From 629322e803c4f6e06cd674110b70397a3cfef6dd Mon Sep 17 00:00:00 2001 From: Corey Thuen <108432788+corey-thuen-gravwell@users.noreply.github.com> Date: Thu, 12 Dec 2024 15:38:32 -0600 Subject: [PATCH] Update maclookup.md --- search/maclookup/maclookup.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/search/maclookup/maclookup.md b/search/maclookup/maclookup.md index ace5d50a..500397cc 100644 --- a/search/maclookup/maclookup.md +++ b/search/maclookup/maclookup.md @@ -4,7 +4,7 @@ The maclookup module uses a custom MAC prefix database to extract Manufacturer, ## Setting Up Databases -Before using the maclookup module, you must install a [resource](/resources/resources) containing the macdb database. +Before using the maclookup module, you must have the mac_prefixes database as a Resource in your Gravwell instance. The mac_prefixes resource is included in the Gravwell Network Enrichment Kit, which you can find by browsing the available kits in the Kits section of the UI. By default, the maclookup module expects the macdb database to be in a resource named "macdb". This will allow you to do extractions without specifying the resource name explicitly.