Hold, stop, resume or retire a filter

You can stop a filter in two ways. Stop filtering lets every event through to the agent while Sift keeps scoring. Hold events stops Sift reading the source, so the agent gets nothing from Sift at all. You can later resume a stopped filter on the model it was running, or retire a filter for good. This guide covers each move, what it costs, and how to come back from a fall-back Sift made on its own.

Which to use when

You want	Use	Where	Approval or reason
The agent to see every event again, now, without losing anything	Stop filtering	Header menu Stop or hold (active filters only)	Neither. The threshold approval stands.
Nothing sent to the agent while something is investigated	Hold events	Header menu Stop or hold	Neither.
A stopped or held filter filtering again on the same model	Resume on the current model	Actions	A written reason.
A held filter scoring again, filtering nothing	Move it back to shadow	Actions, or Settings › Lifecycle	None on Actions; a rationale on Lifecycle.
The filter ended for good	Retire	Settings › Retire	A written reason.

Before you start

Every move here needs the operator or admin role. The header menu does not appear for a reviewer, or on a filter with no move to offer.

Stop filtering

On the filter’s page, open Stop or hold in the header. It is on every tab.
Select Stop filtering, which reads Every event goes to the agent. Sift keeps scoring and learning.
Read the confirmation and select Stop filtering now.

The filter moves from active to shadow. It escalates every event, at the unfiltered rate, keeps scoring, and keeps collecting labels. Its threshold approval stands, so Actions offers Resume on the current model to put it back on the same model. If a retrain finishes meanwhile and proposes a new operating point, the filter moves to proposed; resuming still puts it back on the old model, and the new one waits.

Stop filtering is only offered on an active filter.

Hold events

Open Stop or hold in the header.
Select Hold events, which reads Sift stops reading the source. The agent gets nothing until you release it.
Read the confirmation and select Hold events now.

You can hold a filter in shadow, proposed or active. The state badge reads paused, and Overview shows Events held with when it started and whether an approval stands. While held, Sift scores nothing, filters nothing and starts no agent run for the filter.

What happens to the events that arrive meanwhile depends on the source:

If the source has a Watermark parameter, Sift asks it for everything since it stopped when the filter scores again. Nothing is lost.
If not, Sift reads what the source returns and keeps what is newer than where it stopped. Events that arrived meanwhile and fall outside that read may never reach the agent.

A held filter carries an Attention condition on Actions until it is released.

A filter with an agent budget keeps its held queue while held: nothing in it is sent or ages out until the filter scores again. Its attention conditions, such as a queue filling, are not raised while the filter is held.

Release a held filter

Open the filter’s Actions tab. The Held card offers one of two ways back, depending on whether an approval stands:

Resume on the current model, if the filter can filter again on its approval. See the next section.
Move it back to shadow, if it cannot. Select it and confirm with Move it to shadow now. The filter reads its source again and scores in shadow, filtering nothing. No reason is asked.

You can also move a held filter to shadow from Settings › Lifecycle: select Move to shadow, write a Rationale, and confirm.

Resume on the current model

A resume puts a filter back to filtering on the model and approval it had, and records your reason as a re-affirmation of that approval. It is offered on Actions, on a filter in shadow, proposed or paused, when one of these holds:

you or someone stopped or held it while its approval stood; or
Sift fell it back on drift or the trigger ceiling, and the model it withdrew the approval from is still the active one.

On Actions, select Resume on the current model.
Read the confirmation. It says what the resume re-affirms, and under Resuming overrides: lists each reading against its alarm level.
Note what it will acknowledge. Drift signals breached now are acknowledged for up to seven days, or until they clear. Any other breach falls the filter back again.
Write your reason in Why (required).
Select Resume filtering.

The filter returns to active on the same model and threshold. Overview’s drift rows mark each acknowledged signal acknowledged, and Actions shows an Acknowledged alarm condition until it ends. The acknowledgement ends at the first of: seven days, the reading coming back within bounds, a new model, a gated change, another fall-back, or a later resume. The trigger ceiling is never acknowledged.

Beside Resume, Retrain is the other way back: a new model enters shadow and filters once its threshold is approved.

When resume is refused

Where a resume would be refused, Actions shows Sift’s reason in place of the button.

Situation	What to do instead
A version was saved with a gated change, so it has no approval to re-affirm	Approve the running model on the threshold screen, or retrain.
Sift fell the filter back because the version running had no approval	The threshold screen offers the running model at that version’s point.
The approval withdrawn was of a model that is no longer the active one	Approve the model that runs now on the threshold screen.
The latest threshold decision is a rejection, or no model has been approved	Approve an operating point on the threshold screen.

See Approve a threshold.

After Sift falls a filter back

Sift moves an active filter to shadow on its own when a drift alarm fires, when it reaches the trigger ceiling, or when the version it is running has no standing approval. It does this only when the filter’s On alarm setting is Stop filtering, the default, except for a missing approval, which always falls back. A fall-back withdraws the approval.

You see it as a condition on Actions:

Condition	Card action	Your choices
Drift alarm (Fell back on drift on Overview)	Resume or retrain	Resume over the readings shown, with a reason; or retrain.
Trigger ceiling (Fell back on its ceiling)	Resume or retrain	Resume, or retrain. Consider raising Max escalations per hour if the volume was expected.
Approval withdrawn	Approve the running model or retrain, Approve on its evidence, or Retrain it	Use the threshold screen, or retrain.

The card shows the readings that tripped it. After a drift or ceiling fall-back it offers two ways back, side by side:

Control	What it does
Resume on the current model	Filters again on this model, with your reason. Follow Resume on the current model.
Retrain	A new model enters shadow; it filters once its threshold is approved. Training is queued at once; approve its proposal on the threshold screen when it arrives.

Which is right depends on what the drift was: resume if the reading reflects a change you expected and the model still serves, retrain if the traffic has moved. Until you act, the filter escalates every event. See Operating point and approval for why a fall-back withdraws the approval.

If On alarm is Keep filtering, Sift does not fall back. The alarm is a fault instead, with four moves on Actions; see Work through Actions.

If On alarm is Filter at a safer point, a drift alarm moves the filter to the safer point approved with its threshold, and it stays active with its approval. A second drift alarm there falls back as above. To filter at the approved point again, use Return to the approved point on Actions and give a reason. The card shows both points, Approved point and Safer point, now, since when and on which signals, with the alarm’s other moves under it. Returning puts the filter back at the approved threshold, re-affirms the approval, and acknowledges the signals breached now for up to seven days or until they clear. See Shadow and filtering.

Retire a filter

Open Settings › Retire.
Write your reason in Why.
Select Retire this filter.
Read the confirmation and select Retire it.

You can retire a filter from any state but retired. Nothing is deleted: its history, approvals and Filtered events stay readable. Escalations still waiting in an agent budget’s queue are closed unsent, as cleared, and recorded. Overview shows Retired with when, by whom and why, and the flow below it becomes the filter’s history. A retired filter has no Actions tab. To start again, create a new filter.

A draft that nobody will finish can be retired from its Actions card with Retire the draft, which opens the same section.

What can go wrong

Stop or hold is missing from the header. You are a reviewer, or the filter’s state has no such move (a draft, authoring, held or retired filter).
The filter falls back again right after a resume. A signal that was not breached when you resumed has breached since; only signals breached at the moment of the resume are acknowledged.