Get Started

Goal: In about an hour, go from an empty account to your first real data incident—identified, investigated, and resolved.

You need: A Sifflet account with the Admin role, a data warehouse or data platform (Snowflake, BigQuery, Fivetran, etc.), and optionally, a BI tool (Looker, Tableau, or Power BI).

What You'll Learn

1. Connect a data source
2. Create teams and assign owners to assets
3. Create domains
4. Create monitors on your tables
5. Set up collaboration tools and notifications (email, Slack, or Teams)
6. Handle incidents

Example used on this page: a company's Operations team needs to trust its delivery data. Its tables live in Snowflake (PROD_DB.OPERATIONS.SHIPMENTS and PROD_DB.OPERATIONS.INVENTORY), and it uses a Looker dashboard called Daily Deliveries.

1. Connect a Data Source

1. Create a service account for Sifflet in your warehouse (supported technologies).

2. Add the credentials in Sifflet.

3. Add the source: pick the credential, then choose the databases and schemas to include.

4. Let the catalog sync.

   

2. Create Teams and Assign Owners (Optional)

Why: teams make it clear who is responsible for each piece of data. When something breaks, the incident goes straight to the right people.

1. Add users. Settings → Users → Add user. Invite everyone who will use Sifflet.
2. Create one team per area. Settings → Teams → Create Team. Give it a name and add members.
3. Turn on Teams as a custom metadata field. Without this, you can't pick a team as an owner.
4. Set a team as owner. On each asset or monitor, choose its owning team.

Example

• Team: Operations, members: Marie (Ops data lead) and Karim (data engineer)
• Team: Data Platform, the central data team
• Owner of SHIPMENTS, INVENTORY and Daily Deliveries: Operations

3. Create Domains (Optional)

Why: a domain groups the assets that belong to one business area. Each team then sees only its own data, and incidents and alerts stay focused on that area. Domains also protect sensitive data, like Finance or HR.

1. Create the domain. Settings → Access and Permissions → Domains → + New domain. Give it a name. Only an Admin can do this.
2. Add assets
3. Give teams access with a role: Viewer (can see) or Editor (can change monitors and incidents).

Example

• Domain: Operations, filled dynamically with every asset tagged operations
  • Subdomain Logistics: SHIPMENTS and the Daily Deliveries dashboard
  • Subdomain Inventory: INVENTORY
• Access: Operations team as Editor, Data Platform as Viewer

✅ Someone from Finance, who isn't in the domain, can't see the Operations tables.

4. Create Monitors

Why: monitors check your data automatically, like whether it arrived on time, whether values are missing or whether a column changed. When one fails, Sifflet opens an incident and alerts the owning team, so you catch issues before they reach dashboards and users.

1. Open the monitor builder. Monitors → New monitor, or from a table's page. You can also use Sentinel, which suggests monitors for you.
2. Choose the table, and the column if needed.
3. Pick a monitor type
4. Set severity and schedule. Severity is Critical, High, Moderate or Low; the schedule is how often the monitor runs.
5. Set owner and tags. The owner is the team you created in section 2. Notification rules (section 5) then send the alerts to the right channel.
6. Save. Dynamic monitors need a few days of history to learn what's normal.

Example: monitors on SHIPMENTS

Monitor	Setting	Severity
Freshness	on UPDATED_AT, expected every hour	Critical
Volume (dynamic)	daily row count	High
Nulls	WAREHOUSE_ID	High

5. Set Up Collaboration Tools and Notifications

Why: Sifflet sends alerts and incidents to the tools your team already uses (Slack, Teams, email, Jira), so nobody has to keep checking Sifflet. Notification rules make sure each alert reaches the right team.

1. Open the settings. Settings → Collaboration Tools.
2. Connect your tool: Slack, Microsoft Teams, email, etc.
3. Create notification rules: choose which alerts (domain, severity, monitor type) and where they go (a channel or email).
4. Test it. Send a test alert.

Example

• Connect Slack, then create the channel #ops-data-alerts
• All Operations monitors send to #ops-data-alerts
• Critical monitors also email [email protected]

✅ The Operations team receives a test alert in Slack.

6. Handle Incidents

Why: an incident brings together everything about one data problem: the failing monitors, the affected tables and dashboards, and who's working on it. The team fixes it faster, business users know what's impacted, and every fix is recorded for next time.

1. Triage: open the incident and look at the failing monitors and their severity.
2. Assign: click Edit, choose an owner or team, and move the status to In Progress.
3. Investigate and fix: the Lineage tab shows the root cause upstream, and Impacted Dashboards shows who's affected. Fix the issue, then add a comment in the Activity Feed.
4. Resolve: close as Closed — Fixed, Closed — No Action Needed or Closed — False Positive / Expected.