Objects

An object is a file as Stairwell identifies it: by the content of the file, not by its name or where it was found. Every object carries its hashes, its size, the day Stairwell first saw it anywhere, and the day it first appeared in each of your environments. The same bytes on ten thousand machines, under a hundred different filenames, across three years, are one object with one accumulated body of analysis. Stairwell keeps the original bytes in the Stairwell Private Vault, so an object collected years ago can still be re-examined today.

Why does Stairwell identify a file by its content?

Because everything else about a file is something an attacker can change for free. A filename is a costume, a path is a suggestion, and a timestamp is a field in a header. The bytes are the thing that actually ran. Identifying a file by its content means the same file is recognized as the same file after it is renamed, moved, copied to another machine, or found a year later on a host you had forgotten about, and every piece of analysis it has ever accumulated is waiting when you open it.

Content identity is also what makes keeping everything affordable, which is what makes keeping everything possible. A file is stored once, however many machines have it. Before a forwarder sends a file, it asks whether that file is already in the environment: the first machine to see it contributes the bytes, and the rest record that they have it too. That is why collecting from a whole fleet, including the files that were on disk long before Stairwell arrived, costs a fraction of what teams expect. Everything else, every machine, path, filename, and date, is a lightweight record pointing at the one object. See Sightings.

There is a third consequence, and it is the one that pays off years later. Because an object never changes, the platform can keep changing its mind about it. The facts of an object, its bytes and its history, are permanent. The interpretation, meaning what it is, whether it is malicious, and what else it resembles, is computed on top and recomputed as intelligence improves. A tool that records "we saw this file" and "this file is bad" as a single fact cannot revisit either one. Stairwell keeps them apart on purpose.

Worth knowing what is not an object. Stairwell does not collect every file on a machine. Collection is aimed at the files that can carry an attack: roughly 65 executable and script formats by default, from PowerShell, Bash, batch, and Lua scripts up through executables, drivers, DLLs, JARs, and other binaries. Documents, spreadsheets, and images are out of scope by default. That default is a starting point rather than a fixed policy, since you can exclude paths and filenames you do not want collected and add file types to widen coverage. Objects can also have parents: when Stairwell unpacks an archive or an installer, the files inside become objects in their own right and each remembers the object it came out of, so a payload delivered inside a zip is a file you can search for and hunt across your fleet rather than something buried in a container.

What do I do with an object?

• Look one up by hash. Paste a SHA-256, SHA-1, or MD5 into Search. Any of them resolves to the same object.
• Decide whether it is yours to worry about. My Objects tells you whether the file has been in your environments. Global Objects tells you whether Stairwell has seen it at all, which is how you learn something useful about a file that has never touched your fleet.
• Read what the platform knows. An object's panel holds its verdict, its sightings, its rule matches, its strings, and its parsed executable structure, and it is where you ask for an AI Triage write-up or the files this one resembles.
• Take the bytes. You can download the original file as a password-protected zip when you want to work on it in your own tooling.
• Share it across your own boundary. If you hold more than one environment with write access, you can make an object accessible in another of your environments.

Where do I see objects in Stairwell?

Search is the front door, with results split into My Objects and Global Objects, each showing a count.

Selecting a result opens the object panel, whose tabs are the platform's answers about that one file: Summary, AI Triage, Sightings with a count, Variants, YARA, Strings, Hex View, PE Data, ELF Data or Mach-O Data depending on the file type, Integrations, and History. The header carries the hash, the download and share actions, and the control for setting your team's opinion of the file.

Objects also appear anywhere the platform hands you files: in an asset's interesting and rare file lists, in a threat report's matches, in a YARA rule's matches, and in alerts.

What should I read next?

• Sightings, for where and when an object was seen, which Stairwell keeps as a separate record from the object itself.
• Verdicts, for how Stairwell answers whether an object is malicious.
• Variants, for how Stairwell finds the files an object resembles, which is a different question from whether it is malicious.