Sightings

A sighting is the record that one file was observed on one machine, in one environment, at a particular path and filename, first at one time and most recently at another. Objects answer what a file is. Sightings answer where it was, when it arrived, when it was last there, and what it was called. A single file can have thousands of sightings across your fleet, each with its own name and location, and Stairwell keeps all of them.

Why does Stairwell keep sightings separately?

Because the file and the observation age differently, and only one of them is safe to throw away. The file is small, deduplicated, and worth keeping forever. The observations are the expensive part in every other tool, which is why every other tool deletes them: endpoint telemetry rolls off in weeks, logs in a month or three. Stairwell stores the file once and keeps the observations as lightweight records against it, which is what lets it answer the question those tools cannot answer after their window closes: which of my machines had this file, starting when, and what was it called there.

That last clause is not a detail. The name and the path live on the sighting, not on the file, because the same file is called different things in different places. A renamed binary, an installer dropped in a temp directory on one host and in a startup folder on another, a tool copied to a share: all one file, all different sightings. Renaming is the cheapest evasion there is, and it is why a hunt that searches by filename goes quiet while the file itself is untouched. Search by the file, then read the names off its sightings.

Sightings are also what turn a detection into a timeline. First seen tells you when a file arrived on each machine, which is how you find the host it landed on first and the day the intrusion actually started, usually well before the alert that brought you here. Last seen tells you whether it is still there. Ordering the sightings across the fleet is scoping, and it is one screen rather than a week of correlation work.

The volume of sightings is also what makes rarity meaningful: a file with two sightings in your fleet and none anywhere else is a very different object than one with forty thousand. See Prevalence.

What do I do with a sighting?

• Build the timeline. Open a file's sightings, sort by first seen, and read the spread across machines. The earliest sighting is your patient zero candidate.
• Get the names and paths. Take them into your other tools, since they are what an EDR query or a log search can act on.
• Find out where the file came from. A sighting marks a file that arrived as a web download, and it names the parent object when the file was unpacked out of something else, which is often how you find the dropper rather than only the payload. A sighting produced that way is a virtual sighting: the archive was reported by the machine, and the file inside it is credited to the same machine.
• Count carefully. A file's sighting count is not its asset count. One machine can produce several sightings of the same file at different paths and times, so the two numbers are shown separately.
• Pivot to the machine. Every sighting names its asset, so a file leads to hosts and a host leads back to everything unusual on it. See Assets.
• Check whether it is still live. Compare last seen against the asset's last check-in before you conclude a file is gone.
• Expect no per-machine detail on uploads. Files that arrive from a feed or a bulk upload belong to an environment but have no machine, path, or filename to record, because no machine reported them.

Where do I see sightings in Stairwell?

The Sightings tab of any object, which shows a count in the tab label. Its columns are Environment, Asset, Filepath, Filename, Origin, Parent object hash, First seen, and Last seen, sorted with the most recent last-seen first. The Asset column header carries its own count, so you can read the number of machines and the number of sightings off the same table. Rows that came from an unpacked file are marked with an icon.

On the Assets screen, the Last sighting column is the most recent sighting reported by that machine, which is a different thing from the machine's last check-in: one says when it last had something to tell you, the other says when it last spoke.

Sightings are also what a Run-to-Ground investigation orders into a per-machine timeline, and what a threat report match points at when it tells you an indicator has been in your environment.

What should I read next?

• Objects, for the file a sighting refers to, and why the file is stored once while the sightings accumulate.
• Assets, for the machine on the other end of a sighting.
• Prevalence, for how Stairwell turns a count of sightings into a rarity signal you can triage on.