> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getthread.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Identity Alert History Check

> On a new identity or EDR alert, look back 90 days for prior alerts of the same type for the same user and client, check for a reported trip on unexpected-country alerts, and post the history as an internal note.

<Info>
  **Category:** Security · [View source ↗](https://github.com/Thread-Magic/super-magic-skills/blob/main/skills/security/identity-alert-history-check/SKILL.md)
</Info>

**Runs as:** <span className="thread-chips" data-skill-tier="agent"><span className="thread-chip thread-chip-tier-agent">Agent</span><span className="thread-chip thread-chip-beta">Beta</span></span> Paste this prompt into a Flow's New Super Magic Agent action and it runs unattended on a matching ticket event. You can also run it yourself in Super Magic while you prove it out.

**Connectors:** <span className="thread-chips"><span className="thread-chip thread-chip-native">Thread</span></span>

**Role:** [Security & Compliance Owner](/start-here/roles/security-compliance-owner), [Technician](/start-here/roles/technician)

**Outcome:** Faster Resolution & Response, Risk & Compliance

**When to use:** An identity or EDR alert arrives ("Unexpected country: Denmark by [jane@client.com](mailto:jane@client.com)", "Unexpected VPN: \<provider>", "Critical incident on host") and the analyst's first question is whether this has happened before, or whether the user told you they were travelling.

**Run it:** on one ticket · or as a Flow (when a ticket is created from your ITDR or EDR vendor, such as Huntress, Blackpoint or SentinelOne).

## Prompt

```
Give the analyst this alert's history before they start. Read-only apart from one internal note.

1. Parse the title. Extract:
- Alert type, e.g. "Unexpected Country", "Unexpected VPN", "Critical Incident".
- The identity: the full email address in the title (or the hostname for device alerts).
- A short subtype keyword: the country, the VPN provider, or the incident descriptor.
- The country, only for unexpected-country alerts.
Common shapes: "<Vendor> <Product> <Severity> Unexpected Country - <Country> by <email> (<Company>)", "<Vendor> <Product> <Severity> Unexpected VPN - <VPN> by <email> (<Company>)", "<Vendor> <Product> Critical Incident ... on <email or host> (<Company>)". If you cannot extract an identity, post "Alert history check skipped: no user or device identified in the title." and stop.

2. Use the client on the ticket itself. Do not parse the company from the title or search for it.

3. Search this client's tickets from the last 90 days, any status, using two short separate search terms, the identity and the subtype keyword. Do not search on the whole title as one phrase; long exact phrases miss matches. Exclude this ticket. If a search may have hit its result cap, say so.

4. Unexpected-country alerts only: search this client's tickets from the last 30 days for the identity plus the country and travel words (travel, vacation, trip, OOO, out of office). Keep only tickets that plausibly show the user reported travel to that country.

5. Post one internal note, plain text:
ALERT HISTORY (last 90 days)
Alert type: <type> | Identity: <identity> | Client: <client>
Prior alerts found: <n>
- #<ticket> <summary> | <date> | <status>
(or) This is the first alert of this kind for this identity in the last 90 days.
Expected travel (last 30 days, <country>): <n> (unexpected-country alerts only)
- #<ticket> <summary> | <date> | <status>
(or) No travel to <country> reported in the last 30 days.

Report what you found; do not judge whether the alert is malicious, and never close, merge, reprioritise or reassign. Never invent a ticket or date. Never contact the user.

As a Flow: your entire reply is the note.
```


## Related topics

- [Downloads, Alerts, and Scheduled Delivery](/analytics/downloading-alerts-scheduling.md)
- [Client Intelligence Service Tech Guide](/ai-agents/knowledge-intelligence-service-tech-guide.md)
- [Super Magic prompting 101](/super-magic/prompting-101.md)