Create a filter

You create a filter by telling Sift what matters, letting Sift’s assistant read a sample of the source and propose a filter, and reviewing that proposal before you create it. A new filter filters nothing: it needs two approvals first, the gold set and a threshold.

Before you start

You need the operator or admin role. The New filter button is not shown to a reviewer, and opening the page directly says “Creating a filter needs the operator or admin role.”
Sift needs a working Kindo connection. If it has none, the page stops on Sift has no Kindo connection, The Kindo connection is not verified or Kindo is not answering Sift, and an admin fixes it under the gear icon (Administration) › Kindo connection (see The Kindo connection). If Kindo refused one of Sift’s calls in the last hour, the page says Kindo refused Sift recently; you can select Continue anyway.
The source must be an integration connected in your Kindo tenant. Sift reads it through the credential Kindo holds for that integration and holds none of its own.

The flow at a glance

The progress strip at the top shows four steps: Source, Build the filter, Review and create, and Connect the agent. The last is marked as optional (its tooltip says “If needed”): it applies only when the filter feeds a paired agent that Sift generates for it.

Steps

Open Filters and select New filter.

The page asks What should this filter catch? and offers three ways to start, under Start from.

Choose how to start:

Choice	Use it when	What you do
A source	You know which integration carries the events.	Pick it from the list, under Recently used, or by typing in Find an integration.
An agent	An agent already does this work and you want its history measured first.	See Start from an existing agent.
A description	You know what you want but not which source has it.	Write it in Description and select Find the source.

Integrations that expose no tools are hidden from the list; a line under it says how many.

If you chose a source, read the check line under it.

It says Sift can read the source, with a record count, the tool and the first few fields; or Sift can’t read it, with the reason; or “Sift will find how to read this in the conversation.” when it could not check. If the credential lacks permission, ask whoever connected the integration in Kindo to grant read access. Use Choose another source to change it.
Write the Description, or select one of the suggestions under Start from one of these.

Say which events matter and what the agent should do about them. The description can be up to 4,000 characters. Sift checks words you wrote yourself before it goes on (see What can go wrong).
Select Continue.

If the check line said Sift can’t read the source, the page asks “Continue anyway?” once: select Continue anyway or Choose another source.

The page becomes Building the filter. The assistant works through Finding the source, Fetching data, Analyzing data and Proposing the filter, with the time beside it (Working · 0:24, then the total once the turn ends). A run may skip a stage. Show what Sift did lists each step, with what it read.
Answer the assistant if it asks.

The conversation panel is titled Sift needs an answer when it is waiting on you. Type in the reply box (Answer, or add a detail.) and select Send, or press Cmd+Enter (Ctrl+Enter).
Read the proposal card, Proposed filter.

It shows the filter’s name, the pipeline it would run, and any Open questions. Select Answer beside a question to start a reply to it, or reply below to refine the proposal. A newer proposal marks the older one Superseded.
Select Review and create →.
Check the review page, Review and create:
- Name and Intent. The intent is shown at both approvals, and the gold set is reviewed for whether its examples match it. It cannot be changed once the filter leaves authoring.
- What it will do: what it reads and each stage of its pipeline. Select a step to change it. See Use Collapse, Always escalate and Shape delivery.
- Compare against, under the Decide stage: the candidate recipes measured beside the deciding one, if any. A candidate never filters anything. Tick or untick them, or use Add a candidate (see Compare recipes in a bake-off).
- Agent load: how big the stream is, what shadow would cost the agent, and the protections Sift suggests. See Agent load.
- Posture, and Advanced settings (source, delivery, monitoring and training). Everything here can be changed later in Settings.
Select Create filter.

The bar beside it says “Starts in authoring. Filters nothing until you approve a threshold.” If something blocks creating, the bar says what instead, for example “State its intent to create it.”, and the button is disabled.

What you should see

The page shows the filter’s name with Created and “In authoring. It filters nothing yet.” The console also starts building the filter’s gold set from the source. The list below has up to three items:

Item	What it shows
Connect the agent	Shown only when the filter feeds an agent Sift generated for it. Get the agent → opens the paired agent: see Connect a filter to its agent.
Review the gold set	The build’s state: `building`, `ready · N examples`, `build failed`, or `not started` if the build could not be started. Review → opens it: see Review the gold set.
Start shadow	Open the filter goes to its Actions tab, which tracks each remaining step. Where the stream’s size is known, a line says what shadow will cost the agent, such as “About 4,000–6,000 agent runs an hour until a threshold is approved”, or under a budget “At most 800 agent runs an hour; the rest wait in a queue”.

When the assistant modelled the filter on an existing agent that declares named inputs, the filter sends events to that agent, and the progress strip’s Connect the agent is struck through.

