Work with Threat Reports

Everything you put into a threat report starts matching your files, so getting intelligence into Stairwell is the same action as checking whether you are affected by it. This page covers uploading a report somebody else wrote, creating one of your own, and keeping the indicator list current as an investigation moves. For reading the results, see Threat Reports.

You need write access to the environment you are adding the report to. Everything below happens from the Threat Reports page in the left navigation.

How do I add a report somebody else published?

Use the upload control in the action bar at the top right, which opens the Add threat report dialog on its upload tab.

1. Give it a Name. This is what you and your colleagues will search for, so name it the way your team refers to the campaign rather than the way the vendor titled the PDF.
2. Choose a Report source, the origin of the intelligence.
3. Provide the Content, either by pasting a URL to the file or by choosing a local file. It is one or the other, not both. Accepted formats are .txt, .json, and .stix.
4. Select Upload.

Stairwell reads the indicators out of the content and starts matching them. If the dialog tells you the report already exists, somebody has loaded it: find it in the list rather than making a second copy, because two copies of one report means two match counts to reconcile and two places to silence noise.

Open the report afterwards and check the IOCs tab. If the count is zero, the extraction found nothing usable in the file you gave it, and the fix is usually to create a report by hand from the indicator list at the bottom of the vendor's write-up instead.

How do I create a report of my own?

Use the add control next to the upload control, which opens the same dialog on its create tab. This is the path for an investigation you ran yourself, and for a vendor report whose indicators you would rather paste than parse.

1. Name and Description. Write the description for the colleague who finds this report in eight months with no memory of the incident: what happened, what was established, what is still open.
2. Add IOCs. Paste hashes, hostnames, and IP addresses. They can be mixed together; Stairwell sorts out which is which and tells you how many of each it recognized. Check that number against what you pasted before saving, because a count lower than you expected usually means a malformed line.
3. Sample files, optionally. Attach the actual files if you have them.
4. YARA files, optionally. Attach rules associated with the threat. Invalid rules are reported rather than silently dropped, so read the response. See YARA Rules.
5. Confirm the Environment if you have access to more than one, and select Create.

The report starts matching immediately, in both directions in time. A report you write from today's incident will tell you within minutes whether the same indicators were present on your fleet last year.

This is the durable form for your own conclusions. When an investigation ends, the indicators you established are worth keeping in the same shape the vendor sent theirs in, so they keep matching, so a colleague can pick them up, and so the work does not end its life in a spreadsheet attached to a closed ticket. See Write It Up.

How do I add an indicator to an existing report?

Investigations produce indicators after the report exists, which is the normal case rather than the exception.

Open the report, go to the IOCs tab, and use the add control on the list for the type you are adding: hashes, hostnames, or IP addresses. Enter the indicator, explain in the comment why it is being added, and save. For several at once, use Bulk add indicators to this report in the panel header and paste the lot into the Indicators field with a single comment covering them.

Write the comment properly. An indicator with no rationale is a liability the next time somebody asks why a file matched: the value of the addition is the reasoning, and the reasoning is what nobody can reconstruct later.

Indicators you add are attributed to your team and marked as added, so the report keeps a visible line between what the publisher asserted and what you established. They match exactly like the original ones.

How do I remove an indicator?

Open the report's IOCs tab, right-click the indicator, and choose Remove hash, Remove hostname, or Remove IP. The dialog asks why, and the comment is worth writing for the same reason.

Removal applies to indicators your team added. The indicators a report was published with are not yours to delete.

Reports themselves cannot be deleted from the UI. If you have created one you need removed, contact [email protected].

What if a published indicator is a false positive?

It happens. A report ships an address that turns out to be shared hosting, a hash of a legitimate installer, or a hostname belonging to a vendor everyone uses, and it matches things in your environment that have nothing to do with the campaign.

You can silence the indicator yourself.

Right-click the indicator on either the report's Summary tab or its IOCs tab. Both offer the same menu, so you can silence from wherever you happened to spot the problem.

That opens the Stairwell context menu, the same one that carries Remove hash. Choose Silence hash, Silence hostname, or Silence IP. Select several first to silence them together. The dialog asks which environment the silence applies to, and asks for a comment.

Three properties are worth understanding before you use it.

It stops the matching, not just the alerting. A silenced indicator is removed from the query that produces the report's matches, so files linked only by that indicator stop appearing on the Matches tab. This is different from a trigger silence, which suppresses the notification while leaving the match in place. Reach for a trigger silence when the match is right and the paging is noisy, and for indicator silencing when the indicator itself is wrong.

It is scoped to an environment, the one you pick in the dialog, so silencing an indicator that is noisy on your corporate fleet does not affect a subsidiary's environment subscribed to the same report.

It is reversible. The same right-click menu offers Unsilence hash, Unsilence hostname, and Unsilence IP. Write the comment properly, because the comment is what tells the next person why the indicator was judged wrong rather than merely inconvenient.

YARA rules carried by a report can be silenced the same way.

When to involve support instead

Silencing is per environment and per report, which is the right tool when the indicator is wrong for you. When an indicator is simply wrong, and every environment subscribed to that report will hit the same false positives, contact [email protected], who can silence or remove the indicator from the report itself.

Send the report name, the exact indicator, and an example of what it matched with a sentence on why the match is wrong. That last part is what makes it actionable, because the fix affects everyone subscribed to the report and not only you.

How do I read the Matches tab?

Open the report and go to Matches. Then read in this order, because the order is what keeps you from spending an afternoon on shared hosting.

1. Which indicator linked each file. A hash link is a strong statement about that exact build. A hostname or IP link is often much weaker.
2. The file's rarity. A file on most of your machines is your estate. See Prevalence.
3. The sightings. Which assets, which paths, and when it first arrived. A first-seen date years before the campaign existed is a strong hint that the match is coincidental.
4. The Variants tab. The files that resemble the report's matches are frequently the ones the report did not list, and they are where the actual spread shows up.

For the full sequence on a match that turns out to be your own software, work through The Alert Is a Legitimate IT Tool. For the morning after a report drops, New IOCs Were Published.

What should I read next?

• Share Threat Reports, for getting a report into another environment.
• Threat Reports, for the list, the filters, and how to read a match count.
• Event Notifications, so report matches reach your team instead of waiting to be noticed.