1. A method comprising: monitoring a behavior of a first computing system; creating a history of actions performed by the first computing system based on the monitoring, wherein the history comprises a plurality of records, each record of the plurality of records corresponding to a first occurrence of a specific action, authorized and performed on a resource of a plurality of resources of the first computing system, the history further comprising a description of the specific action, a reason for performing the specific action and a list of objects affected by the specific action; detecting an activity on the resource of the plurality of resources of the first computing system, the activity comprising a potential threat to the first computing system; accessing a record of the plurality of records in the history corresponding to the resource; comparing, by a processing device, information about the activity on the resource to the description of the specific action, the reason for performing the specific action and the list of objects affected by the specific action in the record to determine whether the activity comprises a second occurrence of the specific action on the resource, wherein the activity comprises at least one of an attempt to access a restricted file or network address or receipt of a communication attempt from a restricted network port; and classifying the potential threat as an actual threat if the activity on the resource does not comprise a second occurrence of the specific action on the resource.