Glossary

The words Sift uses, with the meaning they have everywhere in the console and in these pages. Where the API names a thing differently, its name follows in code. Each term has its own anchor, so a page can link to one: /docs/reference/glossary/#leak-through.

A

Actions

The first tab on a filter’s page. It lists what the filter needs and who should act: conditions to fix, recommendations to accept or decline, Setup steps, and what Sift is doing meanwhile. See Health, Actions and alerts.

Active

The lifecycle state in which a filter filters events. The only one. A filter may be active only while a person’s threshold approval stands for the version it runs. The console’s badge for it is Filtering.

Actionable

The verdict an agent gives an event that needed doing something about. One of three verdicts.

Agent budget

The most agent runs a filter starts in a rolling hour, in every state (operating_point.agent_budget). Off unless you set it. What it has no room for is never filtered: it waits in the held queue, goes in a grouped run, or is recorded, by the budget’s overflow. See The agent budget.

Agent capacity

How many runs an hour the agent can take (The agent can take in the console, target.capacity_runs_per_hour). Sift sizes its suggestions for a big stream from it. It limits nothing by itself.

Always escalate

The first slot of the pipeline (guarantee). Rules that send an event to the agent whatever the later stages decide. It can only add escalations, never filter.

Analyzer

Measures an existing agent’s run history, before a filter is built for it: how many runs found nothing, and whether those runs can be told apart from the rest.

Assistant

Sift’s assistant in the new-filter flow (copilot in the API). It reads samples of the source and proposes a filter, or proposes building nothing; it cannot change anything itself. It runs on Sift’s model.

Ask

One item on the Actions tab.

B

Bake-off

The side-by-side comparison of a filter’s candidates. It may recommend switching recipe; it never switches on its own.

Benign

The verdict an agent gives an event that needed nothing. Only benign verdicts teach Sift what can be filtered.

C

Candidate

Another Decide recipe measured on the same events as the one deciding. A candidate never filters anything. The set of them is the slate.

Collapse repeats

The second slot (collapse), and its recipe (dedup_cluster). Folds an event into a near-identical earlier one, so the agent runs once for the group. The repeats are filtered; the one that escalates tells the agent how many it stands for.

Copilot

The API’s name for the assistant.

D

Decide

The third slot (decide). Scores each event and filters the ones below the threshold. Most filters’ deciding stage.

Deciding stage

The stage that carries a filter’s model, operating point and approval: Decide, or Collapse repeats on a filter that only collapses.

Decision model

An optional yes/no model an admin can turn on. It can add escalations and raise questions for a person; it never filters. See The decision model.

Displaced agent

The agent a filter replaced, when the filter’s paired agent takes over its work. Until it is confirmed stopped, Sift does not count spend as saved. Sift checks it hourly while the filter is active; Dismiss… records that a person has dealt with it, not that the agent was retired.

Drift

A filter’s traffic or scores changing from what it was approved on. Sift watches how often the filter sends, its scores, the events’ fields, and the agent’s verdicts on the leak-through sample. When one of them passes its alarm level, the filter falls back to shadow, or, if its On alarm setting is Keep filtering, keeps filtering and raises a fault.

E

Escalate

Send an event to the agent. Everything a filter does not filter is escalated.

Event

One record read from a filter’s source: an alert, a ticket, a log line.

F

Fall back

Sift moving an active filter to shadow on its own, because of drift, the trigger ceiling, or a version running without an approval. A fall-back withdraws the approval.

Filter

A definition of which events from one source are worth one agent’s run, plus where it stands in its lifecycle. Each saved change is a new version.

Filtered events

The record of every event a filter filtered: which event, its score and the model, without the event’s content. Kept 400 days by default. The console’s tab and page are Filtered events; in the API it is GET /api/v1/filters/{filter_id}/filtered-events.

Filtering

Not sending an event to the agent. Only an active filter filters; an event it keeps from the agent is filtered. Would filter is what a filter in shadow records it would have filtered.

Fit check

The decision model’s measure of how well it reads a filter’s intent, shown as reads it well, reads it partly or does not read it.

Frontier

The measured trade-off between filtering more and missing more, measured on the holdout: at each threshold, the share filtered, the recall, and the events missed.

Futility

The share of an agent’s past runs that concluded nothing was actionable, as the analyzer measures it.

G

Gold set

About fifty events from the live source, each proposed as matching the filter’s intent or not, and then judged by a person, Escalate or Filter. Approving it is the first of the two approvals a filter needs. Anyone signed in can judge examples; approving the set takes an operator or admin.

H

Health

Sift’s one judgement of whether a filter needs anything, shown as the Fault or Attention badge on the Filters page, the dashboard’s Needs attention, and the Actions tab. A condition is a fault (something is broken) or attention (a person should look).

Held queue

Where an agent budget holds the escalations it has no room for, until there is room. The likeliest incidents leave first. An escalation that waits too long, or is pushed out of a full queue, leaves unsent and is recorded.

Hold events

Pause a filter: Sift stops reading its source, so nothing is scored or sent. It picks up from where it stopped when released, if the source can be asked for events since a point (see Hold, stop, resume or retire). The state badge reads paused.

Holdout

The newest 20% of a filter’s labels (or 30%, the Holdout setting), kept out of training and used to measure the model before you approve a threshold. Always the newest, so the measurement reflects recent traffic.

I

Insufficient data

The verdict an agent gives when an event did not carry enough to judge. Sift counts it with actionable: an event the agent could not clear is not one to filter.

Integration

A connection in your Kindo tenant (Jira, PagerDuty, a SIEM). Sift reads every source through one; it has no connectors of its own.

