Backstory

Backstory is Stairwell's agentic investigator. You give it one starting point, a file hash, a hostname, or an IP address, and it works the case for you, returning a report on the full scope and impact.

It behaves the way three specialists would if they sat down together on your incident: a tier 3 SOC analyst who knows what to pivot on next, an expert forensic analyst who can say what a file is really doing, and a world class threat intelligence analyst who recognizes which campaign this belongs to. The difference is that it does all three at once, and it finishes in minutes.

What does Backstory actually do?

Backstory runs the investigation an experienced analyst would run, in roughly the order they would run it, using the platform underneath it.

It starts from what you gave it and establishes what the object is and whether it deserves attention. It uses Variant Discovery to find the files that resemble it across the entire corpus, both your own private files and the global malware corpus, so the investigation is never limited to the exact file you happened to start with. It applies Run-to-Ground to find what else landed on the same assets around the same time, which is how files that evaded detection come to the surface. It pulls in sightings, prevalence, resolution history for any domains and IP addresses involved, and published threat intelligence as the picture develops. At each step it decides what to chase next based on what it has already found, which is the part that would otherwise be your afternoon.

Why does Backstory reach further than the same investigation done by hand?

Because it compares across two corpora, and it can travel between them. Your own private files tell it what is in your environment. The global malware corpus tells it what bad looks like, and carries the relationships that let a local file be recognized as part of something larger.

That is not merely a bigger haystack. It is a bridge between two of your own files:

1. A malicious file A sits in your environment.
2. A resembles a file in the global malware corpus.
3. That outside file has its own relatives there.
4. One of those leads back to a distant file B, on a different machine inside your own environment.

Compare A and B directly and they do not resemble each other closely enough to connect. Searching only your own files would never have linked them. An analyst working by hand would have had to guess that B was worth a second look, and would have had no reason to.

What is in a Backstory report?

A report, not a dashboard. The distinction matters because a dashboard leaves the synthesis to you, and synthesis is the expensive part.

A Backstory report tells you what happened, how far it reached, and which indicators are worth acting on. Indicators carry a disposition rather than arriving as an undifferentiated list, so you can tell what Backstory concluded about each one and why. Findings cite the evidence underneath them, so you can check the work rather than taking it on faith. The report is shareable, which means it also serves as the write-up you would otherwise have spent the rest of the day producing. See The Backstory Report for how to read one.

When should I use Backstory instead of investigating by hand?

Reach for Backstory when you have a starting point and not enough time.

• An alert fired and you have one hash. Backstory establishes whether it matters, what else is related to it, and where it spread, before you have finished reading the alert.
• A vendor published indicators this morning. Point Backstory at them and find out whether anything related has been in your environment, including files nobody flagged at the time.
• You need to brief someone by the end of the day. The report is the briefing.
• The investigation has more threads than you have hours. Backstory follows all of them and tells you which ones led somewhere.

Investigate by hand when you already know exactly which single question you need answered. Backstory is for the case where the next question depends on the last answer, several times over.

How does Backstory relate to the rest of Stairwell?

Backstory is built on the platform you already use, not beside it. Variant Discovery and Run-to-Ground are its two main instruments, and it reads the same sightings, prevalence, verdicts, and threat intelligence you see in the UI.

That has a practical consequence worth knowing: everything Backstory concludes, you can go and verify yourself using the same tools, on the same data. It is not a separate opinion arriving from somewhere else. It is the investigation you would have run, run faster.

What does Backstory not do?

• It is not a replacement for an analyst. It does the legwork and the correlation. Deciding what to do about a confirmed intrusion is still your call, and it should be.
• It is not a detection engine. Detection is YARA rules, verdicts, and triggers. Backstory starts after something has drawn your attention.
• It is not inline. Stairwell does not sit in the network path and Backstory does not block anything. It tells you what happened and how far it went.

What should I read next?

• Starting an Investigation, for the seed, the environment, and the choice between running live and running in the background.
• Reading the Investigation Graph, for what the graph is showing you while the investigation runs.
• The Backstory Report, for the report's sections, how a disposition is expressed, and how findings are supported.
• Campaign Awareness, for what happens when one investigation turns up two unrelated things.
• Pausing, Resuming, and Cancelling, for controlling a run in flight.
• Sharing a Backstory Report, for the shareable link, the downloadable report, and getting findings into another tool.
• The Backstory API, for driving investigations from your own code.