AI Triage

AI Triage takes one file and hands back the report a senior analyst would have written about it: a one-line summary, a malicious likelihood and a confidence score, a specific threat type, the indicators worth pivoting on, a MITRE ATT&CK mapping tied to what the file actually does, and the prose behind all of it. It answers the question you have when a file is unfamiliar, which is "what is this thing and how worried should I be", and it answers it in the time it takes to read a paragraph.

What do I get back?

Part	What it gives you
TL;DR	One or two sentences naming what the file appears to be
Malicious likelihood	How likely the file is malicious, as a percentage
Confidence	How sure the assessment is. Read this before you act on the likelihood
Threat type	A specific classification, such as a loader, a credential stealer, or a remote access trojan. Vague labels are deliberately not accepted
IOCs	The indicators found in the file: addresses, domains, paths, registry keys, and the like, ready to pivot on
MITRE ATT&CK mapping	Techniques tied to concrete observed behavior rather than a generic list
Details	The reasoning: what is in the file, what it does, and what makes it notable

The pairing of likelihood and confidence is the part people skip and should not. A high likelihood with low confidence is a lead to check, not a conclusion to act on.

Why is this better than reading the strings myself?

Because the assessment is grounded in what Stairwell already knows about the file, not only in the bytes.

An analyst working a file alone can pull strings, look at entropy, read the AV results, and see which rules matched, and then has to synthesize a judgment out of that. AI Triage does the synthesis in one step, and it does it while knowing things the file itself cannot tell you: how common the file is across environments, whether its hashes appear in threat intelligence available to you, and whether files that resemble it are already known to be bad. Each of those is weighed as context, never as a verdict on its own.

The most valuable consequence is what it does not do. Because it knows a file present across a large share of environments is probably legitimate IT tooling, it does not invent backdoor theories about your password manager or your remote support agent. That is the failure mode that makes automated file summaries useless in a real fleet, and it is designed against explicitly.

How do I run it?

Open the file's object panel and select the AI Triage tab.
If an assessment already exists, it is displayed. If not, select Analyze.
Read the likelihood and confidence first, then the TL;DR, then the details if the first two leave you unsure.

Assessments are reused when the facts about a file have not changed, and re-run when they have, so opening the tab on a file somebody triaged last week is instant and free.

Through the API, one request returns the same assessment for a hash, both as the text you see in the app and in structured form:

GET /v1/objects/{SHA256}:summarize

That is the endpoint to reach for when you want to score a batch of files from a hunt and open the full write-up only on the ones that come back interesting.

Does AI Triage change the file's verdict?

It can. A confident assessment feeds into Stairwell's single verdict for the file, which means a file nothing else flagged can be marked malicious on the strength of a triage result and alert your team without anyone opening the write-up. When the verdict came from AI Triage, it carries the label ai-triage-verdict, so you can always tell where it came from.

Your team still outranks it. An opinion you set on the file takes precedence over the automated verdict, AI Triage included. So the platform sharpens the verdict on its own, and your analysts stay the final word. See Setting Opinions.

Reassessments happen as evidence changes: new variant relationships, new rule matches, or a rescan of the file can all produce a revised result. A file that read as unremarkable months ago is not stuck with that reading.

What should I be careful about?

Confidence is part of the answer. Treat a low-confidence result as a starting point, not a conclusion.
It is one file at a time. AI Triage explains a file. It does not scope an incident. For that, go to Run-to-Ground or a Backstory investigation, which use this as one input among several.
Stairwell is not a full sandbox. There is some detonation available, and it is not a complete behavioral profile. Read the assessment as being grounded mostly in static evidence plus Stairwell's own context.
It can be turned off per environment. If your policy prohibits a specific environment's files being analyzed by a third-party model, AI Triage can be denied for that environment while the rest of your organization keeps it. Ask Stairwell support to configure it.

What should I read next?

Verdicts, for how the platform's single answer is formed and what AI Triage contributes to it.
Setting Opinions, for recording a decision that outranks any automated assessment.
The Object Panel, for the rest of the evidence on the same screen.
What Stairwell Knows About a File, for the evidence AI Triage is synthesizing.