To get Mac address, there is two ways, the device has to be directly connected to the switch where the SPAN is occurring, otherwise the MAC could be of the router on that specific LAN.
The more accurate way to get mac addresses is to integrate stealthwatch with Cisco ISE.