Share Threat Reports

Sharing a threat report copies it into another environment, where it begins matching that environment's files immediately and keeps matching everything that arrives afterward. It is how a service provider gets one campaign's indicators in front of every customer they run, and how a security team gets a report written for one business unit working across the others.

Coverage in Stairwell is per environment, which is what keeps one customer's files from being visible to another. Sharing is the deliberate act of extending a report across that boundary.

What do I need to be able to share one?

Read access to the environment holding the report, and write access to the environment you are sharing it into. If the destination you want is not offered in the dialog, that is the missing permission rather than a bug.

How do I share a report?

Open the Threat Reports page in the left navigation.
Open the report you want to share.
Select the share control in the panel header, tooltipped Share this threat report to another environment.
Choose the destination environment.
Select Share.

Repeat for each destination. One share puts the report in one environment.

What travels with the report?

A copy carrying the substance:

The report's name, description, source, and link to the original.
Its hashes, hostnames, and IP addresses.
Its YARA rules, including their definitions, so rule matching works in the destination and does not depend on the source environment staying readable.
The indicators your team added to the report, merged in alongside the publisher's. If an analyst extended the report during an investigation, the destination gets the extended version, which is usually the point of sharing it.

What stays behind?

The copy is a separate report in the destination environment, not a view of the original, and that has consequences worth knowing before you share rather than after.

Matches do not travel. The copy matches against the destination environment's own files and produces its own count. A report showing three matches in the source environment may show none in the destination, or thirty.
Silences do not travel. An indicator you silenced in the source environment arrives unsilenced in the destination. If you are sharing a report you already know is noisy, expect to silence it again there. See Trigger Silences.
Later changes do not travel. Adding an indicator to the original afterwards does not add it to the copy, and the reverse holds too. There is no ongoing link between the two.
Notifications are configured per environment. The copy alerts only if a trigger covering the destination environment includes that environment as a report source. Sharing a report to an environment nobody has a trigger for produces matches you have to go and look at.

That last pair is the one that catches people out. A report shared to twelve customer environments and then extended with a hash from a new investigation is now twelve reports out of date. If a campaign is still developing, share it once it settles, or plan to re-share.

When should I share instead of creating a new report?

Share when the intelligence is the same and only the environment differs, which is nearly always the case for a service provider covering multiple customers.

Create a new report when the conclusions are different: your investigation in one environment turned up indicators the original report never carried, and they belong to your finding rather than to the publisher's. See Work with Threat Reports.

What should I read next?

Work with Threat Reports, for creating and extending them.
Environments, for the boundary sharing crosses and why it exists.
You Just Acquired a Company, where you do this across a fleet you did not build.