Verdicts

A verdict is Stairwell's single answer to the question "is this file malicious." Stairwell's verdict system, MalEval, combines multiple detection engines, machine learning, and analyst opinion into one verdict: a malicious likelihood of Low, Medium, High, or Very High, and labels such as a malware family name. A file with no deep analysis yet reads as Scan Pending rather than being called clean. One file has one verdict, and that verdict changes as the evidence about the file changes.

Why does Stairwell produce one verdict instead of showing every result?

Because an analyst asked to referee their own scanners is being handed the work, not the answer. Raw output is a list of disagreeing vendor strings, a score with no units, and a pile of rule matches, and reading it is a skill that does not scale past the first hundred files of the day. A verdict is the platform taking a position: one likelihood, one set of labels, and enough context to act. Triage becomes reading a bucket rather than adjudicating a spreadsheet.

Two properties of that verdict matter more than the number itself.

It is not frozen. Most tools judge a file when it arrives and keep that judgment. Stairwell keeps the file, so it can keep re-deciding: a verdict reflects the newest engine results, the newest analyst opinions, and the newest AI Triage findings, including for a file collected years ago. A file that looked unremarkable in March and is understood in September does not need anyone to remember to go back and look. The verdict moves, and the alert fires.

Your team outranks the platform. When your analysts record an opinion on a file in your environment, that call overrides the engines and the model wherever that verdict appears for readers of your environment, and it beats Stairwell's public default. This is what keeps the platform usable in a real fleet, which is always full of internal build tooling, bespoke agents, and legitimate software that trips detections. You teach it once, and the decision holds.

One distinction to hold on to, because the two are often confused. A verdict answers whether a file is malicious. Variant Discovery answers what else a file resembles. They are separate systems that answer different questions, and a file can have a confident verdict and no interesting variants, or a pile of variants and no verdict at all.

What do I do with a verdict?

• Triage by the bucket. High and Very High are the files to act on. Low is not the same as safe, and Scan Pending is not a verdict at all.
• Read the labels for context. A family name tells you what you are dealing with and often what to look for next. Selecting a label searches for every other file carrying it.
• Query on it. The verdict is a searchable field, so "everything malicious on this asset" is a query (mal_eval.malicious == true alongside an asset filter) rather than a report request.
• Record your own call. Set an opinion of Trusted, Benign, Grayware, or Malicious on a file from its panel. Use it when you have decided something the platform could not: that a file it flagged is your own build tooling, or that a file nothing flagged is the intrusion. Vulnerable is the fifth option and it is deliberately a separate dimension, recording that a file carries known weaknesses rather than raising or lowering how malicious it is.
• Alert on it. Triggers turn a verdict crossing into a malicious state into a notification by email or webhook, so a file that turns bad months after collection reaches a human.
• Know the API's vocabulary. In the API, the analyst opinion you set is itself carried in a field called verdict, so read carefully when you automate against both.

Where do I see verdicts in Stairwell?

The MalEval card on an object's Summary tab is the canonical view: a Malicious Likelihood row holding the bucket, and a Label row for each label, where each label links to a search for other files carrying it. When nothing has been computed yet, the card reads Scan Pending.

In any list of files, the verdict is the small four-bar indicator beside each row, filling from one bar to four as the likelihood rises. Hovering it shows the same card without leaving the list, which is what makes scanning a long result set fast.

The object panel header carries the opinion control, so recording your team's call is one action away from reading the platform's, and the object's History tab holds the record of who set which opinion and when. Verdicts also drive the Alerts screen and the notifications your triggers send.

What should I read next?

• Opinions, for recording your team's own call on a file and how it overrides everything else.
• AI Triage, for the analyst-grade write-up on a single file, which is a different artifact from the verdict and feeds into it.
• Objects, for the file a verdict is attached to, and why that attachment survives renames and reimages.