arpwatch is useful, but on a modern network i would not build the whole process around mac sightings alone. randomized macs, docking stations, phones, and guest devices can make it noisy very quickly. if the goal is “tell me when something new appears,” you can get part of the way there with dhcp logs, windows dhcp audit logs, switch mac tables, or your firewall’s device inventory, depending on what you already run. if the goal is “do not allow unknown devices,” then you are really talking about 802.1x, nac, or at least tighter dhcp/reservation and switch port controls. for a cheaper middle ground i would probably start with dhcp alerting plus a small script or scheduled report before buying a full manageengine product.