What is Sift?

Kindo Sift decides which events from a busy source are worth a run of your Kindo agent. It sits in front of the agent, learns from the agent’s own verdicts which events it dismisses, and, once a person approves, stops starting runs on those events. You run it on your own hosts, beside Kindo, not inside it.

The problem it solves

A Kindo agent that triages alerts, tickets or log lines usually runs once per event. On a high-volume source most of those runs end with the agent deciding the event needed nothing. Each of those runs still costs money and time, and the agent cannot be told to skip an event it has not yet read.

Sift reads the source first. For every event it asks: has this kind of event been worth the agent’s time before? Events that have go to the agent. Events the agent has consistently judged benign can be filtered, at a miss rate you choose and approve.

How it works, in one paragraph

You describe what matters, and Sift builds a filter: which source to read, through which Kindo integration, and which agent to send events to. A person checks a gold set of about fifty events, to confirm Sift read the description the way you meant it. Then the filter runs in shadow: it scores every event but still sends every one to the agent. Sift collects the agent’s verdicts (actionable, benign or insufficient data) and learns from them. When the filter has been measured, a person reviews what it would filter and what it would miss, and approves a threshold with a written reason. Only then does the filter start filtering. How Sift works follows that loop step by step.

Where it sits beside Kindo

Sift is a separate, self-hosted service. It talks to Kindo only through Kindo’s public API, with one API key an admin gives it:

• It reads sources through the integrations already connected in your Kindo tenant (Jira, PagerDuty, a SIEM). It has no connectors of its own.
• It starts agent runs itself and reads their verdicts back. The filter is the caller: the agent is not given Sift as a tool, and never learns what Sift predicted about an event.
• Its own language-model calls (Sift’s assistant, which helps you build a filter, the analysis of an existing agent’s runs, and the gold-set proposals) go through Kindo, on a model an admin chooses. Sift holds no model-provider keys for them.

Scoring each event happens inside Sift, with no call out. (The one exception is the optional decision model, which is off by default.)

Creating a filter usually produces a second thing too: a paired agent, a Kindo agent Sift generates to take one event per run and record a verdict Sift can read. You can create it in Kindo from the console, or download it and import it yourself.

Who it is for

Sift is built for IT and security operations teams who run Kindo agents over streams of events, for example:

• alert storms, where many near-identical alerts arrive together;
• ticket and alert triage, where most items need no action;
• log streams, where only the unusual lines matter;
• reported-phishing triage.

Monitoring employees or insider risk is out of scope.

People work in Sift in three roles:

Role	What the console says it does
admin	Manages users and the Kindo credential. Inherits everything below.
operator	Authors filters, runs training, and approves thresholds.
reviewer	Labels gold sets and reads dashboards. Cannot change what a filter does.

What Sift is not

• Not a SIEM or a log store. It reads a source to decide what reaches one agent. It keeps event payloads for 30 days by default, for training, and the record of what it filtered without the payload.
• Not a rule engine you program. Each filter uses one of a fixed set of recipes, techniques you can audit. Sift never writes or runs generated code, and its assistant has no tools that change anything.
• Not a claim of accuracy. Sift reports recall and miss rate measured against your agent’s verdicts, never accuracy, which looks excellent for a filter that filters everything. See How Sift measures a filter.
• Not a promise of savings. How much a filter filters depends on your source and your agent. Sift shows what a filter would filter before you approve it, measured on your own events.

Where to go next

You are	Start with
Someone who creates and watches filters	Your first filter, then A tour of the console
Asked to review a gold set	Review the gold set
The admin who connects Kindo and manages users	Connect Kindo, then Users and roles
The operator who installs and runs the stack	Install Sift, then Deploy for production
Deciding whether Sift is safe to run	What Sift guarantees