Your First Fifteen Minutes

Sign in at app.stairwell.com, confirm that files are arriving, then look up one file and read everything Stairwell knows about it. That sequence is the fastest way to understand the platform, because it walks the same path every real investigation takes. If no files are arriving yet, the last section tells you what to do instead.

By the end you will know whether your fleet is reporting, what a file record contains, and whether any published threat report has already matched something in your environment.

What do I need before I start?

• An account, and the ability to sign in. Your organization either federates its own identity provider or uses Stairwell's, and either way someone has already made that choice for you.
• At least one forwarder installed somewhere, or someone who can tell you whether the rollout has started. You can complete most of this page without one, but the interesting parts need real files.
• Nothing installed locally. Everything below happens in the browser.

What should I do first?

1. Check that files are arriving. Open Assets. Each machine running a forwarder appears here with when it registered, when it was last seen, and how far along its initial sweep of existing files is. A machine that registered and has been seen recently is working. A fleet with zero assets means the rollout has not reached you yet, which is the case the last section covers.

2. Notice which environment you are in. Your data is partitioned into environments, and everything you search is scoped to the ones you can read. If your organization runs more than one, knowing which you are looking at prevents the most common early confusion, which is concluding a file is absent when you were looking somewhere else.

3. Look up one file. Open Search and paste a hash. If you do not have one to hand, search for something you expect to be everywhere, such as a common system binary or an installed agent, and open any result. The file detail view is where the rest of this page happens.

4. Read the file record top to bottom. This is the step worth slowing down for, because every instrument in the product shows up here at once:

• The verdict, which is multiple detection engines, machine learning, and analyst opinion resolved into one answer rather than a wall of scanner results to referee.
• Prevalence, which tells you how common the file is in your fleet and across everything Stairwell observes. Read it before anything else on an unknown file. Rare is where the interesting things live.
• Sightings, every machine that ever held this file, what it was named there, and when it first appeared. This is the question your logs stop being able to answer after a month.
• Variants, the files that resemble this one. On a benign system binary this is dull. On malware it is the difference between one indicator and the whole cluster.

5. Check yourself against published intelligence. Open Threat Reports. Subscribing an environment to a report means its hashes, domains, IPs, and rules are matched against everything you have, retroactively as well as going forward. If a report has already matched, you have found something on your first day. If nothing matches, you have learned something worth knowing too, and the subscription keeps working from now on.

6. Record one opinion. If you find a file the automated verdict got wrong in either direction, set an opinion on it. Your team's call overrides the automated verdict wherever it appears, and doing it once is how you learn that the platform can be taught.

How do I know it worked?

• Assets lists your machines, with a recent last-seen time and an initial sweep that is complete or progressing.
• A hash search returns a file, and its detail view shows a verdict, a prevalence reading, and at least one sighting.
• Threat Reports shows the reports your environment is subscribed to, with any matches attributed to the specific indicator that linked them.

What if nothing has arrived yet?

Most likely the forwarder rollout has not started, or has not reached the machines you can see. That is normal on day one and it does not block you.

• Install a forwarder on one machine per operating system before doing anything at scale. The Deploy section covers each platform, and doing one machine first tells you what the common files in your fleet look like before ten thousand endpoints send them.
• Confirm outbound connectivity is allowed and that forwarder traffic is excluded from TLS inspection. This is the single most common reason a forwarder installs successfully and then sends nothing.
• While you wait, you can send a file directly through the web app or the API and follow steps 3 and 4 on it. The record looks the same regardless of how the file arrived.

What should I read next?

• How Stairwell Works, if you skipped it, for why the file record contains what it contains.
• Meet Backstory, when one hash on the file detail view turns into a real investigation.
• The Core Concepts section, which defines every term above in one place, in the order a newcomer needs them.