Environments

An environment is an isolated container for one set of data in Stairwell: the files collected from a group of machines, the assets that reported them, the rules that run against those files, and your team's own verdicts on them. Every answer Stairwell gives you is scoped to the environments you have permission to read. Environments are owned by an organization, which is your tenant, and one organization can hold as many environments as it needs.

Why is Stairwell organized into environments?

Because "what is this file" and "who is allowed to know that you saw it" are different questions, and Stairwell keeps them in different places. A file in Stairwell is identified by its content, so the same bytes seen at two different companies are one file with one accumulated body of analysis. That is what makes the platform's memory worth having: work done on a file once is available to everyone who meets that file again. It would also be unacceptable if that sharing meant your filenames, your paths, your machine names, and your timelines were visible to anyone else.

The environment is where that line is drawn. Analysis of a file is global. The record of where and when you saw it is not. It belongs to an environment, and it is visible only to people with permission on that environment.

That boundary is why the product is shaped the way it is, and once it exists it turns out to be the natural unit for nearly everything a team wants to control: which machines report in, what those machines collect and skip, which rule feeds and threat reports are subscribed, which alerts fire and which are silenced, and whose verdict on a file counts. All of those are set per environment rather than per account.

Two things follow that are usually mutually exclusive. A service provider can keep every customer in its own environment, with no commingling, and still check the whole book with one pivot the moment one customer is hit. A large enterprise can wall off a subsidiary, a regulated business unit, or a research lab, and an analyst with permission across all of them can still ask one question and get one answer.

What do I do with an environment?

• Decide the boundary before you deploy. One environment for the whole fleet is a reasonable answer for a single security team. One per customer, per subsidiary, or per regulated business unit is the answer when the data must not mix, or when different people should see different slices of it.
• Scope a search. The Search screen separates My Objects, which searches the environments selected in your organization, from Global Objects, which widens the same query to everything Stairwell has seen. The first tells you whether you are affected. The second tells you what the file is.
• Set collection policy. Asset groups, asset policies, asset registration, asset exclusions, and intake filters are all defined per environment, so a noisy build server and a set of executive laptops can be treated differently.
• Record verdicts that count for your team. An opinion your analysts set in your environment outranks Stairwell's public default for everyone reading that environment. See Verdicts.
• Govern third-party AI analysis. AI Triage can be turned off for one environment while it stays on elsewhere, and that decision is enforced no matter who reaches the file, including Stairwell staff.- Recognize the environments you did not create. Alongside your own, your organization has read access to shared environments Stairwell maintains: rule feeds, malware feeds, and threat intelligence. They are how curated content reaches you, and they are why a search can return a file your fleet has never held.
• Know the two limits worth knowing. An environment has an asset cap, which is the maximum number of assets that can register to it, and a default asset that receives files uploaded through the API when the upload does not name one.

Where do I see environments in Stairwell?

Settings, then Organization, then Managed environments is the list: each environment with its identifier, its parent organization, your permission level on it, and its creation time.

Settings, then Environments is where per-environment policy lives: Asset policies, Asset groups, Asset registration, Asset exclusions, and Intake filters.

You also see the environment named on individual records. The Sightings tab of any object has an Environment column, so a file seen in three of your environments shows you which three. When you save a YARA rule or upload a file by hand, Stairwell asks you to select the environment it belongs to.

What should I read next?

• Assets, because an environment is populated by the machines that report into it.
• Objects, for what Stairwell considers a file to be, and why the analysis of one can be shared when your sightings are not.
• What Is Stairwell, if you have not yet read the one-page description of what the platform does.