Integrations
Connect Stairwell to the tools you already run: EDR platforms that send it files, and the SIEM, SOAR, and case management systems that receive its findings.
Stairwell integrates in two directions, and it is worth knowing which one you are setting up before you start, because they solve different problems.
Inbound integrations send files to Stairwell. An EDR platform you already run has visibility into your endpoints, and Stairwell can take the files and detections it surfaces rather than requiring a second agent on every machine. This is how you get coverage without a new deployment.
Outbound integrations send Stairwell's findings somewhere else. A verdict, a rule match, or a report match becomes an event in your SIEM, a case in your case management system, or the trigger for a playbook in your automation platform. This is how Stairwell reaches the people and processes that already exist.
Most teams run at least one of each.
Which integrations are available?
| Integration | Direction | What it does |
|---|---|---|
| CrowdStrike | Inbound | Ingests detections and suspicious file activity, and optionally retrieves the files themselves |
| SentinelOne | Inbound | Ingests threat detections and fetches the associated files |
| Splunk | Outbound | Sends Stairwell events into Splunk as searchable data |
| Google SecOps | Outbound | Sends Stairwell events into Google SecOps, formerly Chronicle |
| Elastic | Outbound | Sends Stairwell events into Elasticsearch |
| TheHive | Outbound | Creates and updates cases from Stairwell findings |
| Tines | Outbound | Drives Tines stories from Stairwell events, and queries Stairwell from a story |
| Cortex XSOAR and XSIAM | Both | A full content pack: commands, playbooks, and an event feed |
| Generic SIEM or SOAR | Outbound | A webhook, for anything without a purpose-built integration |
Two more ways in and out are documented elsewhere, because they are not integrations with a named product. The REST APIs are what every integration above is built on and what you would use to write your own, and the MCP server exposes Stairwell to AI assistants that speak the Model Context Protocol.
Do I still need the forwarder?
Usually, yes, and this is the question worth settling early rather than discovering later.
An EDR integration gives you the files that platform noticed. The forwarder gives you the files that are there, whether anything noticed them or not, including everything already on disk before Stairwell existed in your environment. That difference is the whole premise of the product: the file nothing flagged is the one worth finding, and an integration that only forwards detections cannot hand you one.
There is also a throughput consideration. An EDR platform's data pipeline is built for its own purposes, and it may not sustain the rate needed for full file visibility, particularly on macOS and Linux. If extended coverage on those platforms matters to you, deploy the forwarder there and treat the integration as an addition.
The honest summary: use an integration to reach machines you cannot put a forwarder on, and use the forwarder where you can.
How do I set one up?
Inbound integrations are configured per environment, from the settings area:
- Select the settings icon.
- Open the Managed environments tab.
- Find the environment you are configuring, select (...) under Actions, and choose Manage integrations.
- Choose the integration to add.
Outbound integrations are configured on the receiving side, using a Stairwell auth token and, in most cases, an event notification that decides which findings are sent. Each page below covers its own specifics.
Every integration needs credentials from both sides, and several of them involve secrets that the other platform will show you exactly once. Read the whole page before you start clicking, and have somewhere to put a secret before you generate it.
What should I read next?
- Event Notifications, which decide what an outbound integration receives.
- REST APIs, the surface every integration is built on.
- Forwarder Deployment, for the coverage question above.
Updated 4 days ago