The audit log
The audit log records every change to Sift’s state: who or what made it, what it changed, and when. Use it to answer “who approved this threshold”, “why did this filter go back to shadow”, or “who has been trying to sign in”. Only an admin can read it, under the gear icon (Administration) › Audit log.
What a row records
Section titled “What a row records”| Column | Meaning |
|---|---|
| When | The time of the change. |
| Action | What happened, as a dotted code such as filter.state.active. |
| Actor | The account that acted, or system when Sift acted on its own (a fall-back, a first Kindo key going live once its checks pass, an expired staged key). A failed sign-in with a username that does not exist, and any throttled sign-in, also show system; the username that was tried is stored with the row, but neither the console nor the API shows it. |
| Target | What was acted on: a type (filter, user, credential, recipe, webhook_endpoint, analysis_report, portfolio_scan) and its id. |
| (last column) | Detail, on a row that has any, opens Before and After: the relevant fields before and after the change, including any reason or note a person wrote, and the request id. |
The request id matches the request_id in Sift’s logs, so you can find the log lines of
the request that made a change.
A row is recorded together with the change it describes: a change that succeeded always has its row, and a row never describes a change that did not happen.
What the rows never contain: passwords, the Kindo API key, webhook URLs, header values or secrets. They record that a key or secret changed and, where useful, its last four characters.
Read the log
Section titled “Read the log”Rows are newest first, 50 at a time. Select Load older entries for the next page. The Target menu narrows the list to filter, user or credential, or shows everything.
Badges are colored to catch the eye: approvals stand out; rejected thresholds and stage changes, failed and throttled sign-ins, and moves to shadow or paused are marked as warnings.
The API can filter further, by any target type and by actor:
GET /api/v1/admin/audit-log?target_type=webhook_endpoint&actor_id=<user id>. See
API endpoints.
Common actions
Section titled “Common actions”Filter lifecycle
Section titled “Filter lifecycle”| Action | When |
|---|---|
filter.created, filter.version_created | A filter, or a new version of its spec, is saved. |
filter.version_swapped, filter.version_discarded | A waiting version is put in place, or dropped. |
filter.state.<state> | The filter moved to a state: filter.state.shadow, filter.state.active, filter.state.paused, filter.state.retired, and so on. A move Sift made on its own (drift, the trigger ceiling) has system as the actor and the cause in After. |
filter.ceiling_breached | The filter reached its trigger ceiling. |
filter.delivery_stalled, filter.delivery_restored | Escalations stopped reaching the agent, and started again. |
filter.budget_bound, filter.budget_released | The filter’s agent budget came to keep escalations back with some waiting, and later had room again. Written by system, once at each edge. |
filter.queue_losing, filter.queue_recovered | The budget’s held queue began losing escalations (aged out, or pushed out of a full queue), and an hour passed with none lost. |
filter.warm_start | Someone asked for a warm start: After has the count, the gold set and the cost when priced. A training it queues at the floor is model.training_queued, by system, naming the warm start. |
filter.loosened, filter.point_restored | Sift moved the filter to its safer point on a drift alarm, and a person returned it to the approved point. |
filter.paired, filter.agent_created | The filter was connected to its agent, or Sift created the paired agent. |
filter.cutover_acknowledged | Someone confirmed the displaced agent is stopped. |
filter.model_swapped, model.training_queued | A retrained model took over; training was started. |
filter.recommendation_declined | Someone declined a recommendation on Actions. |
filter.verdict_check_switched, filter.verdict_check_paused, filter.verdict_check_resumed, filter.verdict_checked | The verdict check was turned on or off, paused, resumed, or an item answered. |
event.rescued | An Always-escalate rule sent an event the filter would have filtered. |
Approvals
Section titled “Approvals”| Action | When |
|---|---|
approval.gold_set.approved, approval.gold_set.rejected | Someone decided on a gold set. |
approval.threshold_promotion.approved, approval.threshold_promotion.rejected | Someone decided on a threshold. After holds the rationale. |
approval.threshold_promotion.point_overridden | The approval was at a frontier point other than the one the posture picked. |
approval.threshold_promotion.withdrawn | Sift withdrew an approval, on a fall-back. |
approval.threshold_promotion.reaffirmed | Someone chose Keep filtering on an alarm, so the filter went on filtering. |
approval.threshold_promotion.carried_forward, approval.threshold_promotion.withdrawal_carried_forward | A new version kept the approval, or the withdrawal, of the one before. |
approval.stage_change.approved, approval.stage_change.rejected | A grouping change in Shape delivery was decided. This is never a threshold approval. |
alarm.acknowledgement_lapsed | An alarm acknowledgement stopped applying: the signal cleared, seven days passed, a different model or a gated change took over, or the filter fell back. |
Gold sets and labels
Section titled “Gold sets and labels”| Action | When |
|---|---|
gold_set.build_queued, gold_set.built, gold_set.build_failed, gold_set.created | A gold set build was started, finished or failed. |
gold_set.item_labelled | Someone labelled a gold-set item. |
labels.history_import_queued, labels.history_imported, labels.history_import_failed, labels.history_withdrawn | Label history was imported, or withdrawn. |
analysis.requested, analysis.completed, analysis.failed, portfolio_scan.requested, portfolio_scan.finished | An agent analysis or a scan of several agents. |
Accounts and sign-in
Section titled “Accounts and sign-in”| Action | When |
|---|---|
auth.login_succeeded, auth.logout | A sign-in or sign-out. |
auth.login_failed | A failed sign-in. After says why: unknown_username, bad_password or disabled. |
auth.login_throttled | A sign-in refused by the throttle, with the client address. |
auth.password_changed, auth.password_change_failed, auth.password_change_throttled | A password change, a wrong current password, or one refused by the throttle. |
user.created, user.role_changed, user.disabled, user.enabled | An admin changed an account. The seeded admin’s creation has system as the actor. |
Kindo connection
Section titled “Kindo connection”| Action | When |
|---|---|
credential.staged, credential.pending_discarded | A key was staged in the wizard, or discarded (by Cancel, or after an hour). |
credential.created, credential.replaced | A first key went live; a replacement went live. Before and After name both keys by label and last four characters. |
credential.check_started, credential.check_finished | A connect, replace, Change model or Verify check. |
credential.verified, credential.model_selected | The tenant check recorded its result; a model was stored. |
credential.deleted | The connection was removed with Disconnect. |
Recipes and notifications
Section titled “Recipes and notifications”| Action | When |
|---|---|
recipe.enabled, recipe.disabled | An admin turned a recipe on or off. |
webhook.created, webhook.updated, webhook.deleted, webhook.secret_rotated, webhook.test_sent | An admin changed a notification endpoint. |
Retention
Section titled “Retention”Sift never deletes audit rows: there is no retention period, and neither the console nor the API can edit or remove them. A row keeps the actor’s username, so it still says who acted even if the account is later disabled.
The log is kept in Sift’s database. Back the database up to keep it; see Back up and restore.