Meet Backstory

Backstory is Stairwell's agentic investigator. You give it a starting point, a hash, a hostname, or an IP address, and it works the case: it pulls the file apart, finds what resembles it, follows where those relatives were seen, follows the infrastructure they reach, and comes back with the full scope and impact in minutes. It behaves like a tier 3 SOC analyst, an expert forensic analyst, and a world class threat intelligence analyst at the same time.

When should I reach for Backstory?

When you have one indicator and need the whole picture, and you would otherwise spend an afternoon pivoting between screens to build it. An EDR alert with a single hash and no context is the canonical case.

You can do every one of those pivots by hand, and the Investigate and Hunt section teaches them one at a time. Learning them is worth it, because knowing what the manual moves are is what lets you judge what Backstory did on your behalf and decide whether you agree.

What does it give me back?

A scoped answer rather than a lead. Backstory reports what the starting indicator turned out to be, where it and its relatives were seen across your fleet, what infrastructure they reach, and which indicators are worth acting on now as opposed to watching or ignoring. When one investigation turns up two unrelated things, which happens often, it keeps them apart instead of blending a two year old leftover into this week's incident.

It is built on Variant Discovery, which is how it finds the renamed and recompiled relatives of a file, and on Run-to-Ground, which is how it establishes the blast radius on each machine and surfaces the rare files that landed alongside a payload.

What should I read next?

• The Backstory section, for starting an investigation, reading the graph, and interpreting the report.
• Variants, the capability Backstory leans on hardest, and the one worth understanding before you read its findings.
• How Stairwell Works, if you want the loop Backstory is investigating over.