How to alert when a rogue/unknown device is plugged into network

[pradeep577]

Hi,

I need to be alerted when a rogue/unknown device is plugged into network.
Any help will be appreciated.

[pruthvikrishnap]

Hi, this is a bit generic question. One thing that i would do is
1) Identify to which index is the network logs going
2) Whitelist all known devices into a lookup file
3) create an alert using a search which compares the host names and alert if it sees any new device.
If you have some sample events i can help with search, also look in Splunk base if you can find a related app which can do this for you.

[pradeep577]

Thank you for your kind response...yes its generic question.

Would it be best to have CMDB( config. management DB) pulled into SIEM & run the search against it.