The Pulse
Kindo Ships Deep Hat Sift to Filter Enterprise Alerts
Kindo has released Deep Hat Sift, a model that filters enterprise alerts, tickets and logs before they reach a large language model. The company says Sift learns from an agent’s decisions, runs inside the customer’s environment and begins f
AI.info Team · Written with AI · fact-checked ·
Kindo says a large enterprise can run hundreds of thousands of Deep Hat Sift models at once, assigning each model to a data source, an agent and a filtering task. The company announced the product on October 28, 2026, describing it as a way to screen alerts, tickets and logs before sending them to a large language model (LLM). Sift is available now, according to Kindo.
Sift learns from the agent it serves
Kindo positions Sift as a fast decision model, not a text-generating chatbot. It makes a yes-or-no assessment about whether an event should go to an LLM, with the aim of avoiding calls on events the agent would dismiss. Rather than relying on a fixed filter, Sift learns from the verdicts of the agent it serves, the company says.
The deployment process is designed to put a human approval step before any event is withheld. Sift first runs in “shadow mode,” scoring events while continuing to send all of them to the agent. Teams can review a preview of what Sift would filter and approve a threshold with a written reason; after filtering begins, a random sample of withheld events still goes to the agent so the miss rate can be measured.
Filtering comes before the expensive model call
The product targets streams where reviewing every event can add up: SIEM and endpoint detection alerts, ticket queues, system and network logs, monitoring tools such as New Relic, Splunk and Datadog, and streaming systems such as Kafka. Kindo names alert storms, log streams, reported-phishing triage and ticket triage as early use cases. It also describes review of event streams for policy anomalies and fraud indicators in finance and compliance work.
The company says Sift runs entirely inside a customer’s environment, including air-gapped deployments. It can run on premises, in a customer-managed cloud or in Kindo’s cloud; Kindo says scoring happens where the customer installs its platform and Sift holds no model-provider or data keys. That setup is intended to keep the event-scoring step within the organization’s chosen environment, even when the downstream agent uses an LLM.
The release leaves savings unquantified
Kindo CEO Ron Williams described the product as an alternative to sending every event to a large model or using a fixed filter that teams may not trust. “Deep Hat Sift gives IT, Security, Finance, and Compliance teams a new world of choice to put intelligent agents to work where cost once made it impossible,” Williams said.
Deep Hat Sift engineer Troy Presley said the approval gate and fallback behavior are meant to address the risk of filtering out useful events: “It filters nothing until a person approves the threshold, and if quality drifts it fails open and sends everything through for LLM judgment.” The announcement does not provide a measured cost reduction, benchmark results or miss-rate figures. Those numbers will matter to teams weighing potential savings against the consequences of a missed alert.