Assets

An asset is a source of files in Stairwell, usually one machine: a laptop, a server, a virtual machine, or a cloud workload running the Stairwell forwarder. The asset record carries the machine's name, an identifier, its operating system and version, its forwarder version and status, when it last checked in, and how far it has got through collecting the files that were already on disk when it was installed. An asset always belongs to exactly one environment. Files pushed through the API rather than by a forwarder are attributed to an asset too, which is how a feed or a bulk upload gets a place to live.

Why does Stairwell track assets separately from files?

Because a file on its own is trivia, and a file on a named machine at a known time is an incident. The asset is the half of that sentence your incident responders and your executives care about: which machines, how many, whose, and starting when.

Keeping the machine as its own first-class record buys two things the tools next to Stairwell usually cannot offer.

The first is that the record outlives the machine. Endpoint tools answer questions about hosts they can currently see, for as long as their telemetry window stays open. In Stairwell, a laptop that was wiped and reissued eight months ago is still an asset, and the files it reported are still attached to it. When a report published this morning names a hash from last spring, "which machines had it" is answerable even for machines that no longer exist.

The second is that the asset is where coverage becomes visible. Deployment quality is not a feeling, it is a list: which assets have checked in recently, which are running an old forwarder, which have finished collecting their existing files and which are still working through them. A gap in that list is a gap in everything else Stairwell can tell you, because the platform can only reason about files it was given. Assets are the screen where you find out.

What do I do with an asset?

• Check coverage. Sort the asset list by last check-in to find machines that have gone quiet, and by forwarder version to find machines that need an upgrade. The backscan columns tell you which assets have finished collecting the files that predate the install.
• Group machines and apply policy. Asset groups and asset policies let you treat a class of machines as one thing, so exclusions and collection settings are set once rather than per host.
• Tune what a machine sends. Path and filename exclusions keep content you do not want collected out of Stairwell in the first place. This is the control that answers "we cannot ship the contents of that directory," and it is yours to set.
• Pivot from a machine to what is unusual on it. Opening an asset gives you its interesting files, meaning the ones with a malicious verdict, and its rare files, meaning the ones almost nothing else in your fleet has. Those two lists are where a compromised host usually gives itself away.
• Pivot from a file to its machines. Any file's sightings name the assets that reported it, with the path and the dates. See Sightings.
• Retire what is gone. Assets that have been uninstalled or decommissioned can be archived so they stop counting against your active fleet without deleting the history they contributed.

Where do I see assets in Stairwell?

Assets in the left navigation is the fleet list. Its columns include Name, Identifier, Forwarder status, OS, OS version, Forwarder version, IP address, MAC address, Registration time, Last seen, Last sighting, and Backscan status with its start and end times. You can filter the list and add or remove columns.

Selecting an asset opens its panel: the details table on the left, and on the right two lists built from that machine's own history, Interesting objects and Rare objects.

Assets also appear as a column on the Sightings tab of every object, and in the emails and webhooks a trigger sends, which name the machines a detection fired on.

What should I read next?

• Environments, because every asset belongs to one, and the environment decides who can see what that asset reported.
• Sightings, for the record that joins an asset to a file at a moment in time.
• Forwarder Deployment, when you are ready to turn a machine into an asset.