Sharing a Backstory Report

A finished investigation has three shareable forms: the link to the live page for colleagues who use Stairwell, a single self-contained HTML file for everyone else, and machine-readable output for another tool. Which one you want depends entirely on who is receiving it.

How do I share it with a colleague who uses Stairwell?

Send them the page URL. It carries the investigation's identifier, so the link reopens the saved investigation, graph and report together, exactly as you left it.

The link is not a bypass. Whoever opens it still has to have access to the investigation's environment, and that is checked when they open it, not when you send it. Sharing a link with someone who cannot read the environment shares nothing.

This is the form to use inside a team, because the recipient lands on the live investigation rather than a snapshot: they can click through to the evidence, follow the deep links into the platform, and record their own verdict if they disagree with yours.

How do I send the report to someone who cannot open Stairwell?

Download it. The download button in the report toolbar produces one HTML file that renders the report exactly as it appears in the app, and opens in any browser with nothing else installed.

It is genuinely self-contained. No fonts, scripts, or images are fetched from anywhere, so it works on an air-gapped machine, in an email attachment, and as an evidence artifact filed against a ticket. The tabs work, the connection map works, the copy buttons work.

What does not work is anything that needs the live server: you cannot regenerate the report from the downloaded copy, and the links back into Stairwell are still links, so they need access to follow. Everything the report says is in the file; everything that would change it is not.

Treat the file as sensitive. It contains machine names, file paths, hashes, and your incident narrative, and unlike the link, it carries no access check with it. Send it the way you would send any incident write-up.

Can I get the findings into another tool?

Yes. The Backstory API returns a finished investigation in machine-readable form: the verdict and summary, the immediate actions as a flat list, the full report, the classified remediation export, and the raw graph state.

This is the path for feeding an investigation into a ticketing system, a SOAR playbook, or your own automation. The remediation export is the piece to reach for first: it is the classified action plan, assembled from the investigation's own record rather than parsed out of prose, and it carries a schema version so your integration can rely on its shape.

How do I find an investigation again later?

The Investigations page is the index, and it is built for a team rather than a person.

• Rename an investigation so it reads as the incident and not as a hash.
• Label it, and filter the list by label.
• Assign an analyst, so an investigation has an owner rather than a launcher.
• Filter by environment, status, severity, date, or your own investigations.
• Archive what is closed, so the list stays the work in front of you.

There is also a search that answers the question you will actually have in three months: which investigations mentioned this indicator. Search by hash, hostname, or address and you get every investigation that recorded it, with the disposition it was given. Hostname searches include subdomains by default, so a search for a domain finds the investigations that saw a name underneath it.

That search is the reason it is worth naming and labeling investigations as you close them. The next incident often starts as a question about the last one.

What should I read next?

• The Backstory API, for the machine-readable form and for driving investigations from code.
• The Backstory Report, for what you are sharing.
• Threat Reports, for how curated intelligence is represented inside Stairwell.