Yes Kyle,
sorry for the late reply. we will need the add the rule, as i shown in the screen shot above and Add a Network scan under Device setup --> Communication --> Discover tab on Airwave GUI, using which Airwave will do nmap/snmp on the network and try to get the http wireline finger printing to classify a rogue device. However, easier and more reliable to find the wired rogue device is by adding the wired switches to the Airwave but then depending upon the resources available on Airwave.