What Gets Collected

Stairwell does not collect every file on a machine. It collects executables, scripts, and related artifacts: roughly sixty file types by default, listed in full below.

Every environment starts with a Default Policy that tells its forwarders which types to collect. A file is included if it matches one of those types either by filename extension or by magic type, which is the detail that matters most on this page. Magic type means the file's actual content, so a PowerShell script renamed to notes.txt is still collected. Renaming a file does not hide it.

Anything outside the policy is not uploaded. To collect more, customize the policy, or use the API and the UI for one-off uploads. See REST APIs and Additional File Extensions.

Why not collect everything?

Because the value is in what attackers actually run, and the cost of the rest is borne by your endpoints and your network.

Executables and scripts are what execute. A collection policy aimed at them keeps the corpus dense with the things a YARA rule or a variant search can say something about, and keeps your documents, your media, and your users' personal files out of it entirely. That last point is usually the one that matters to whoever reviews the deployment.

The corollary is worth stating plainly, because it shapes what Stairwell can answer: a file type outside this policy was never collected, so no rule written later can find it and no search will show it. If a format matters to you, add it before you need it, not after.

Which file types are collected by default?

Two entries look like mistakes and are not. .elf is labelled as a game file, which is one common use of the extension, and it also covers Linux executables, which is why it is here. .iso and .dmg are disc images: they are collected because installers arrive inside them, and their contents are unpacked into objects of their own.

How do I change what is collected?

Three routes, in increasing order of scope.

Add file types. Extend the policy to cover a format your organization cares about. See Additional File Extensions.

Exclude paths and filenames. Keep specific content out of Stairwell entirely, which is the control that answers "we cannot ship the contents of that directory". See Exclusions and Recommended Exclusions.

Filter at intake. Drop files after they arrive but before they are stored. See Intake Filters.

Exclusions and intake filters solve different problems and are often confused. An exclusion stops a file leaving the endpoint. An intake filter stops it being kept. Reach for the first when the content must not leave the machine, and the second when it may leave but is not worth storing.

What should I read next?

• Exclusions, for keeping content out of Stairwell.
• Additional File Extensions, for collecting more.
• Groups and Policies, for applying a policy to a class of machine rather than a whole environment.