Overview

Stairwell allows you to query data and relationships in your environments using Common Expression Language (CEL).

CEL provides a powerful syntax for filtering and searching entities across the Stairwell platform. Analysts use CEL queries to locate malware indicators, hunt for suspicious files, filter YARA rules, and explore network indicators.

A typical CEL query consists of three parts:

entity.property == "value"

Example:

object.md5 == "6f5902ac237024bdd0c176cb93063dc4"

Entities

CEL queries operate on top-level entities within Stairwell.

Each entity supports different properties.

Example:

object.sha256 == "HASH"

Query Structure

General CEL query format:

entity.property OPERATOR value

Example:

rule.name == "example_rule"

⚠️ Queries only return results if the current Stairwell view matches the entity.

Example:

Supported Properties

rule

rule.name == "<NAME>"
rule.status == ACTIVE
rule.status != INACTIVE
rule.version > 5
rule.tag == "MALWARE"

object

object.sha256 == "<SHA256>"
object.sha1 == "<SHA1>"
object.md5 == "<MD5>"
object.imphash == "<IMPHASH>"
object.authenticode_verification_result == VALID
object.tag == "<TAG>"
object.tag in ["TAG1","TAG2"]

📘

Note
object.tag queries cannot be combined with other logical operators.

net

net.hostname == "sub.domain.com"
net.ip == "1.2.3.4"

mal_eval

mal_eval.malicious == true
mal_eval.label.contains("trojan")
mal_eval.probability_bucket > r"PROBABILITY_VERY_HIGH"

Operators

Querying Multiple Values

Example:

object.sha256 in ["hash1","hash2","hash3"]

Example with AND:

object.imphash == "abcd1234" && mal_eval.malicious == true

Regex Queries

Regular expression queries use .matches().

Example:

rule.name.matches("[Aa]pt")

This matches:

apt
APT
Apt

Example Threat Hunting Queries

Search by hash:

object.sha256 == "HASH"

Search by import hash:

object.imphash == "IMPHASH"

Search by YARA rule:

rule.name == "example_rule"

Search by hostname:

net.hostname == "malicious.domain.com"

Search for malicious files:

mal_eval.malicious == true

Search for trojan-labeled files:

mal_eval.label.contains("trojan")

Common Environment IDs

Malware Feeds

Rule Feeds