After completing this topic, you can review a Run, investigate an issue, and close it out from start to finish.Documentation Index
Fetch the complete documentation index at: https://docs.siftstack.com/llms.txt
Use this file to discover all available pages before exploring further.
New to Detect and Review? Read the Overview to understand how Rules, Reports, Annotations, and Campaigns work together before proceeding.
When to use this workflow
Use this workflow when you have a completed Run and want to evaluate it against a set of Rules, examine any flagged issues, and mark them as resolved. This is the core daily loop for anyone doing data review in Sift.Before you begin
- You have at least one Run in Sift. If you need to import or stream telemetry first, see Import or Stream.
- At least one Rule exists in your workspace. If no Rules have been created yet, see Write a Rule to detect issues automatically.
Complete the workflow
Step 1: Generate a Report
- In Sift, click the Runs tab.
- In the Runs table, click the Run you want to review.
- Click Create report.
- Click the Rules tab.
- In the Rules table, select the Rules you want to evaluate.
- Click Evaluate.
If your team has already set up a Report Template for this type of Run, use the Report Template tab in step 5 to select it. This applies a predefined set of Rules in one click. See Set up a repeatable review checklist.
Step 2: Read the Rule summary panel
The Report opens with a list of Rules that were evaluated and violated. This means each Rule generated at least one Annotation. Rules that passed without generating any Annotations are not shown by default. Each Rule in the list shows its current state:- Open: no Annotations have been reviewed yet. This is the default.
- Failed: one or more Annotations were marked Failed.
- Accepted: all Annotations were marked Accepted.
Step 3: Open an Annotation
- In the Rules section, click the Rule you want to investigate.
- Click the Annotation listed under that Rule.
Step 4: Update the Annotation state
In the Annotation details panel, use the status control to change the state from Open to either Failed or Accepted:- Mark Failed if the telemetry represents a real problem that must be addressed.
- Mark Accepted if the finding was reviewed and determined to be valid or not requiring action.
Step 5: Leave a comment
In the Enter a comment box at the bottom of the details panel, type your notes and click Post. Comments support rich text and appear alongside state changes in the activity log, giving the full context of the review decision.Step 6: Assign the Annotation (optional)
If the issue needs follow-up from a specific team member, use Assigned to to assign it. Assignment changes are logged alongside comments and state updates.Verify the result
After reviewing all Annotations in the Report:- Every Rule in the Report should show a state of Failed or Accepted. None should remain Open if the review is complete.
- Each Annotation you investigated should have a state, a comment explaining the decision, and an assignee if follow-up is needed.
Next steps
- To set up Rules that detect issues automatically in future Runs, see Write a Rule to detect issues automatically.
- To create a template so you do not need to pick Rules manually next time, see Set up a repeatable review checklist.
- To triage a large set of Annotations across multiple reviewers, see Triage and close out flagged issues.