Agent load

In shadow a filter sends the agent every event until you approve a threshold. On a stream bigger than the agent can take, that is the expensive part, so the review page says what it will cost before you create the filter, and suggests protections. Nothing is switched on unless you tick it. For when to tick each protection, see Put Sift in front of a big stream.

Agent load shows:

Item	What it says
Events an hour	The stream’s size as a range, and what it was read from: measured (a day of polls), as you said, from a read of the source, from the agent’s past runs, or not known.
Agent runs an hour in shadow	What shadow would start, as drafted: every event, the sample’s share, or the budget.
Cost a day	Shown only when the deployment prices an agent run.
A meter	Shadow’s runs against what the agent can take, with the deployment’s Kindo rate limit marked. over capacity when the low end is over it.
The agent can take	The agent’s capacity in runs an hour. Empty uses the deployment’s default. Change it if you know better; it only changes what Sift suggests.

When nothing has read the stream, the page asks About how many events an hour?: Not sure (the default), four ranges, or Custom with a number. Not sure suggests nothing, and the page says so.

Under the figures, each suggestion is a row with an unticked box, Recommended, one line on why, and the preset it would set:

Suggestion	Ticking it
Agent budget	Sets a budget at the agent’s capacity, with Hold in a queue, and opens its settings: the preset, Runs an hour, and under Custom the rest. See The agent budget.
On alarm, a safer point	Sets On alarm to Filter at a safer point. The point itself is chosen when you approve a threshold, on the threshold screen, at 99.5% recall unless you choose another.
Sampled shadow	Sends the agent a sample in shadow, at the share suggested, and opens its presets. See Sampled shadow.
Warm start	Not ticked here: it is offered on the filter’s Actions, beside Start in shadow, once its gold set is approved and its agent paired. See Warm start.

Unticking a row puts its settings back as they were. Lines that are not suggestions say when the agent can take the stream whole, when nothing is known, and when the deployment’s Kindo rate limit, not the agent, is the bound. Every setting here can be changed later in Settings › Delivery › Agent load and In shadow.

What the assistant can and cannot do

The assistant reads; it never changes anything. It can list your integrations and agents, pull a live sample from a source, profile that sample, and propose a filter or decline to build one. It cannot create the filter or approve anything: nothing exists until you select Create filter. It runs on Sift’s model.

Limit	Value
Model calls in one conversation	24
Tool calls for one message of yours	8, after which it stops and asks you which source to read, or what to look for
How long a conversation or proposal is kept	8 hours after it last changed

A conversation you leave shows on the Filters page as “1 draft in progress: … · expires in …” (or a count, when there are several) until it expires. A link to an expired one shows This conversation has expired or This proposal has expired; select Start a new filter.

Writing a good intent

Name the decision, not the data: “Escalate incidents that paged a human and were not auto-resolved”, not “PagerDuty incidents”.
Say what makes an event worth the agent’s run, in terms the event itself carries.
Keep it to one or two sentences. Every gold-set example is judged against it, and it is fixed once the filter leaves authoring.
Name the source if you know it. Naming it is what most often turns a long search into a short one.

What can go wrong

You see	What it means	What to do
Sift couldn’t read the source, while building	The source refused the query, did not answer, answered with no records, answered in a shape Sift cannot read, or the credential is not allowed to read it.	Try the last 30 days (when it refused the query) or Try again (when it did not answer); or type what to read in the reply box (Or tell Sift what to read); or Choose another source.
A request that is not about building a filter	On the first page, Sift’s answer and “One more and this session ends.” While building, the heading That is not what this is for.	Rephrase it as a filtering request. A second one opens Unsupported operation. Start over?: the conversation has ended and nothing was created. Yes starts again; No leaves.
Sift cannot build this as asked	No connected integration carries that data, or you asked for something Sift does not do. Often the assistant asks for a detail that would let it go on.	Answer, or change what you ask for; the conversation stays open.
No filter worth building	The sample’s events do not separate, or carry only one kind: a model trained on them would learn to filter everything. “An answer, not a failure.”	Start over with a different source.
“This session has used its whole budget…”	All 24 model calls are spent. Nothing was saved.	Start a new filter and name the source up front.
A recipe “is turned off for new filters”	An admin turned it off in Filter recipes.	Choose another recipe in that stage, or ask an admin.
A recipe “is not offered by this build”, “needs a decision model” or “cannot be trained on this install”	This install cannot run it.	Choose another recipe in that stage, or untick it as a candidate.
The gold set shows `build failed` or `not started`	Reading the source for the gold set failed, or the build was not started.	Open the gold set and build it again: see Review the gold set.