Getting started
Getting Sift from a fresh install to a filter that filters events takes five steps, done by three kinds of people. This page lists them, who does each, and how long the waiting parts take. The pages after it walk through each step.
The checklist on the dashboard
Section titled “The checklist on the dashboard”Until Sift is set up, the console’s dashboard is a checklist headed Get Sift running. It shows the same five steps as this page, marks each one done as it happens, and puts the button for the current step beside it.
| # | Step on the dashboard | Who | Button | Guide |
|---|---|---|---|---|
| 1 | Connect to Kindo | admin | Connect Kindo | Connect Kindo |
| 2 | Choose Sift’s model | admin | Choose a model | Connect Kindo |
| 3 | Create your first filter | operator | New filter | Your first filter |
| 4 | Sift learns in shadow | Sift | Shadow and filtering | |
| 5 | Approve a threshold and start filtering | operator | Approve a threshold |
If the current step is not yours to take, the dashboard says who takes it instead of showing the button, for example “An admin connects Kindo.” Beside the checklist, a System panel lists deployment warnings, such as the default administrator password still being in use.
The checklist stays until the first three steps are done. After that, the dashboard shows its usual panels, and Road to production tracks each filter on its way to filtering.
Before you start: install
Section titled “Before you start: install”Someone with shell access to the host installs Sift and changes the default password. That is Install Sift. It is not on the checklist, because the checklist is inside the console.
Who does what
Section titled “Who does what”Sift has three roles. The admin account the install creates can do everything; add accounts for other people under the gear icon (Administration) › Users.
| Role | Does in getting started |
|---|---|
| admin | Connects Kindo, chooses Sift’s model, adds accounts. Can also do everything an operator can. |
| operator | Creates the filter, connects its agent, approves the gold set, starts it in shadow, approves the threshold. |
| reviewer | Judges gold-set examples. Cannot approve the gold set or a threshold, or start shadow. |
The console shows the approval forms to a reviewer, but Sift refuses a reviewer’s approval: approving the gold set and the threshold needs an operator or admin.
How long it takes
Section titled “How long it takes”| Step | Time |
|---|---|
| Install | Minutes, plus a one-time download of about 134 MB on first start. |
| Connect Kindo and choose a model | A few minutes. |
| Create the filter and connect its agent | Minutes. Sift reads samples of the source while you talk to its assistant. |
| Review the gold set and start shadow | About fifty events to judge, in one sitting. Sift builds the set in a few minutes after the filter is created. |
| Learn in shadow | Days, usually. Depends on how many events the source produces. |
| Approve the threshold | As long as it takes to read the evidence. |
Shadow is the wait. Sift trains a filter only when two things are true:
- it has reached its label floor: 400 labels by default (a label is one event with the agent’s verdict), or more if the filter’s recipe needs more; and
- the newest of those labels, which Sift keeps aside to measure the model, hold at least 20 actionable events.
In shadow every event goes to the agent, so each verdict adds a label: a busy source reaches 400 quickly. The second count is usually the slower one, because it waits on events the agent finds actionable. A quiet source, or one where actionable events are rare, takes longer. The filter’s Actions tab shows progress toward both counts, with an estimate when Sift can make one. Every event still reaches the agent during this time, unless you chose sampled shadow, which sends a share of them, so the labels come more slowly.