When the Device is not listed in the White list, UDT will list it as Rouge device.
My question related to the action for this Rogue device If its port can be shut down automatically once it is detected or it's need manually intervention
have you tried to check the email action on the Orion Alerting and see if it is listed there?