Lost/Stolen Device Sentinel Actions

[shawninfinity]

Hello,

Very new to Sentinel so forgive me if this is an easy one! I was wondering if there was anything you would recommend to do in Sentinel for a device that is lost/stolen? Maybe create an alert if it attempts to contact the network/is logged in to? How would you go about doing it?

Thank you!

[#2]

So you'd have to know that the device is stolen first, you dont mention the product that feeds Sentinel, so lets assume for now that you "know". If you know the name or details, then I'd probably populate a Watchlist of known stolen devices https://learn.microsoft.com/en-us/azure/sentinel/watchlists and generate an alert if any of those are seen in the Logs.