What Is an Opinion?

An opinion is your team's own conclusion about a file, recorded in Stairwell and kept alongside the automated one. You set an opinion when you have decided something the platform could not: that a file it flagged is your own build tooling, or that a file nothing flagged is in fact the intrusion. Inside your environment, the opinion you set takes precedence over the automated verdict. In the API, an opinion is recorded as a verdict on the object.

The vocabulary is fixed: No opinion, Trusted, Benign, Vulnerable, Grayware, Malicious. No opinion is the starting state and means the file is left to automated analysis. Vulnerable records a judgment about a security weakness rather than about intent, which is a different axis from the rest: a library with a known flaw is not malware, and tracking it as though it were would be wrong.

Why do opinions exist?

Because without them, analyst judgment evaporates the moment the analyst closes the tab.

Every security team has a set of files it has already argued about. The remote administration tool the help desk deployed on purpose. The unsigned installer the data team built themselves. The penetration-testing binary from last quarter's exercise. Each of these looks bad by any automated measure, because each is genuinely the kind of thing an attacker would use, and no amount of analysis of the file itself can tell you that yours was authorized. Only your organization knows that, and only for its own environment.

If there is nowhere to record the conclusion, the same file gets triaged again next month by a different analyst who reaches the same answer more slowly, and again the month after that. Worse, it keeps generating alerts, and a team that gets alerted repeatedly about something it has already accepted learns to ignore the alerts, which is the actual failure. The reverse case matters no less: when you determine a file is malicious that nothing else flagged, that conclusion needs to reach everything downstream rather than living in one person's notes.

An opinion is the durable place to put the decision. Setting one is not annotation, it is configuration: it changes the verdict the file displays in your environment, it stops a file you have marked safe from generating notifications, it takes files you have marked Trusted or Benign out of threat report match counts, and it shows up next to that file everywhere it appears, including as a member of somebody else's variant list. You teach the platform once.

There is a hierarchy, and it exists so that global research and local reality do not have to fight. Stairwell's own research can set an opinion that applies as the default everywhere. Your environment's opinion overrides that default, and only within your environment. If Stairwell's researchers call a dual-use tool Grayware and your policy says that tool is prohibited on your fleet, you mark it Malicious, and that is what your team sees. Nobody else's view changes, and the global assessment is not degraded by your local decision.

What do I do with an opinion?

• Close a false positive for good. Mark your own tooling Trusted or Benign. The file stops paging you, and the next analyst sees the conclusion instead of repeating the work.
• Confirm a real threat. Mark a file Malicious when you have established it, so the verdict, the alerting, and every list the file appears on reflect what you know.
• Record the middle ground. Grayware is for software that is not malicious but is unwanted or risky in context, such as adware or a dual-use administration tool.
• Track exposure separately. Vulnerable marks a file that carries a security weakness. Use it for patching and hygiene workflows, where the question is risk rather than intent.
• Write it down where the next person will look. Pair an opinion with a comment. The value of a conclusion is mostly in the reasoning, and six months later the reasoning is the part nobody can reconstruct.
• Alert on changes. A trigger can fire when an opinion changes in an environment, which is how a team of more than one person stays in sync about what has been decided.

Opinions are not restricted to files. Hostnames and IP addresses carry them too, which is how a conclusion about infrastructure becomes as durable as a conclusion about a binary.

Where do I see opinions in Stairwell?

• The object panel's top actions, where the opinion selector sits. This is where you set or change one.
• The verdict shown on the file, which reflects your opinion once you have set one.
• The History section of the object panel, which records each change: who made it, when, which environment it applied to, and what the previous value was. That is the audit trail, and it is what makes an opinion defensible rather than merely convenient.
• The Opinion column in search results and object lists, so you can filter a hunt down to what has and has not been judged.
• The Variants detail pane, which offers Set opinion directly, so judging a cluster does not mean leaving the investigation.
• Threat report match counts, which leave out the files you have marked Trusted or Benign.

What should I read next?

• Verdicts, the automated conclusion an opinion overrides, and how the two combine.
• Opinions for the working detail: setting them through the UI and the API, and how they interact with automated analysis.
• Prevalence, which is usually the evidence behind a Trusted opinion on widely deployed software.