Using Stairwell as a VirusTotal Replacement

This guide explains how to perform common VirusTotal Enterprise workflows using the Stairwell platform and API.

Overview

Many teams use VirusTotal (VT) for file lookups, YARA hunts, and triage. Stairwell offers an equivalent feature set with unlimited analysis and private data handling.

You can migrate VT workflows to Stairwell using the following endpoints:

Workflow	Stairwell Endpoint	Notes
File Lookup	`GET /v1/objects/{SHA256}/metadata`	Retrieve metadata and verdicts
Variant Discovery	`GET /v1/objects/{SHA256}/variants`	View related samples
YARA Hunts	`v1/environments/{environment}/yaraRules/{yaraRule}/matchingObjects`	Unlimited live + retro rules
Sightings	`GET /v1/objects/{SHA256}/sightings`	Observe files in your environment
File Download	`GET /v1/objects/{SHA256}:download`	Retrieve binary samples
Search Malware Corpus	`GET /v1/objects/metadata` + CEL	Search across full corpus