You can create a new device group for jail-broken devices, and then add an alert rule for the device event "Device security violated" and with action to automatically relocate such device to the new jail-broken device group.