Reading the Investigation Graph

The graph is the investigation as it happens: each file, machine, hostname, IP address, and piece of intelligence Backstory has touched, and the relationships it established between them. It is not a picture of your network. It is a picture of one case, and it grows while you watch.

What am I looking at?

Columns, arranged left to right in the order an investigation tends to travel, with the most severe thing in each column at the top.

The seed is marked so you never lose the thread back to where the case started. Empty columns are dropped, so a hostname investigation that never reached an ASN does not leave you staring at a gap.

The PIVOTS column is the one worth understanding, because it is where you can see what Backstory actually did. Each pivot node is one analysis, and the files hanging off it are that analysis's results. A Variant Discovery pivot's children are the resembling files it found. A Run-to-Ground pivot's children are the files that were on the same machines at the same time.

Two views are available. The default arranges nodes into those columns, which is what makes a large investigation readable. A free layout is available from the graph controls if you would rather see the shape of the relationships than the taxonomy. In the column view you can drag a node vertically and pan and zoom, but columns stay put, because the column is information.

What do the colors mean?

Each node carries the disposition Stairwell computed for it, and the color is that disposition: malicious, suspicious, benign, or nothing yet.

"Nothing yet" is a real and common state early in a run, and it means the platform has not concluded anything, not that the thing is safe. Watch the colors settle as the investigation goes: a file that arrives uncolored and turns red a moment later had its verdict established while you were looking at it.

Your own opinion outranks every automated signal. If you mark a file malicious or benign, the node reflects your call from that moment on, and so does the report.

How do I see the evidence behind a node?

Click it. Every node opens a detail panel, and the panel is the evidence.

A file panel leads with the identity and the verdict, then gives you the facts underneath: how rare the file is locally and globally, which machines it was seen on and when, the filenames and paths it used, the hostnames it contacted, the YARA rules that matched it, and the related files with how confidently each belongs. A hostname panel gives you rarity, resolution history, whether the name is known-bad infrastructure, and the reputation picture for its domain. An asset panel gives you what was found there.

Three reading notes that save people from wrong conclusions:

• A match percentage is relative to the pivot that produced it, not to the file whose panel you are reading. If a Variant Discovery pivot started from file X, every percentage on its results is similarity to X. Run-to-Ground results carry no percentage at all, because co-occurrence is not similarity.
• "Carried on assets" is not the same as "seen on assets". A file that reached a machine inside an archive or a packer is listed separately, with the parent it came in, and the panel says plainly that it may or may not be present on the machine as its own file. Blast radius claims are never inflated by that distinction.
• Counts drawn from periodic snapshots are shown as approximate, with a ~, and facts local to this investigation are shown exactly. A count with a tilde is honest imprecision, not a rounding error.

Hashes are never truncated in panels, values are click-to-copy, and identities deep-link back into the main Stairwell app so you can leave the investigation and check any claim against the platform directly.

How do I follow Backstory's reasoning?

Read the conversation log beneath the graph. It is one line per step: a timestamp, a verb, and a short message naming what was done and to what.

The log is the narrative version of the graph. When you want to know why a file entered the case, find it in the log and you will see which pivot produced it, and what Backstory was doing at the time. Detailed analysis does not live in the log, it lives on the node, so the log stays scannable.

Can I push the investigation further myself?

Yes, and this is the part most people discover late. Right-click any node while the investigation is live and you get its actions:

• Analyze (+5 steps) hands the investigation back to Backstory with that node as the new focus.
• AI Triage, Get Sightings, Get Variants, and Run RTG on a file run that one analysis now, whether or not Backstory had planned to.
• Check Prevalence on a hostname answers how common it is.
• Retrieve +10 matches on a YARA rule pulls more of what it matched.

You can also record your own verdict on a node from here. Doing that is not a note to yourself: it changes the disposition, and regenerating the report rebuilds the findings around your call. That is the intended way to disagree with Backstory.

Why does the graph look like two investigations?

Because sometimes it is. One pivot can find things that have nothing to do with each other, and Backstory separates them rather than blending them into one story. See Campaign Awareness.

What should I read next?

• The Backstory Report, which is the graph's conclusion in a form you can hand to someone else.
• Campaign Awareness, for how one investigation keeps two intrusions apart.
• Variants and Prevalence, the two concepts that explain most of what the panels are showing you.