ECS specifies to use this format for MAC addresses:

The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.

The to_mac function could apply the formatting. This would cover fixing the ECS fields an also make the rsa.* fields consistently formatted.