Network Intelligence

Network intelligence is what you do with ActiveDNS, Stairwell's historical record of what the infrastructure in your files was doing over time: which hostnames resolved to which IP addresses and mail servers, when each answer was first and last seen, and which other hostnames share an address. The hostnames come from the files Stairwell already holds, so a domain extracted from a binary you collected last year is a domain whose history you can read today, even if nobody knew it was malicious until this morning.

Where does this data come from?

Not from your network.

Every day Stairwell resolves hundreds of millions of registered domains and records the answers. On top of that daily sweep it also resolves the specific hostnames its scanner extracted from the files it has collected -- the strings and indicators inside executables, scripts, and documents -- along with names from curated threat intelligence.

The accumulated record is more than 1.3 trillion resolutions, indexed in both directions: hostname to addresses, and addresses back to hostnames.

Two things follow. The base sweep means a domain usually has a history even if it never appeared in one of your files, so a name forwarded out of a phishing email that never reached your fleet is still a name you can read. The file-derived layer means the specific hostnames buried in your binaries are resolved too, and stay linked to the files they came out of.

This matters enough to state plainly. There is no sensor in your network, no packet capture, and no netflow anywhere in this. You get the kind of retrospective infrastructure intelligence a passive DNS product provides, without the deployment, privacy, or legal footprint of network monitoring.

The consequence is a limit worth knowing: this is a record of what names resolved to, not a record of what your machines connected to. It tells you where an indicator pointed and when it moved. It does not tell you that a host in your fleet talked to it. For that, look at the sightings of the file the indicator came out of, and at your own network logs.

Why does the history matter more than the current answer?

Because a live DNS lookup answers a question about today, and almost every question worth asking about infrastructure is a question about the past.

Four things follow from having the history that do not follow from a lookup.

An indicator published this morning can be checked against last spring. A report names a domain, and the useful question is not where it points now, which is often nowhere. It is where it pointed while the campaign was running, because that is the address your proxy and firewall logs need to be searched against. A name that was taken down last month has no current answer at all and a perfectly readable past.

Abandoned addresses are indicators nobody published. A report lists what its author saw. The addresses the domain used before that, and moved off, are usually not in the list, and they are frequently still hosting the rest of the operation.

Activation has a date. Failed lookups are kept rather than discarded, so a name that answered NXDOMAIN for months and then started resolving shows you exactly when somebody turned it on. Compare that date against when a file arrived on one of your machines and you have a timeline that neither fact gives you alone.

Reuse is visible. Operators recycle addresses across campaigns. Reverse an address and the other names that have lived there are frequently the rest of the footprint, including names from an earlier campaign that was written up under a different label.

The unit to think in while you do this is the eTLD+1, not the full hostname, because that is the part one operator actually controls.

For the concepts underneath all of this -- what ActiveDNS is, how the reverse index works, and how hostnames stay wired to the files they came out of -- see Hostnames and IP Addresses.

What can I ask about a hostname?

Open a hostname and you get its resolution history: each answer it has returned, the record type, and when that answer was first resolved. Answers that were not seen in the most recent resolution are shown as inactive, along with when they were last resolved, so a domain that has moved shows both where it used to point and roughly when it stopped.

Three record types are covered:

Failed lookups are kept too, not discarded. A domain that answered NXDOMAIN for months and then started resolving is a domain that was activated, and that transition is frequently the most interesting fact available about it.

The hostname panel also shows the subdomains Stairwell has seen under that name, which is how you go from one host to the shape of a whole domain, and the files, assets, and YARA rules connected to it.

What can I ask about an IP address?

The reverse question: which hostnames have resolved to this address. That is the pivot that turns one indicator into an actor's footprint, because infrastructure gets reused and the other names parked on an address are frequently the rest of the campaign.

It is also how you avoid a common false lead. An address answering for a large number of unrelated domains is shared hosting, a parking service, or a sinkhole, and an indicator that points there deserves much less weight than one pointing at an address answering for two names. Read the list before you act on the address.

📘

The reverse direction is IPv4 today. AAAA answers are resolved and kept like any other, so an IPv6 address shows up in a hostname's history -- but pivoting from an IPv6 address to the names that have used it is not available yet, so treat an empty result there as a coverage boundary rather than a quiet address. Reverse IPv6 is coming; if you have use cases for it, raise them with your customer success manager.

How do I use this in an investigation?

The move that pays for itself: a report names a domain, and you want to know whether you were ever exposed.

1. Search the hostname. The Hostnames tab of search results holds the hostname entities; the IPs tab holds the addresses.
2. Read the resolution history. Note every address the domain has used and when, including the ones it abandoned. Those historical addresses are indicators the report probably did not list.
3. Pivot on the addresses. For each one, look at what else resolved there. Weight it by how crowded the address is.
4. Go back to the files. The hostname panel lists the files that reference it, which is the link back into your own environment. A hostname referenced by a handful of files is a lead; one referenced by an enormous number is infrastructure the whole internet touches.
5. Check who saw those files. Take the files to their sightings and assets, and you have an exposure answer with dates rather than a yes or no.
6. Record what you concluded. Hostnames and IP addresses carry opinions, tags, and comments exactly as files do, so the call you make on a domain is durable and visible to the next analyst. See Setting Opinions.

You can also paste an entire report into the search bar and let Stairwell pull out the hashes, domains, and addresses at once, which is usually faster than working through a report indicator by indicator. See Hunting and Search.

Where else do network indicators show up?

• The Embedded Data section of the object panel, which lists the hostnames and addresses found inside a file. This is where most infrastructure pivots start. See The Object Panel.
• The Detonation tab, in beta, which reports the hostnames and addresses a file reaches out to during behavioral analysis. Stairwell is not a full sandbox, so read this as an addition to the static evidence rather than a complete behavioral profile.
• Search filters, where net.hostname and net.ip narrow a file search by the infrastructure inside the files. See CEL Query Language.

Can I get this through the API?

Yes, for hostnames. One request returns the historical A, AAAA, and MX records for a name, each with the outcome of the lookup and the time it was performed.

GET /v1/hostnames/{hostname}/metadata

Hostnames and IP addresses also expose opinions, comments, and tags at /v1/hostnames/{hostname}/... and /v1/ipAddresses/{ip}/..., so an integration can record a conclusion about infrastructure the same way it would about a file. The full request and response shapes are in the Stairwell Network Intelligence API reference.

What should I read next?

• The Object Panel, for the Embedded Data section that starts most infrastructure pivots.
• Setting Opinions, which covers opinions on hostnames as well as on files.
• Hunting and Search, for pasting a report full of indicators in at once.
• Hostnames and IP Addresses, for the concepts this page puts to work.