Variants and Sightings

A variant is a file that resembles another file closely enough to be worth investigating together. A sighting is a record that a file was observed on one of your assets at a particular time. Variants answer "what else looks like this", sightings answer "where and when was it here", and almost every investigation needs both, because one hash on one machine is neither a scope nor a story.

What is a variant, and where does Stairwell look for one?

Variant Discovery finds the files with content and structural similarity to the one you are looking at, across the entire corpus: both your own private files and the global malware corpus. It hands back a ranked list with a similarity reading on each entry, so you can decide what to open first without unpacking anything by hand.

That comparison happens out of band, in Stairwell rather than on the endpoint, across petabytes of files. Nothing about it is limited by what an agent on a laptop could afford to compute, which is why the answer covers files collected years ago as readily as ones collected this morning.

It runs automatically on the files in a threat report and as part of a Backstory investigation, and on demand whenever you ask for it in the web app or through the API. It does not run against every file at the moment that file is collected, so treat it as a lens you point at a file rather than a field stamped on one.

GET /v1/objects/{SHA256}/variants

Why does the global malware corpus matter here?

Because it is what connects two of your own files that do not resemble each other.

Malware authors change their tools constantly: new versions, obfuscation, encryption, packing, junk insertion. Each change breaks an exact-hash match while leaving the tool recognizably the same tool, and unpacking and comparing samples by hand does not scale past a handful of files.

Now follow what happens when the comparison reaches beyond your own environment:

1. A bad file A sits inside your environment.
2. A resembles a file in the global malware corpus.
3. That outside file has its own relatives there.
4. One of those leads back to a distant file B, on a different machine of yours.

A and B may not resemble each other closely enough to connect directly. Searching only your own files would never have linked them. The global corpus is the bridge between two of your own files, which is a different thing from a bigger haystack: it is what tells you what bad looks like, and it carries the relationships that let a local file be recognized as part of something larger.

There are two limits worth holding onto. Similarity is a lead and not a verdict, because two builds of the same benign installer are nearly identical too. And what you see always respects environment boundaries, so a variant sitting in an environment you cannot read is never surfaced to you.

What is a sighting?

A record that a specific file was on a specific asset at a specific time. Sightings come in two kinds:

• Actual sightings. The file was collected from that asset directly, by a forwarder or by the swell CLI.
• Virtual sightings. The file was found inside something else collected from that asset. If a machine holds a zip containing a malicious executable, the zip is an actual sighting and the executable inside it is a virtual sighting from the same asset.

Virtual sightings are the reason a payload hiding inside an archive is still a file you can search for, judge, and alert on, rather than a thing nobody knew was there.

One counting note that trips people up: sighting counts are not asset counts. One object can have many sightings on one asset across different times and paths. When you need to know how many machines are affected, read the asset count.

GET /v1/objects/{SHA256}/sightings

How do I use variants and sightings in an investigation?

Take them in order. Variants widen the question, sightings scope the answer.

1. Start from what you have, usually one hash from an alert or a report.
2. Open the Variants section and see what the file belongs to. If your team has already judged any member of the cluster, that opinion is on the list, and it often settles the new file immediately.
3. Sort the cluster for the interesting end. Rare variants carrying a bad verdict come first. The common ones are usually shared libraries and packers.
4. Take the whole cluster to sightings. Ask which of your assets saw any member of it, not only the one file the alert named. This is the step that turns one endpoint into the real list.
5. Read the dates. The first sighting of the earliest cluster member is your best estimate of when this actually started, and it is frequently much earlier than the alert.
6. Then go to Run-to-Ground for what arrived alongside those files on those machines, including the things nothing flagged. You can launch it from the Variants view directly, or by right-clicking any hash and choosing Workflows → Run to ground -- there is no separate page to navigate to.

What does this answer that a hash search does not?

• Is this file part of something? The variant list tells you whether you are looking at a one-off or a family, and whether the family is already known to be bad.
• Where did it land? Sightings across the cluster, not only the single hash, give you the affected assets and environments.
• How long has this been here? First-seen dates across the cluster, which is how an investigation acquires a timeline.
• Was this here before anyone told us to look? When a report is published, searching for variants of its hashes finds the historical presence that an exact-hash sweep misses, because the version you were hit with is rarely the version the report documented.

Starting from a single hash, you can map the scope of an incident without writing a YARA rule or correlating logs by hand.

What should I read next?

• Variants and Sightings, for the concepts on their own.
• Run-to-Ground, which combines variants, sightings, and rarity into one blast-radius picture.
• Prevalence, which tells you which members of a cluster deserve your attention first.