How Stairwell Works

Stairwell runs one loop. A forwarder collects executables and scripts from your machines and sends them to your own environment. Stairwell keeps them. It analyzes them, and keeps re-analyzing them as detection improves. Everything it learns becomes searchable, and every result is something you can pivot from. Because the files stay, a question you think of tomorrow can be asked about last year.

That last sentence is the one to hold on to. Everything else on this page follows from it.

What is the core loop?

Four stages, and a file moves through them without anyone starting a job.

1. Collect. A lightweight forwarder on each Windows, macOS, or Linux machine collects the file formats you have chosen and sends them in. You can also send files through the web app or the API. The forwarder checks before it sends: if your environment already has a given file, the machine records that it saw it too rather than shipping the bytes again, which is why full fleet collection costs far less bandwidth than people expect.
2. Retain. The file lands in your environment, which is the boundary your data lives inside. Original bytes are kept, so you can re-analyze, re-detonate, or download the file later. Nothing ages out on a retention clock.
3. Analyze, then analyze again. Stairwell scans the file with your YARA rules and its own, resolves multiple detection engines, machine learning, and analyst opinion into one verdict, calculates how rare it is, extracts the hostnames and IP addresses inside it, and can write you an analyst-grade summary of it. None of that is a one-time pass. It is redone as rules change, as intelligence arrives, and as verdicts sharpen.
4. Search and pivot. Every file, sighting, asset, and indicator is queryable, and each answer is a place to pivot from: from a file to the machines that held it, from a machine to everything else it ran, from a file to the domains inside it, and from a domain to every other file that references it.

Why does it matter that Stairwell keeps the files?

Because detection always arrives late, and keeping the file is what lets late detection still be worth something.

Consider what happens with a rolling telemetry window. A new report names a loader first seen four months ago. Your endpoint data goes back thirty days, so you can answer "is it here now" and nothing else. The four-month-old question, which is the one that actually matters, is unanswerable, and an attacker's dwell time is exactly the interval your tools have forgotten.

With the files retained, you write the rule and get the historical answer in the same motion. A rule authored 30 seconds ago is evaluated against files collected years ago, and it raises notifications through the same path as routine scanning, so a hit on an old file reaches you the way a hit on a new one would. Stairwell calls that retroactive sweep time travel. It is the difference between "we will watch for this" and "here is where it already was, on these machines, on these dates."

The same property applies to verdicts. A file that looked clean when it arrived is re-judged as the world learns more, so you are never stuck with whatever was known on the day it landed.

What does Stairwell compare my files against?

Two corpora, and the pairing is the point.

• Your private files. Everything Stairwell has retained for your organization.
• The global malware corpus. This is what tells you what bad looks like.

Variant Discovery runs across the entire corpus, both your own private files and the global malware corpus. Neither side alone is as useful as both. An organization compared only against itself can learn that two of its files resemble each other. An organization compared across both can learn that a file it never suspected belongs to a family that has been seen elsewhere in the world.

The pairing also connects your own files to each other, because the traversal is recursive. A chain like this is ordinary:

1. A bad file, A, sits inside your environment.
2. A has a variant in the global malware corpus.
3. That global variant has variants of its own there.
4. One of those leads back to a distant variant, B, sitting inside your own environment.

B is now known to be related to A, even though A and B do not resemble each other closely enough to connect directly. The global corpus was the bridge between two of your own files. That is why more context means more awareness of what is bad, both in the world and inside your own environment.

A limit worth stating plainly: Variant Discovery does not run over every file at ingestion. It runs automatically for threat reports and for Backstory investigations, and on demand from the UI and the API when you ask for it on a specific file.

Why does it matter that the analysis happens off the endpoint?

Because an adversary who owns a machine can see and tamper with anything running on it, and Stairwell's analysis is not running on it.

The forwarder's job is narrow: collect files and send them. Everything that decides whether a file matters -- the scanning, the verdicts, the rarity, the variant comparison, the written assessments -- happens in your environment, after the fact. Three consequences follow, and they are architectural rather than features:

• Your detection logic is not on the box. An attacker cannot read your rules off the endpoint to learn what you look for, and cannot disable the analysis by killing a process, because the analysis is not there to kill.
• Analysis is not bounded by the endpoint. There is no CPU budget to respect and no scan window to fit inside, which is why a file can be re-examined arbitrarily often rather than judged once, cheaply, on arrival.
• Tampering does not erase the evidence. A file already collected stays collected. Wiping it from the machine removes the file, not the copy, not the sightings, and not the record of which machine held it and when.

The trade is stated plainly on every page that touches it: Stairwell is not inline. It does not sit in the network path and does not block execution. It explains and finds, and enforcement stays with the tools you already have.

What does an investigation actually range over?

Four dimensions, and the reason the pivots in step 4 are worth anything is that they cross between them freely.

Most tools answer within one dimension. A single Stairwell question routinely crosses all four: a hostname published in a report this morning resolves to addresses it used last spring, which reverse to other names, which appear in files you collected a year ago, which were seen on eleven of your machines on dates you can hand to your network team.

That is a different shape of question from "did an alert fire", and it is why the unit of work here is an investigation rather than an alert queue. See What Stairwell Knows About a File for the full inventory of what each file contributes to it.

What crosses the boundary between environments?

Analysis does. Your files do not.

Your data lives in environments owned by your organization, and one organization never sees another's files, filenames, paths, or timelines. What is shared is what Stairwell has learned globally, which is why you benefit from analysis performed on files you have never seen. For a service provider that combination is the whole point: each customer stays isolated, and a finding in one can be checked against the entire book with a single pivot.

Read boundaries are enforced everywhere, including in variant results. You only see relatives that sit in environments you are allowed to read.

What happens when new detection arrives?

It is applied to your whole history, not only to what arrives next.

• A new YARA rule is evaluated against incoming files and against the historical corpus. New rules are tested against a known-clean corpus first and their false positive rate measured, so a noisy rule is downgraded to informational instead of paging you a thousand times.
• A new threat report you subscribe an environment to is matched continuously and retroactively, so a fresh report can tell you that one of its hashes has been sitting on an endpoint for six months, and on which machines.
• A sharpened verdict propagates on its own. Your team's own opinion on a file overrides the automated verdict wherever that verdict appears, so you teach the platform once.

Where do I ask the questions?

In the web app at app.stairwell.com, which is where search, the file detail view, assets, and threat reports live. The same data is available through the REST API, the swell command line tool, and an MCP server, so anything you can do by hand can be automated.

What should I read next?

• Your First Fifteen Minutes, to run the loop once yourself on real data.
• Meet Backstory, for the investigator that runs the whole loop from a single indicator.
• What Stairwell Knows About a File, for every signal derived from one file, in one place.
• Variants and Prevalence, the two lenses that do the most work in day to day triage.