Detection & alerting · 6 min read

Set up rogue and shadow device detection

New devices joining the network are checked against your provisioned inventory. Here's how to define what "provisioned" means for your team.

What you'll need

  • Device auto-discovery enabled on at least one sensor
1

Define your source of truth

Rogue-device detection compares newly discovered devices against an inventory list. Import that list from a CSV, sync it from an existing CMDB via the REST API, or simply approve devices as Linivo discovers them for the first few weeks.

2

Set the alert action

Choose whether a new, unrecognized device raises a detection for review or is quarantined automatically pending approval; most teams start with review-only until they trust the inventory is complete.

3

Review the backlog weekly

Check Detections > Rogue devices weekly at first. Most flagged devices turn out to be legitimate but un-inventoried equipment, which is useful signal on its own.