Download Center
Every Stairwell download in one place: the file forwarder for Windows, macOS and Linux, the swell command line tool, and the browser extension.
Stairwell ships three things you install. The file forwarder collects executables and scripts from your fleet on its own, once, and keeps doing it. swell is the command line tool, and it does from a terminal or a script most of what you would otherwise do in the app. The browser extension turns file hashes on any web page into links into Stairwell. Everything downloadable is listed here or one click away.
Which download do I need?
Start from what you are trying to cover, not from the product names.
| What you want to do | What to download | Where |
|---|---|---|
| Collect files from laptops, desktops, and servers, continuously, without anyone running anything | The file forwarder for that operating system | Forwarder Downloads |
| Send files in from a machine no forwarder covers: a network or security appliance, a build server, an air-gapped host you reach over SSH | swell | swell Downloads |
| Keep YARA rules in version control and have a pipeline push them | swell | swell Downloads |
| Run the query you would type into the search box from a script, and get a table or JSON back | swell | swell Downloads |
| Prove a network and a host are ready before a forwarder rollout | swell | swell Downloads |
| Look up a hash you are reading on a web page without retyping it | The browser extension | Browser Extension |
The forwarder and swell are not alternatives to each other. The forwarder is how a managed fleet gets covered, and swell is how everything else does: the appliances that will not take an agent, the pipelines, the one-off uploads, and the checks you run before a rollout. Most teams end up with both.
The extension is a convenience for the analyst's browser. Installing it changes nothing about what Stairwell collects and it needs no configuration.
Stairwell File Forwarder
The agent that runs on your endpoints, collects the executables and scripts it is configured to collect, and uploads them to your environment. It is how most of the data in Stairwell arrives.
| Operating system | Current version | Packages |
|---|---|---|
| Windows desktop and server | 1.7.9 | Bundled installer, standalone installer, MSI |
| macOS, Intel and Apple silicon | 1.7.4 | Signed package, plus configuration profiles |
| Linux, RHEL family and Debian family | 2.5.1 | RPM per major release, and a Debian package |
Download links, release notes, compatibility tables, and the configuration profiles are on Forwarder Downloads. Older supported versions have their own pages in this section.
Before you install the first one, run the two checks on Pre-Deployment Check. They take a few minutes on one machine and they catch the failure that otherwise shows up after the agent is on a thousand.
swell
A single self-contained binary. No runtime to install, nothing to compile, and no dependency to satisfy, which is what makes it usable on a stripped-down host you would never put an agent on.
| Platform | Shape |
|---|---|
| Linux | 64-bit binary |
| macOS | Signed installer package, Intel and Apple silicon in one build |
| Windows | Signed 64-bit executable |
Links are on swell Downloads. Read that page rather than saving a link: swell downloads are pinned to a release date, so the URL changes every time a new version ships.
For what the tool does and the first commands to run, start at swell.
Browser Extension
Highlights MD5, SHA-1, and SHA-256 hashes on any page you visit and lets you open the matching object in Stairwell from the context menu. It works in Chrome, Edge, and other Chromium browsers.
Install it from the Chrome Web Store: Stairwell Extension. Browser Extension covers Edge, the other Chromium browsers, and what the extension does and does not do.
Do I need anything else to use these?
An auth token, for swell and for anything you script. You generate it in the Stairwell app under Settings, then Auth tokens under the Organization section. swell auth login walks you through it from the terminal.
Nothing else is a prerequisite. The forwarder does not need swell installed, swell does not need a forwarder, and the extension needs neither.
What should I read next?
- Pre-Deployment Check, the two commands to run before any forwarder install.
- swell, for what the command line tool is for and the first commands to run.
- Assets, for what a machine looks like in Stairwell once its forwarder is reporting.
- What Is Stairwell, if you inherited this rollout and want to know what the files you are about to collect are for.
Updated 4 days ago