Sleep and Wake Forwarders

Sleep mode pauses a forwarder. A sleeping forwarder records and reports nothing: no sightings, no collection, no action beyond a lightweight check for when it should wake up again.

The recommendation is to leave forwarders running. Sleep mode exists for the cases where that is not possible, and it is a better answer than uninstalling, because the asset keeps its identity and its history and comes back as itself.

Understand the trade before you use it. A sleeping forwarder is a machine Stairwell learns nothing about for as long as it sleeps. Files that arrive during that window are not collected, so they are absent from prevalence, absent from Run-to-Ground, and invisible to a YARA rule written later. That last point is the one people are surprised by: a rule reaches backwards through everything Stairwell holds, and it cannot reach a file that was never collected.

If the reason you are reaching for sleep mode is resource usage rather than a hard requirement, look at Forwarder Throttles first. Throttling keeps coverage while reducing load; sleeping trades coverage away entirely.

Which versions support it?

Older forwarders have no sleep mode. See Forwarder Downloads.

How do I put a forwarder to sleep?

One asset. Go to app.stairwell.com/assets, find the asset, right-click it, and choose Sleep Mode, then Turn On Sleep Mode.

A whole group. Go to the same page, select the environment if you manage more than one, open the Groups tab, right-click the group, and choose Sleep Mode, then Turn On Sleep Mode.

Waking is the same path, choosing Turn Off Sleep Mode.

Allow up to 15 minutes for a change to take effect, in either direction. The forwarder learns about the change on its next lightweight check rather than immediately, so a machine woken for an investigation is not reporting the instant you click.

Plan around that when you are waking a fleet before a sweep: wake first, confirm the assets are checking in, then run the sweep. A search run against a fleet that has not finished waking returns an answer that looks clean and is not.

What should I read next?

• Forwarder Throttles, the option that reduces load without giving up coverage.
• Assets, for what stays true about a machine while its forwarder sleeps.
• Groups and Policies, for putting a whole class of machine to sleep at once.