osquery-defense-kit/incident_response/arp_cache.sql

-- Retrieves the ARP cache values in the target system.
--
-- interval: 3600
-- value: Determine if MITM in progress.
-- version: 1.4.5
select
  *
from
  arp_cache;