tracecathq/tracecat/business-context

business-context

Use this skill before you call mail or account activity abnormal. It is the only record of what this organisation expects. No other skill holds that.

This file is a template. The rows below use the reserved example.com domain. Replace them with your own organisation before you publish the skill. Until you do, nothing in those tables is evidence. Say "no baseline recorded" rather than treating an example row as fact.

Known benign email

A pattern matches only when every condition in the row holds. A similar sender or a similar subject is not a match.

Employee list

Match a mailbox to a person by the full address, in lower case. Do not build an address from a name.

Normal account activity

• Sign-ins from the organisation's usual country, during working hours, are the baseline. A country the account has not used is not.
• A new OAuth grant, a new recovery address, or a change to 2-Step Verification is not normal unless a row above says it is.
• No shared mailbox and no team address is a person in the employee list.

When a section does not answer

Say which section you read and that it does not cover the question. Do not fill the gap with a plausible guess. A missing row is "not recorded", not "abnormal" and not "benign".