Only then does it turn out that systems are operating in the environment that IT and security teams were not previously fully aware of. These may include vendor devices, equipment used temporarily in projects, IoT infrastructure elements, or systems launched outside the standard infrastructure management process.
The problem is that the traditional approach to identifying hosts in the network – based on active scans or agents installed on systems – does not provide full visibility of the environment. As a result, some devices remain outside IT management processes, security monitoring, and network access control.
That is why more and more organizations are building device detection in the network based on passive traffic analysis, which allows devices to be detected at the moment they begin communicating in the network – without interfering with their operation and without generating additional traffic in the infrastructure.
Such an approach combines three key areas of modern IT environments:
- network visibility, i.e., the ability to observe real network traffic
- security operations, i.e., detection and analysis of events by SOC teams
- infrastructure governance, i.e., the decision-making process regarding which devices can operate in the organization’s environment
Table of Contents
Unknown devices as a source of risk in the organization’s network
Every device connected to an organization’s network becomes part of its attack surface.
In an ideal scenario, IT teams have full knowledge of all hosts operating in the environment – from production servers to user workstations. In practice, however, an organization’s infrastructure often grows faster than the processes used to manage it.
Unknown devices in the network most often appear in several recurring scenarios:
- vendor equipment temporarily connected to the infrastructure
- devices used in pilot projects
- employees’ private devices (BYOD)
- IoT systems installed outside central management
- hosts launched as part of shadow IT
Shadow IT refers to technologies used within an organization outside the formal supervision of the IT department. In the context of network infrastructure, this often means devices connected to the network without a formal authorization process.
From a security perspective, such hosts may pose a serious threat. Most often, this means:
- lack of patch and vulnerability management
- lack of control over network communication
- lack of monitoring of device activity
- lack of an assigned owner within the organization
That is why detecting unknown devices in the network is becoming one of the fundamental elements of an infrastructure security strategy.
Limitations of active scans and agents in device detection
Traditional methods of identifying devices in the network are mainly based on two approaches: active infrastructure scanning and installing agents on hosts.
Active network scanning involves sending queries to IP addresses to identify hosts and services operating in the environment. Although this method is widely used, it has several significant limitations.
First of all, scans are usually performed periodically – for example, once a day or once a week. This means that devices appearing in the network for a short time may remain undetected.
Additionally, scanning generates traffic in the network, which in some environments – especially production or industrial ones – may be restricted for operational reasons.
The second approach is device detection using agents installed on operating systems. Such solutions allow precise identification of hosts, but they work only for systems centrally managed by the organization.
In practice, this means that agents cannot be installed on many types of devices, such as:
- network printers
- IP cameras
- IoT devices
- vendor equipment
- industrial systems
As a result, the organization has full visibility of only part of its infrastructure.
Passive device detection and vendor identification
An alternative to active scanning is passive device detection based on the analysis of real network traffic. This approach involves monitoring copies of network traffic – for example, from switch SPAN ports or network TAP devices – without interfering with communication between hosts. When a new device appears in the network, it almost immediately begins generating characteristic communication events.
In practice, it usually looks like this:
- the device obtains an IP address from a DHCP server
- a new MAC address appears in the network
- the host begins making DNS queries
- it initiates the first connections to network services
For a system analyzing network traffic, this means the appearance of a new communication identity in the infrastructure.
On this basis, it is possible to identify:
- the device’s MAC address
- the assigned IP address
- the moment of first activity in the network
- the nature of communication
An important element of this process is also vendor detection, i.e., identifying the device manufacturer based on the MAC address. The first part of the MAC address – the so-called OUI (Organizationally Unique Identifier) – indicates the device manufacturer. This makes it possible to initially determine the type of host, e.g.:
- laptop
- smartphone
- IP camera
- network printer
- IoT device
Combined with network traffic analysis, this makes it possible to build a realistic picture of the devices operating in the organization’s network.
Allow list and watch list as elements of control and risk management
Detecting a new device in the network does not automatically mean a security incident. A key element of the process is host classification and determining its status in the IT environment. In many organizations, two basic mechanisms are used for this purpose: allow list and watch list.
The allow list includes devices recognized as authorized elements of the infrastructure. These may include:
- production servers
- network devices
- employee workstations
- systems centrally managed by IT
If a host is on the allow list, its presence in the network does not require additional analysis. The watch list serves a different function. It is a list of devices that have been detected in the network but require additional verification. It may include, for example:
- new hosts appearing in the infrastructure
- vendor equipment
- test devices
- systems with an unknown owner
This approach allows security teams to manage risk in an organized way instead of reacting only at the moment of an incident.
Automatic incident creation in Jira for unknown devices
In large organizations, infrastructure may include thousands of hosts. Manual analysis of every new device would be very time-consuming in such an environment. That is why device detection systems are increasingly integrated with incident management tools such as Jira.
When a traffic monitoring system detects a new device, it can automatically:
- create an incident ticket in the system
- record the host’s IP and MAC address
- indicate the device manufacturer
- attach information about its first activity in the network
As a result, SOC analysts receive the full context of the event already at the reporting stage. This approach also makes it possible to build a history of device appearances in the network, which is particularly important during security audits.
Decision-making workflow, escalations, and auditability of actions
Device detection in the network should be linked to a clear decision-making process regarding their status in the infrastructure.
In practice, the workflow for handling an unknown device may look as follows:
- the traffic monitoring system detects a new MAC address
- the host is marked as a new device in the network
- an incident ticket is automatically created
- the SOC team analyzes the host’s communication
- administrators identify the device owner
- a decision is made regarding its further status
Such an approach ensures full auditability of actions, as every decision regarding a device is documented in the incident management system.
Integrations with security systems and network infrastructure
Modern device detection systems rarely operate in isolation. In practice, they are part of a broader security tools ecosystem.
They most often integrate with:
- SIEM systems
- SOAR platforms
- NAC (Network Access Control) systems
- firewalls and network segmentation systems
Thanks to such integrations, it is possible not only to detect new devices but also to automatically respond to their presence in the network.
Blocking unauthorized devices – automatic and approved
In some cases, detecting an unknown device may require immediate action.
Enforcing network access policies can be carried out in several ways:
- through NAC systems
- through firewall rules
- through network segmentation
- through dynamic block lists
Depending on the organization’s security policy, blocking may be performed automatically or require administrator approval.
This approach makes it possible to maintain a balance between infrastructure security and the continuity of IT environment operations.
Transition from reactive response to conscious network control
In many organizations, device detection takes place only at the time of an incident or audit. However, a modern approach to infrastructure security assumes continuous visibility of the network environment. Thanks to passive traffic analysis, it is possible to:
- continuously monitor devices in the network
- quickly detect new hosts
- identify unauthorized equipment
- maintain control over the IT environment
As a result, organizations move from a reactive security model to conscious network infrastructure management, in which every element of the environment is visible and subject to appropriate security policies.
