Starting an Investigation

You start a Backstory investigation by giving it one indicator: a file hash, a hostname, or an IP address. Open Backstory from the Stairwell navigation, paste the indicator, choose the environment to investigate in, and start it. Everything after that is Backstory's job.

What can I start an investigation from?

One of three things, and one at a time.

• A file hash. A SHA256 is the usual case. An MD5 or a SHA1 is accepted too, and Backstory resolves it to the file Stairwell holds.
• A hostname. A fully qualified name, as it would appear in a DNS record.
• An IPv4 address.

The start form will not launch on something it cannot classify as one of the three, which saves you a run that would have gone nowhere. If your indicator is a domain from a report with punctuation around it, clean it up before starting.

The choice of indicator is a choice about where the investigation begins, not about how far it goes. A hash seed begins with the file and works outward to the machines and the infrastructure. A hostname or IP seed begins with the infrastructure and works inward to the files in your environment that touch it.

How do I start from a file I am already looking at?

Use the workflow menu on the object. Anywhere the main app gives you a file's context menu, there is a Backstory entry that opens Backstory with that file's hash already filled in. You still press start, so you get a chance to check the environment first.

This is the shortest path from "an alert handed me a hash" to a working investigation, and it is worth learning as a reflex.

Which environment does the investigation run in?

One environment, the one you pick, plus any environments you add as intelligence sources.

The investigation environment is where Backstory looks for your files, your sightings, and your assets. It is the answer to "whose incident is this". Intelligence environments add context without making their contents part of your blast radius. Your investigation environment's own intelligence is always in scope, so the common case needs no extra selection at all. See Environments if the distinction is new to you.

If you pick the wrong one, the symptom is a thin investigation: the file is found, but nothing was ever seen anywhere, and the report has little to say about scope.

Do I have to know which environment the file came from?

No. If you know which machine it came from, name that instead.

The start form has an optional Asset ID field beneath the seed. Paste an asset id and Backstory resolves the machine to the environment that owns it, fills the environment in for you, and skips the environment step. The chip that appears names the environment it chose, so the choice is never made behind your back.

The asset is a suggestion, not a lock. Choose a different environment by hand and the asset stops being the reason the environment is selected, the chip goes away, and the environment step comes back. The id stays in the field.

Should I run it live or in the background?

Run it live when you are going to watch it, and in the background when you are not.

• Run live streams the investigation into the tab as it happens. You see the graph build, you can pause it, and you can push it further from a node while it runs. This is the mode to use the first few times, because watching one run teaches you more about what Backstory does than any page can.
• Run in background queues it and hands you back your tab. Track it on the Investigations page, attach to watch it whenever you like, and open the report when it finishes. This is the mode for the fifth hash of the morning, and for anything you want running while you do something else.

Closing the tab on a live run does not kill it. It finishes on its own and saves. That said, a live run with nobody watching is not guaranteed to run indefinitely, so if you know you are going to walk away, start it in the background instead.

What happens in the first few seconds?

Backstory establishes the ground truth about your seed before it starts making choices.

From a file hash it pulls the file's own record, finds where and when it was seen across your assets, gets the platform's automated assessment of it, and runs Run-to-Ground to establish the blast radius and surface the rare files that landed alongside it. Only then does it start deciding what to chase.

From a hostname it establishes the name's reputation and how common it is across the corpus. If the name is rare enough to be interesting, it finds the files in your environment that contact it and works on those. It also pulls the name's resolution history, which is how IP addresses enter the picture.

From an IP address it starts with what is known about the address itself, its registration, and the hostnames that resolve to it.

In all three cases the conversation log names each step as it happens, so you can watch the reasoning rather than infer it. See Reading the Investigation Graph.

How do I know it worked?

Nodes start appearing within seconds and the conversation log fills in. If neither happens, the seed or the environment is usually the cause: check that the indicator is the shape you think it is, and that you selected the environment the file actually lives in.

An investigation that finishes with a thin report is not a failure. Backstory reports what it could establish, including what it could not, and a seed that genuinely has no history in your environment is a real and useful answer.

What should I read next?

• Reading the Investigation Graph, which is the next thing on your screen.
• Pausing, Resuming, and Cancelling, for steering a run that is already going.
• The Backstory API, if you would rather start investigations from code than from a form.