Install on Windows with Tanium

Stairwell publishes a package in the Tanium gallery, so this is an import and two substitutions rather than a packaging exercise.

What do I need first?

• Your environment ID.
• A forwarder auth token.
• .NET Core 5.0 or newer, included in the bundled installer.
• Tanium Deploy.

Plan which machines go first. The initial backscan is a full disk scan and is resource intensive for a while, so do not start with critical assets. Your earliest installs take the heaviest load because they upload the greatest number of files nobody has seen before; later machines find more of their files already known and their backscans are shorter. See Asset Deployment Strategy.

Import and configure the package

1. Open the Deploy module in Tanium.
2. From Quick Links, select Package Gallery.
3. Filter Title for Stairwell and select Stairwell Forwarder.
4. At the far right of the entry, select the down arrow to import it, and confirm.
5. On the Stairwell Forwarder software page, select Edit.
6. Scroll to Deploy Operations, and under Run Command replace the placeholders:

.\InceptionForwarderBundle.exe TOKEN="<AUTH_TOKEN>" ENVIRONMENT_ID="<ENV_ID>" /quiet /norestart /log C:\stairwell.log

7. Scroll to Installation Requirements and delete the second requirement. It is a reminder to fill in the token and environment ID, plus a link to this page, and it exists only to stop the package deploying before step 6 is done.
8. Deploy it through your normal process.

Step 7 is the one to remember. Leaving that requirement in place means the package refuses to deploy, and the reason is not obvious from the failure.

TOKEN and ENVIRONMENT_ID are the only required parameters. Backscan behavior, CPU and bandwidth limits, and starting in sleep mode can all be added to the same command line. See Windows Install Parameters.

Keep /log C:\stairwell.log. When a deployment fails on a subset of machines, that log is what turns guesswork into a diagnosis.

Confirm it worked

1. Go to app.stairwell.com.
2. Open Assets and find the new asset names.
3. Check the data under All Objects.

Ingestion takes a few minutes to show, and the backscan runs well past that. An asset checking in with few objects is normal early on. If a machine never appears at all, start at What to Check First.

What should I read next?

• Windows Install Parameters, for the rest of the command line.
• Asset Deployment Strategy, for deployment order.
• Pre-Deployment Check, for the network requirements to confirm first.