

 

SELECT
    description "Desc",
    mac "MAC"
FROM interface_details
WHERE MAC >1;
/* This removes the loopback adapters and Microsoft tunnels  */

 

Should work on Windows, Mac, and Linux

Cheers,
AM

AndyM

  • Hello, I have a particular situation regarding Live discover. I need to get the MAC addresses of the company's devices, although the query worked for me to get the information of the computers online, I need to get the same information for the offline computers. For this I understand that we could use the Data Lake option but the query gives me an error. Do you know any way to obtain the MAC address of online and offline computers through a query? Thanks so much. 

  • Thanks for the contribution.  In the next two or three weeks we will be adding a fair number of new queries.  We appreciate the support
Unfiltered HTML