Intent

One or two sentences saying what matters to the filter. The gold set is judged against it.

K

Kindo connection

The Kindo API key Sift uses and the model chosen for it, set by an admin under the gear icon (Administration) › Kindo connection (credential in the API).

L

Label

One event with a verdict attached, used for training. Labels come from the agent’s verdicts on escalations and on the leak-through sample, from imported history, and from people.

Label floor

How many labels a filter needs before Sift trains it: 400 by default, or the recipe’s own minimum if that is higher. The first training also waits until the holdout holds at least 20 actionable events.

Leak-through

A small random share of the events a filter would filter (3% by default, between 1% and 5%, never zero) that Sift sends anyway. The agent cannot tell them apart from any other event; their verdicts are how Sift measures what filtering misses. It draws from the events both Collapse repeats and Decide filter.

Live recall

Of the events the agent would call actionable, the share the filter sends it, measured continuously from the escalations and the leak-through sample. Its complement is the miss rate.

M

Miss rate

The share of actionable events a filter filters: one minus live recall.

N

Not seen by the agent

An event the filter decided to send that the agent never received: sampled shadow did not draw it, or an agent budget had no room for it. It is never counted as filtered.

O

Operating point

How a filter decides and what guards it: the threshold (or hourly budget, or fixed rule), the leak-through rate, the trigger ceiling, and what to do on an alarm.

Omission rate

The share of the leak-through sample the agent called actionable. Shown beside the miss rate for context; Sift does not judge a filter on it.

P

Paired agent

The Kindo agent Sift generates alongside a filter, built to take one event (or one group of events) per run and record a verdict Sift can read. Pairing is confirming which agent a filter sends to.

Pipeline

The four slots every event passes through, in order: Always escalate, Collapse repeats, Decide, Shape delivery. A filter uses the slots it needs.

Posture

The cost policy that picks a point on the frontier: how many extra agent runs you will pay to catch one more actionable event. The console offers Maximise savings, Balanced, Catch everything and Custom.

Proposed

The lifecycle state of a filter whose trained model has a threshold waiting for approval. It still sends every event.

Purity

Collapse repeats’ evidence: in groups where the agent judged both the event that escalated and a repeat, whether its verdicts agree about as often as the agent agrees with itself.

R

Recipe

One of Sift’s fixed, auditable techniques a stage can use. Sift never writes code. See Recipes.

Rescue

An event that Always escalate’s plain-language rules sent on after Collapse repeats or Decide filtered it.

Re-send

An event sent again because the answer to an earlier send was lost. Kindo does not de-duplicate runs, so Sift tells the agent it may have seen the event before.

Resume

Put a stopped or fallen-back filter back on its running model, with a written reason. It acknowledges the drift signals that were breached for up to seven days; the trigger ceiling is never acknowledged.

Retire

End a filter for good. It stops; nothing is deleted.

Reviewer

The role for people who label gold sets and answer the verdict check, and can read everything else about filters.

S

Safer point

The second, looser threshold a filter whose On alarm is Filter at a safer point (loosen) moves to on a drift alarm, approved with its threshold (operating_point.safer_threshold). See The safer point.

Sampled shadow

A filter in shadow or proposed that sends the agent a weighted sample of the stream instead of every event (operating_point.shadow_sample). Its recall is measured with an interval. See Sampled shadow.

Separability

How well a candidate recipe tells an agent’s actionable runs from the rest, measured by the analyzer on the agent’s newest runs.

Setup

The steps from a new filter to one that filters, listed on the Actions tab, each with its status and who does it.

Sift’s model

The model chosen on the Kindo connection. Sift’s own requests run on it, through Kindo: the assistant, agent analysis, and gold-set proposals. It is not the model your agents run on.

Shadow

The lifecycle state in which a filter scores every event and records what it would filter, but sends everything. A new filter enters shadow when an operator starts it, after its gold set is approved; every retrained model also runs in shadow first.

Shape delivery

The fourth slot (deliver). Groups escalations into fewer agent runs; its recipe is Group escalations (digest). It never filters.

Slot

A position in the pipeline. A stage is the recipe a filter puts in a slot, running either measured only (shadow) or for real (active).

Source

Where a filter reads events: one tool of a Kindo integration, called on a schedule.

Stop filtering

Move an active filter back to shadow by hand. It keeps scoring and sends everything, and its threshold approval stands, so Resume puts it back on the same model.

T

Threshold

The score at or above which Decide sends an event. A new filter’s is 0, which sends everything.

Threshold approval

A person’s signed-off decision, with a written reason, that a filter may filter at a measured operating point. The second of a filter’s two approvals, and the only way it starts filtering.

Trigger ceiling

The most escalations an active filter may send in an hour (200 by default). A filter that reaches it falls back to shadow (or raises a fault, under Keep filtering). The console calls the setting Max escalations per hour; a group run counts once for each event it carries.

V

Verdict

The agent’s answer for an event: actionable, benign, or insufficient data. A run that failed or gave no verdict is never counted as benign.

Verdict check

A queue of agent verdicts the decision model disputes, for a person to settle. The answer becomes a label.

Verdict route

How Sift read a verdict: Written (recorded in the run’s metadata), Stated (a structured line in the agent’s answer), or Guessed (inferred from prose, only for agents Sift did not write).

Waiting version

A saved change to an active filter’s stages that needs a new approval. It waits behind the running version, which keeps filtering, until someone approves it; the console marks it Waits for approval. (A pending version in the API.)

W

Warm start

The paired agent judging a capped sample of a filter’s history before shadow, so a first model can be trained before shadow sends it every event. Offered on Actions beside Start in shadow. Its labels are backtest labels. See Warm start.