Parse if MAC address is random

Templates and Rules Exchange Pipeline Rules
1 
rule "ParseMACForRandomization"
when
  has_field("source_mac") AND (contains("2", substring(to_string($message.source_mac),1,2),true) OR contains("6", substring(to_string($message.source_mac),1,2),true) OR contains("a", substring(to_string($message.source_mac),1,2), true) OR contains("e", substring(to_string($message.source_mac),1,2), true))
then
  set_field("source_mac_randomized", "True");
end
2 Likes