Deep Hat family · Self-hosted model
Deep Hat Sift: AI event triage that decides which events deserve an agent
A self-improving AI model for your alert, ticket, and log streams. It learns from your agent’s own verdicts and withholds what the agent would dismiss. Nothing withheld until a person approves. Every withheld event on record.
SELF-HOSTED
WORKS WITH KINDO AGENTS
AIR-GAPPED SUPPORTED
INCLUDED WITH THE PLATFORM
.png)
What is Deep Hat Sift?
Deep Hat Sift is a self-improving AI model that decides which events in a high-volume stream deserve an AI agent’s attention. It scores each event, learns from the agent’s own verdicts which events the agent dismisses, and, once a person approves a threshold, stops starting runs for those events.
What it is
A model
Learns the specific agent’s judgment on your events. Improves in production.
Family
Deep Hat
Beside Deep Hat, Kindo’s cybersecurity model. Deep Hat analyzes; Sift decides what is worth analyzing.
Delivery
Self-hosted service
Runs on your infrastructure, works with Kindo agents. Air-gapped supported.
Platform
Kindo
The AI agent management platform. Sift is included; no separate pricing.
Not
Detection
Reads from your SIEM, EDR, ticketing, logs. Replaces none. No employee monitoring.
Why does AI event triage matter?
Agents on busy sources break the economics. An agent that triages alerts, tickets, or log lines runs once per event; on high-volume sources most runs conclude nothing was needed, and every run still costs. So teams keep agents off their busiest sources, which is where the work is.
150,000
AI agents at the average global Fortune 500 company by 2028, up from fewer than 15 in 2025, Gartner projects. Gartner’s definition of an AI agent management platform includes a unified view of agent cost and ROI (agentic FinOps).
.avif)
Sift adds run avoidance: not running the agent at all when the event does not warrant it. A fourth cost lever beside any model, a model per agent step, and open-weight models, and the only one that applies before an agent spends anything.
Source: Gartner, Market Overview: AI Agent Management Platforms, July 2026. Projections are Gartner’s.
What problems does Sift solve?
Sift is built for AI alert triage and every other place an agent meets a stream that never stops. One mechanism answers each problem. Detection, ticketing, and logging stay with the tools you run.
Problem
Alert storms
One source floods. The agent becomes the bottleneck; the bill becomes a surprise.
Sift → Withholds what the agent would dismiss. A trigger ceiling returns it to shadow mode on a spike.
Your SIEM and EDR keep detecting.
Problem
Triage at volume
Most SIEM, EDR, and queue events end as “nothing to do.” Each one costs a run.
Sift → Run avoidance, learned from the agent’s own verdicts.
Your queues and tickets stay where they are.
Problem
Logs too large to afford
Sources you never put an agent on because the volume made it uneconomic.
Sift→ Starts in shadow mode, nothing withheld, so the first agent goes on the busiest source on day one.
Your log platform is the source.
Problem
Reported phishing
Reports arrive constantly. Most are benign. The agent reads all of them.
Sift → Learns which reports the agent dismisses; withholds those, with a measured sample still sent.
Your mail security stays in place.
Compliance and Finance: the same model on policy and transaction streams, for policy anomalies and fraud indicators. Sift decides what an agent examines; it does not detect fraud or threats as a product.
How does Sift decide what to withhold?
Shadow first. A person approves. Then it withholds. A filter names one source on an existing Kindo integration, one target agent, and the withholding logic. Nothing is withheld before step four.
.avif)
Training signal
The agent’s own verdicts
No labeling project
No vendor model to wait for
Each agent gets a filter tuned to it: a SOC agent and a ticket-queue agent learn separately
What Sift measures
Recall and miss rate
Measured against the agent’s verdicts, on live events
The leak-through sample makes the miss rate a measurement, not an assumption
No accuracy figure. No savings claim. Withholding is previewed on your own events first.
Connects via
One Kindo API key. Reads sources through your tenant’s existing integrations; starts agent runs through Kindo.
Model calls
Through Kindo, on a model your admin chooses. Sift holds no model-provider keys.
Scoring
Local, on CPU. Optional decision model off by default.
Pipeline
Always escalate → Collapse repeats → Decide → Shape delivery
Code
Never writes or runs generated code. No write tool.
Fails
Open. Drift or a breached hourly ceiling sends everything to the agent again.
What will you gain with Sift?
Agents on the sources you had kept them off, with the controls a security or operations team needs to accept that.
Cost
Fewer agent runs on noisy sources
Runs go to events that warrant a verdict.
Confidence
A measured miss rate
Recall and miss rate against the agent’s verdicts, continuously.
Record
Every withheld event logged
Suppression log and approval log, with actor and reason, shared by IT, Security, Finance, Compliance.
Safety
Fail-open behavior
Drift or a trigger spike sends more to the agent, never less.
Day one
Shadow mode on your busiest source
Agent sees everything. Sift scores and learns. Nothing withheld.
Week four · illustrative
Operating point approved
A person reviews the preview, sets the threshold with a reason. Withholding begins.
Month six
Improving in production
More verdicts, better withholding, same agent covering more volume. Miss rate still measured.
Timing depends on source volume. Shadow mode trains on a label floor of 400 verdicts by default.
Why choose Kindo for AI alert and event triage?
Other approaches apply fixed rules or score events without learning from the agent they serve. Sift learns a specific agent’s judgment on your own events, keeps improving in production, and leaves a person in charge of the threshold. Comparison by category; keep the tools you have.
Approach
How it decides
What it learns
What it records
SIEM / observability dedup
Fixed rules collapse repeats
Nothing; rules maintained by hand
Grouped events
Simple event-scoring model
Static score per event
Not the agent’s judgment
A score
Cheaper model per event
Still one run per event
Nothing about what to skip
A run for every event
AI gateway / control plane
Acts after the agent calls a model
Traffic, not triage
Call-level records
Deep Hat Sift
Learns what the agent dismisses; withholds only after a person approves
The agent’s verdicts, continuously, with a measured miss rate
Every withheld event; every approval with actor and reason
The second difference is where Sift’s decisions land: in the same record as everything else Kindo knows about the agent.
From Sift
A withheld event
with the operating point, the approver, and the written reason
One record in Kindo
Read by
One history, not a filter’s log in a separate tool
Kindo cloud · your cloud · on premises · air-gapped
1 in 3
That record is what makes SIFT a governance layer, not only a cost one. Gartner’s guardian-agent research lists automated filtering by rules and small models among the layers of human governance for autonomous AI, with proof of oversight through audit trails, and observes that a task needing ten agent calls at a 10% error rate each completes about a third of the time.
Kindo’s view: SIFT is that layer in product form. Every event an agent does not need to run on is a chain of calls that cannot go wrong.
Source: Gartner, Use Guardian Agents to Govern Autonomous AI Systems, 14 September 2026.
How do you get Started with Sift?
Resources
Go deeper on Deep Hat Sift
Featured · Guide
A Guide to AI-Native SOC Workflows (Q1 2026)
Five AI-native SOC workflows that automate correlation, triage, and response.
View resource →
Docs
Deep Hat Sift documentation
Filters, gold sets, shadow mode, operating points, leak-through.
Use case
SOC Automation
Agents triage alerts, investigate, and respond on top of your SIEM and EDR. Analysts approve containment.
Use case
AI Cost Control
Kindo meters every model call and attributes spend to an agent, owner, and team.
