> ## Documentation Index > Fetch the complete documentation index at: https://docs.getthread.com/llms.txt > Use this file to discover all available pages before exploring further. # Alert Title Standardizer > Rewrite a security or monitoring alert ticket title into one standard shape of tool, company, alert and asset, so the board sorts, searches and bundles cleanly. Runs asAgent Build it with Agent Builder: add the action to a Flow, choose Prompt the Agent, and paste this in. It runs unattended on a matching ticket event. You can also run it yourself in Super Magic while you prove it out.Works withThreadRole[Dispatcher](https://docs.getthread.com/start-here/roles/dispatcher), [Security & Compliance Owner](https://docs.getthread.com/start-here/roles/security-compliance-owner)OutcomeFewer Escalations & Less Noise, Faster Resolution & ResponseCategory[Triage & Routing](https://docs.getthread.com/skill-library/triage-and-routing/overview) · [View source ↗](https://github.com/Thread-Magic/super-magic-skills/blob/main/skills/triage-and-routing/alert-title-standardizer/SKILL.md) **When to use:** Alert emails arrive with titles like "\[EXTERNAL] FW: Alert: Notification - New suspicious threat detected on JKS-DT07", each vendor in its own format. Analysts cannot scan the board, and bundling skills that match on the title miss half the duplicates. **Run it:** on one ticket · or as a Flow (when a ticket is created on your security or monitoring board). Run it before any bundling or duplicate skill, since those match on the title. ## Prompt ``` Rename this alert ticket to the standard format: - - - 1. Read the current title and the first message. 2. Identify the four parts: - Tool: the product that raised the alert (for example SentinelOne, Blackpoint, Microsoft Defender, Sophos Central, Huntress, an RMM). Use the clean product name; strip brackets, "FW:", "[EXTERNAL]" and other mail artifacts. - Company: the ticket's client name as it appears in the PSA, in full, unless a short form is part of the client's own branding. - Alert: the core event ("New suspicious threat detected", "Agent disabled", "Suspicious sign-in", "Encryption suspended"). Drop filler like "Alert:" or "Notification:". - Asset: the specific machine, user, mailbox, policy or device ID involved. If none is identifiable, leave this part out. 3. Build the title: " - - - ", or " - - " with no asset. 4. If the ticket is still on your catch-all company, use "Unknown client" for Company and say so in the note; never guess a client from the asset name. 5. If the title already matches the format, change nothing and stop. 6. Update the title, then add an internal note: "Title standardized. Old: . New: ." Never change anything but the title. Never invent an asset or a company. Notes are plain text, no markdown or emojis. As a Flow: your entire reply is the note, or nothing when no change was needed. ``` ## Related topics - [Configure Magic Title in Thread](https://docs.getthread.com/assistive-ai/setting-up-magic-title.md) - [Product guides](https://docs.getthread.com/guides/overview.md) - [Downloads, Alerts, and Scheduled Delivery](https://docs.getthread.com/analytics/downloading-alerts-scheduling.md)