diff --git a/lib/pf/constants/trigger.pm b/lib/pf/constants/trigger.pm
index 115823f6b6..67aa9caa98 100644
--- a/lib/pf/constants/trigger.pm
+++ b/lib/pf/constants/trigger.pm
@@ -86,6 +86,7 @@ our $TRIGGER_MAP = {
     "fingerbank_diff_score_too_low" => "Fingerbank Collector detected a network behavior that doesn't match the known profile",
     "fingerbank_blacklisted_ips_threshold_too_high" => "Fingerbank Collector detected traffic to blacklisted IPs",
     "fingerbank_blacklisted_ports" => "Fingerbank Collector detected traffic to blacklisted ports",
+    "is_max_reg_nodes_reached" => "max nodes per pid met or exceeded",
   },
   $TRIGGER_TYPE_PROVISIONER => {
     $TRIGGER_ID_PROVISIONER => "Check status",
diff --git a/lib/pf/node.pm b/lib/pf/node.pm
index d0d88bfa80..17a77ce0c1 100644
--- a/lib/pf/node.pm
+++ b/lib/pf/node.pm
@@ -1116,6 +1116,14 @@ sub is_max_reg_nodes_reached {
         $logger->warn("No role specified or found for pid $pid (MAC $mac); assume maximum number of registered nodes is reached");
     }
 
+    my $apiclient = pf::client::getClient;
+    my %security_event = (
+        'mac'   => $mac,
+        'tid'   => 'is_max_reg_nodes_reached',
+        'type'  => 'internal',
+    );
+    $apiclient->notify('trigger_security_event', %security_event);
+
     # fallback to maximum reached
     return $TRUE;
 }