Described herein are techniques for receiving an alert associated with an entity and dynamically determining, based on the alert and on substantially real-time attributes for the entity, a geographically dispersed group in which each member of the geographically dispersed group either is a device associated with the entity or shares at least one attribute with the entity. The techniques further include requesting information about the entity from the geographically dispersed group, receiving information from at least a subset of the group, and taking action responsive to the alert based on the received information.