Help combing these rules

[giveen]

Basically, I want it to check if its a randomized MAC first and if it isn’t THEN do a lookup

rule "LookupMACVendor"
when
  has_field("source_mac") 
then
  let macvendor = lookup_value("mac-lookup", $message.source_mac);
  let source_mac_vendor = macvendor;
  set_field("source_mac_vendor", macvendor);
end

rule "ParseMACForRandomization"
when
  has_field("source_mac") AND (contains("2", substring(to_string($message.source_mac),1,2),true) OR contains("6", substring(to_string($message.source_mac),1,2),true) OR contains("a", substring(to_string($message.source_mac),1,2), true) OR contains("e", substring(to_string($message.source_mac),1,2), true))
then
  set_field("source_mac_randomized", "True");
end

[giveen]

So I set ParseMACForRandomization in the one stage and below it in the other stage below I changed the rule to say

rule "LookupMACVendor"
when
  has_field("source_mac") AND !has_field("source_mac_randomized")
then
  let macvendor = lookup_value("mac-lookup", $message.source_mac);
  let source_mac_vendor = macvendor;
  set_field("source_mac_vendor", macvendor);
end

Still not working

[tmacgbay]

Sequentially, you have "ParseMACForRandomization" in a lower number stage from "LookupMACVendor" so that "ParseMACForRandomization" will run first, then when it gets to the next stage it will run "LookupMACVendor" - correct? Then make sure your stage rules are set up to pass properly to the next stage with something like "At least one of the rules on this stage matches the message…

Side note - I love that an option is “None or more rules on this stage match”… “always go to next stage” may have been better…

[tmacgbay]

Alternatively smosh em together:

rule "LookupMACVendor"
when
  has_field("source_mac") AND NOT
     (contains("2", substring(to_string($message.source_mac),1,2),true)  OR 
      contains("6", substring(to_string($message.source_mac),1,2),true)  OR 
	  contains("a", substring(to_string($message.source_mac),1,2), true) OR 
	  contains("e", substring(to_string($message.source_mac),1,2), true)
  )
  
then
  set_field("source_mac_randomized", "FALSE");
  let macvendor = lookup_value("mac-lookup", $message.source_mac);
  let source_mac_vendor = macvendor;
  set_field("source_mac_vendor", macvendor);
end

You may be able to shorten processing with (Untested ):

when  
  has_field("source_mac") AND
  regex("^[^26ae]{2}",to_string($message.source_mac)) == ""
then

EDIT: … or even:

when  
  regex("^[^26ae]{2}",to_string($message.source_mac)) == ""
then

[giveen]

Let me give that a try, I really appreciate the help.