Mac Address

Detects Mac Address patterns.

Type

regex

Engine

universal

Confidence

medium

Confidence justification

High confidence: structurally constrained pattern with corroborative keyword support reduces false positive rates significantly. Added context gating and exclusion rules improve precision and reduce incidental matches.

Detection quality

Verified

Jurisdictions

global

Regulations

GDPR

Frameworks

CIS Controls, ISO 27001, NIST CSF, SOC 2

Data categories

device-id

Scope

wide

Risk rating

5

Platform compatibility

Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Compatible, Netskope: Unsupported

Pattern

\b(?:[0-9A-Fa-f]{2}[:-]){5}[0-9A-Fa-f]{2}\b

Corroborative evidence keywords

device, identifier, serial number, hardware, address, age, birthday, citizenship, city, date of birth, [object Object], email, ethnicity, fax, first name, full name, gender, given name, last name, maiden name (+36 more)

Proximity: 300 characters

Should match

• 00:1A:2B:3C:4D:5E — Low-tier probe - MAC shape without a label
• MAC address: AA-BB-CC-DD-EE-FF — Medium-tier probe - explicitly labelled MAC without an asset record
• Device inventory - assigned user endpoint record, MAC address: 01:23:45:67:89:ab — High-tier probe - MAC label plus asset and user record context

Should not match

• 00:1A:2B:3C:4D — Only 5 octets instead of 6
• 00:1A:2B:3C:4D:5G — Contains invalid hex character G
• 001A2B3C4D5E — No separators between octets
• template example placeholder record identifier — Template/sample context should be excluded even when anchor words are present
• Public vendor manual - MAC address: 00:1A:2B:3C:4D:5E — Public manual contains a complete labelled MAC
• Template example: device inventory assigned user endpoint record MAC address AA-BB-CC-DD-EE-FF — Template contains otherwise high-tier evidence

Known false positives

• Technical identifiers appearing in public documentation, network configuration guides, or example configurations without representing actual infrastructure. Mitigation: Cross-reference with known documentation patterns and reserved address ranges. Require proximity to infrastructure-specific context.
• Placeholder and example values commonly used in technical tutorials and vendor documentation. Mitigation: Maintain exclusion lists for well-known example values (RFC 5737 documentation addresses, example MAC addresses).

Collections

• Network & Device Identifiers