Security to detect specific device

[ali066khan]

Hello,

How do I set up a custom alert in IoT Security to detect specific device vendors? I have several MAC vendor/OUI codes and want an alert whenever a device matching one of them connects to our network.

[S.Cantwell]

For what you’re describing, I’d do it in Palo Alto Device Security / IoT Security using a Custom Alert Rule, with the OUI Vendor or a tag/custom attribute identifying those OUIs.

Palo Alto’s current Device Security platform explicitly tracks OUI Vendor (NIC vendor) separately from the device’s normal Vendor attribute. The OUI Vendor is derived from the MAC address.

Recommended approach

In Device Security / IoT Security, go to:

Alerts → Custom Alert Rules → Create Rule

Create something like:

Rule: Unauthorized Vendor Device Connected
Condition: Change Event → New Device Discovery
Target Device: devices matching your vendor/OUI criteria
Action: Generate Alert / Email / send to SIEM, etc.

Palo Alto specifically supports New Device Discovery as a Change Event, which makes it a good fit for “tell me whenever one of these devices first appears.” Custom alert rules can also notify users or forward the alert into third-party systems.

The one wrinkle is that the Custom Alert Rule editor does not appear to expose raw MAC prefix/OUI as one of its documented direct target selectors. Palo Alto documents target selectors such as IP, subnet, VLAN, tags, custom attributes, category/profile, switch/AP, and related device attributes.

So I would use this pattern:

1. Identify the devices by OUI Vendor / MAC OUI.

In Assets → Devices, use the Query Builder/filtering to find devices matching the OUI/vendor you care about. Device Security has an OUI Vendor field specifically representing the NIC manufacturer derived from the MAC address.

For example, suppose you care about:

AA:BB:CC
11:22:33
DE:AD:BE

and Device Security resolves those to something like:

Acme Wireless
Example IoT Corp
Contoso Electronics

Ideally filter on OUI Vendor rather than the device-level Vendor, because those mean different things in IoT Security.

2. Create a tag/custom attribute for the devices you care about.

For example:

Custom Attribute:
Monitored_OUI = Yes

or a tag:

Restricted-OUI

Device Security supports automatically assigning custom attributes based on saved device filters. You create the device filter first, then create an IF/THEN custom attribute rule such as:

IF device matches <Restricted-OUI-vendors>
THEN Monitored_OUI = Yes

New devices matching that filter will subsequently receive the custom attribute automatically.

Then your alert rule becomes very clean:

WHEN
    Custom Attribute "Monitored_OUI" = "Yes"
AND
    Change Event = New Device Discovery

DO
    Generate High Severity Alert
    Notify Security Team

That’s the architecture I’d favor.

There may be an even better option in the newer platform

If you're on the newer Device Security in Strata Cloud Manager, Palo Alto introduced Action Center in June 2026. It can scope devices using device criteria, trigger on New Device, and then automatically add a tag, raise a security alert, or perform other actions.

So on a current tenant, you may be able to simplify this to roughly:

Scope:
    OUI Vendor IN (
       Vendor-A,
       Vendor-B,
       Vendor-C
    )

Trigger:
    New Device

Actions:
    Add tag "Restricted-OUI"
    Raise Security Alert

That would be preferable to shoehorning this into HIP.

One important distinction

Be careful about Vendor vs. OUI Vendor.

Palo Alto treats them as separate attributes:

Attribute	Meaning
Vendor	Manufacturer Palo Alto believes made the actual device
OUI Vendor	Manufacturer associated with the NIC/MAC prefix

For example, an industrial controller could have:

Vendor: Siemens
OUI Vendor: Intel

because Intel made the network interface.

If your requirement is specifically “alert me when these MAC OUIs appear,” use OUI Vendor / MAC-derived information, not simply Device Vendor.

And one other consideration: randomized/private MAC addresses can make OUI-based detection unreliable for some Wi-Fi clients, although that's generally less of an issue with fixed-purpose IoT/OT devices.

So conceptually, I'd build yours as:

MAC/OUI
   ↓
Device Security identifies OUI Vendor
   ↓
Saved filter / custom attribute or tag
   ↓
New Device Discovery
   ↓
Custom Alert
   ↓
Email / SIEM / SOC notification