Do you need to monitor an interface in NPM to receive an UDT alert for a rogue device introduced into the network?

I am not monitoring all my ports on my company's switches (approx. 3500 switches) but would like an alert set up to send me an email when a rogue device is introduced into my network.  I am evaluating UDT and configured the whitelist.  I am monitoring all ports in UDT, I am trying to avoid purchasing additional polling engines.

Thanks,