What Is a Threat Report?

A threat report in Stairwell is a named collection of indicators: file hashes, hostnames, IP addresses, and YARA rule names. Subscribe an environment to a report and Stairwell matches those indicators against the files you have already collected as well as everything that arrives afterward, and can notify you when something links. Reports come from vendors and national CERTs, from Stairwell's own research, and from your own team writing up what they found.

Why do threat reports exist?

Because intelligence almost always arrives as prose with a list at the bottom, and the work of getting from that list to an answer about your own organization is the part nobody has time for.

Consider the ordinary version of the morning after a report is published. Someone copies forty hashes and a handful of domains out of a PDF. They paste the hashes into one console and the domains into another. The endpoint tool answers for the last thirty days, so anything older is invisible. The proxy logs rolled over. Nothing found, which is reported as "we are not affected", when what was actually established is "we are not affected within the windows our tools still remember". Then the same list has to be checked again next week in case something arrives late, and nobody does that, because it is nobody's job twice.

A threat report inverts the arrangement. The list is loaded once and matched continuously, in both directions in time. Matching runs backward across the files you have kept, so a report published today can tell you about a file that has been sitting on three of your servers since last spring, with the assets and paths attached. It runs forward too, so the same list keeps working next month without anyone reopening the PDF. And because the match records which indicator linked the file, you get an answer you can act on rather than a hit you have to reverse-engineer.

There is a second reason, less obvious and equally practical: a report is a container for your own conclusions. When an investigation ends, the indicators you established are worth keeping in the same form the vendor sent theirs in, so that they keep matching, so that a colleague can subscribe to them, and so that the work does not live in a spreadsheet attached to a closed ticket.

What counts as a match?

A match is a file in your environment that is associated with one of the report's indicators: a hash, a hostname, an IP address, or a YARA rule.

Two properties of that definition are worth knowing before you read a match count.

Filenames are not indicators. Stairwell used to surface corpus files that shared a filename with a report and deliberately stopped, because filename matching produced phantom matches. In the case that ended the practice, a report showed seven matches in a customer environment while none of the report's hashes matched a file there at all. All seven were files sharing two filenames with the report, and both filenames belonged to legitimate libraries that the malware in question impersonated. Two of the seven were first seen years before the campaign existed. A filename is something an attacker chooses precisely because it looks innocent, so it is not evidence, and it is not treated as evidence.

Your own conclusions are respected. Files your team has marked Trusted or Benign are left out of the match count, though they still appear in the results list so you can see them. Known-noisy infrastructure, such as content delivery networks and public resolvers, is suppressed up front, so subscribing to a report about a campaign that used a popular hosting provider does not bury you in matches on the provider.

What do I do with a threat report?

• Subscribe the environments that should be covered. Coverage is per environment, which is how a service provider can run one report across many customers without mixing their data.
• Read the Matches tab first, then the linking indicator. A file linked by a hash is a much stronger statement than a file linked by an IP address that also happens to host ten thousand unrelated domains.
• Pivot from a match rather than closing it. A matched file has variants, a rarity figure, and sightings. The report told you a file is interesting; those tell you how far it went.
• Write your own. Add indicators to a report as an investigation produces them, so the conclusions keep matching after the incident closes.
• Tune the noise precisely. An indicator that matches legitimate software in your environment can be marked safe locally, or silenced for a specific report, without turning off coverage everywhere else. Do that instead of unsubscribing.
• Turn matches into alerts. Configure a trigger so a report match reaches your team through email or a webhook, rather than waiting to be noticed in the UI.

Where do I see threat reports in Stairwell?

• The Threat Reports page, which lists the reports available to you and the ones your environments subscribe to.
• The report panel, whose tabs are Summary, Matches, IOCs, Variants, and YARA. Matches and IOCs carry counts. Variants lists files related to the report's matches, and YARA lists the rules associated with the report.
• Your notifications, when a report match satisfies a configured trigger.
• Upload and indicator dialogs, for adding a report of your own or extending an existing one with indicators you have established.

What should I read next?

• Variants, because the files a report did not list are usually the ones you most need.
• Prevalence, the fastest way to tell a real match from a match on popular software.
• Threat reports for the working procedures: subscribing, uploading, editing, and sharing.