Who to Contact for Support

Urgent, any hour: call 925-238-2444. Round-the-clock phone support.

Everything else: email [email protected], answered during business days.

What counts as urgent?

Use the phone when waiting until tomorrow changes the outcome: an active incident where Stairwell is part of your response, a platform problem blocking that response, or an ingestion outage across a fleet rather than one machine.

Email is right for a question, a single machine misbehaving, a suspected false positive, or anything you would otherwise write a ticket about.

What should I include?

The difference between one reply and four is usually whether the first message carried enough to reproduce or locate the problem.

For anything about a specific file, send the SHA-256 rather than the filename. Filenames live on the sighting rather than the file, so the same object is called different things on different machines and a filename may not identify it at all.

For anything about a specific machine, send the asset identifier. See Asset Identifiers.

For anything about what you can or cannot see, name the environment. Most "why is this missing" questions turn out to be environment scope.

For a notification that did not arrive, send the hash, the trigger name, and roughly when you expected it. Every notification decision is recorded, including suppressions, so support can tell you which gate the alert met. See Event Notifications.

For a noisy threat report indicator, send the report name, the indicator, and one example of what it matched. Support can silence or remove an indicator from a report itself, which is the fix when it is wrong for every subscriber rather than only for you. See Work with Threat Reports.

What can I fix without contacting anyone?

More than most teams expect, and it is worth knowing before you write:

• A noisy indicator in one environment: silence it yourself on the report's IOCs tab.
• A file your team has adjudicated: set an opinion, which overrides the automated verdict inside your environment.
• Alert volume from one legitimate tool: see The Alert Is a Legitimate IT Tool.
• A machine that stopped reporting: What to Check First resolves most cases in minutes.

What should I read next?

• Forwarder Troubleshooting, for machines that are not reporting.
• Managing False Positives, for alert volume.
• Stairwell Platform Access Policy, for who at Stairwell can see your data.