Splunk

The Stairwell App for Splunk enriches Splunk events with Stairwell analysis. It adds a stairwell streaming command that takes a file hash, hostname, or IP address out of your existing data and returns what Stairwell knows about it.

This is the integration that pays off fastest for teams whose analysts already live in Splunk, because it does not ask them to leave. A search they already run gains a column.

What is it compatible with?

Splunk Enterprise and Splunk Cloud, on platform versions 9.4 and 10.0.

How do I install it?

From your Splunk dashboard, open the Apps dropdown and select Find More Apps.
Search for stairwell in the left sidebar. There is a single result.
Select Install and proceed.
When prompted, provide the credentials below.

Field	Where to find it
Authentication Token	Generate it in Stairwell on the Auth Token Settings page
Organization ID	The Organization Settings page
User ID	Optional. On the Settings page. Supplying it raises your rate limit

The User ID is genuinely optional, but supply it. Rate limiting is the thing you will notice on a busy search and the least obvious to diagnose.

After submitting the form you land on the app page, and the command is available.

How do I check it works?

Enrich a synthetic event before you point it at real data. This costs nothing and separates "the integration is broken" from "my search is wrong":

| makeresults | eval client_ip="8.8.8.8" | stairwell ip=client_ip

The same shape works for hostnames and hashes:

| makeresults | eval remote_hostname="google.com" | stairwell hostname=remote_hostname
| makeresults | eval object_hash="<insert hash here>" | stairwell object=object_hash

One behavior to expect: hash enrichment returns data only if the object exists in your Stairwell environment. An empty result for a hash is not necessarily a failed lookup, it may be a file your fleet has never reported. See Environments for what "your environment" covers.

What does it look like against real data?

How you invoke the command depends on what your Splunk instance holds. Two worked examples:

Enrich every object referenced in a CrowdStrike log for one host:

source="crowdstrike.json" host="Macbook-Pro.local" sourcetype="_json" | stairwell object="event.Process.SHA256"

Given CrowdStrike RTR invocations, enrich the file hashes referenced by a specific endpoint request:

index="crowdstrike_raw" "event.Attributes.request_path=/real-time-response/entities/extracted-file-contents/v1"
| rex field="event.Attributes.request_query" "sha256=(?<hash>.*)"
| stairwell object="hash"

The pattern in both is the same: extract the identifier from whatever shape your source data has, then pipe it to stairwell. The command does not care where the hash came from.

Troubleshooting

An updated Organization ID or auth token will not save. A known, sporadic issue. Uninstall and reinstall the app to re-enter the credentials.

The app landing page returns a 404. Splunk role configuration is blocking access to the app's UI components. Use the Search and Reporting app instead: the stairwell command has identical functionality there, so this costs you the landing page and nothing else.

Anything else, contact [email protected].

Where is the source?

The app's source, along with Stairwell's other external integrations, is on GitHub: github.com/stairwell-inc/integrations.

Worth knowing if you want to see exactly what the command sends, or to adapt the approach for a platform with no purpose-built integration.

What should I read next?

REST APIs, which is what this app calls and what you would use to build your own enrichment.
Integrations, for what else is available.
Event Notifications, if you want Stairwell to push findings to Splunk rather than have Splunk pull them.