Macaddress vendor lookup

TA-macadress adds a `macaddresslookup` search command that resolves MAC addresses to vendor, device category, virtualization, and special-use information, using the macadress.com API. Any event with a MAC address field, DHCP leases, ARP tables, wireless associations, switch port tables, asset inventories, can be enriched in place with: - Vendor and manufacturer identity, resolved against the full IEEE OUI registry (organization name, matched registry prefix, country) - Device category inference (router, switch, wireless access point, embedded device, and more) from a manually curated, source-verified dataset, not a guess - Virtualization and container detection: VMware, Hyper-V, Xen, VirtualBox, Parallels, QEMU/KVM, and Docker's default bridge convention - Special-use address classification: broadcast, IPv4/IPv6 multicast, VRRP, HSRP, STP, LACP, 802.1X, LLDP, each with its source protocol cited - Randomization signals: whether an address is locally administered or otherwise likely to be a privacy-randomized or spoofed MAC, useful for flagging anomalous device behavior in security and asset-inventory use cases This turns a raw MAC address into something you can actually search, filter, and stat on: `stats count by mac_organization`, `where mac_virtualization_platform!=""`, `where mac_potentially_randomized=1`, and so on, without leaving SPL. Lookups are batched (up to 100 addresses per API call) for efficiency on large event volumes, and the API key is stored via Splunk's encrypted storage/passwords endpoint rather than a plain-text configuration file. A free API key is available at macadress.com/signup; paid plans raise the request-rate and monthly-quota limits for larger deployments.