Tines
Forty-two Stairwell actions available natively in the Tines template library, plus five example stories covering enrichment, impact assessment, scoping, and hunting.
Stairwell's actions are available natively inside Tines as action templates. There is nothing to download or import: open the action template library in the story editor, search for Stairwell, and drag what you need into a story.
Forty-two actions cover the breadth of the Stairwell API, and five example stories show what they look like assembled into something useful.
How do I get started?
Search the Tines action template library for Stairwell and add an action. The credential setup, API token generation, and example workflows are covered in the Installation Guide.
You need a Stairwell auth token to authenticate the actions. See REST APIs for generating one and for what it can reach.
Add only the actions you need. There is no reason to import all forty-two, and the library is the point: it is a menu, not a package.
What actions are available?
File operations
| Action | What it does |
|---|---|
| File Enrichment | Comprehensive file intelligence |
| Variant Discovery | Find related files. See Variants |
| File Upload (Intake) | Submit a file for analysis |
Object analysis
| Action | What it does |
|---|---|
| AI Triage Summarize | An automated threat assessment. See AI Triage |
| Object Sightings | Where a file has been seen. See Sightings |
| Object Opinions | Analyst judgments. See Setting Opinions |
| Detonation Trigger | Start dynamic analysis |
| Detonation Get | Retrieve analysis results |
| Run To Ground Generate | Impact scoping. See Run-to-Ground |
Network intelligence
| Group | Actions |
|---|---|
| ASN | ASN Get WHOIS |
| Hostname | Hostname Get, Hostname Get Resolutions, Hostname Batch Get Resolutions |
| IP address | IP Address Get, IP Cloud Provider Lookup, IP Get Hostnames, IP Get WHOIS |
| Utilities | Cloud IP Ranges, Canonicalize Hostname, Batch Canonicalize Hostnames, Compute ETLD+1, Batch Compute ETLD+1, Canonicalize URL, Batch Canonicalize URLs |
The utility actions look like filler and are not. Normalizing a hostname and computing an eTLD+1 are the two steps everyone writes by hand and gets subtly wrong, and getting the eTLD+1 wrong is what turns a precise block into either a useless one or an outage.
Assets and tags
List Assets, Get Asset, Create Asset, Update Asset, Add Asset Tags, Remove Asset Tags. See Assets.
YARA rules
List YARA Rules, Get YARA Rule, Create YARA Rule, Delete YARA Rule, Query YARA Matches, Add YARA Rule Tags. See YARA Rules.
Threat reports
Create Threat Report, List Threat Reports, Get Threat Report, List IOCs in Report, Delete Threat Report. See Threat Reports.
Integration framework
Action Dispatcher, a central router that standardizes requests and responses across every Stairwell API call.
What do the example stories do?
Five, each downloadable and meant as a starting point rather than a finished product.
SOC Alert Enrichment, 9 actions. Receives alerts from a SIEM or EDR by webhook, enriches the hashes with reputation and AI triage, updates the ticket in Jira or ServiceNow, and posts high-priority findings to Slack.
Threat Report Impact, 7 actions. Ingests an external threat report, cross-references its indicators against your data, identifies affected assets and prevalence, and writes the impact up in Confluence or Jira. This is New IOCs Were Published as an automation.
Automatic Run-to-Ground Scoping, 8 actions. Triggers on a confirmed malicious detection, generates the blast radius, tags every affected asset, and creates an IR ticket, paging on-call if the spread is multi-asset.
ActiveDNS Infrastructure Investigation, 8 actions. Takes a suspicious domain from proxy or DNS logs, pulls its resolution history, enriches every resolved address with WHOIS and cloud data, and aggregates an infrastructure timeline. See Someone Reported a Suspicious Domain.
Rare Files Hunt, 10 actions. Runs daily, queries sensitive assets for rare files, triages the suspicious ones, discovers variants, and creates tickets plus a daily summary. This is proactive hunting rather than alert response, and it is the story most worth adapting.
Common questions
Can I use the original six templates alongside this? Yes. They remain available and supported, they are a separate story, and they do not interfere. Migration is optional.
Do I need all 42 actions? No. Add what you need from the library.
What happens when the Stairwell API changes? The integration is updated to match.
What about rate limits? Every action retries on HTTP 429 with exponential backoff.
Can I customize the example stories? That is what they are for. Point them at your own ticketing system and notification channels.
The original templates
Still available for teams who prefer a focused set: Run to Ground, Get File Hash Reputation, Get Dynamic Analysis Report, Upload a File, Create a Tag for a File, and Create Job for Dynamic Analysis.
Where do I get help?
[email protected] for the Stairwell side, and Tines support for the platform.
What should I read next?
- REST APIs, which every one of these actions calls.
- Integrations, for what else is available.
- Playbooks, since the example stories are automations of workflows written out there.
Updated 19 days ago