-
Product
ProductThe first AI investigator built on evidence: every executable, kept forever, continuously re-examined.
Take a Virtual Tour
Book a Demo
-
Use Cases
Use CasesSee how security teams actually use Stairwell, and what changes when every file is still there to search.
Take a Virtual Tour
Book a Demo
-
Why Stairwell
Why StairwellStairwell preserves the files behind your alerts. Backstory analyzes the threat, finds related variants, maps the affected systems, and returns the evidence and remediation guidance your team needs to close the case.
Take a Virtual Tour
Book a Demo
- Resources
- Partners
Take a Virtual Tour
Book a Demo
EVIDENCE IN. ACTION OUT.
CONNECT THE INVESTIGATION TO THE TOOLS YOU ALREADY USE.
Bring alerts and suspicious files into Stairwell. Return Backstory verdicts, related variants, affected hosts, Rehunt matches, and remediation guidance to the tools your team already uses.
Stairwell works with the existing security stack, so analysts can investigate from preserved file evidence without creating another disconnected workflow.
How integrations work
Bring the evidence
in
Collect the file behind an EDR alert, ingest campaign intelligence, or submit an artifact directly. Stairwell preserves it in your dedicated environment.
Investigate
the alert
Backstory returns the full case: verdict, related files, affected hosts, attack stages, and remediation steps.
Rehunt
the history
New intelligence runs across the files already collected and sends newly relevant matches back into the workflow.
Put the answer
into action
Deliver reports, notifications, and remediation steps through SIEM, SOAR, case management, chat, webhook, and API workflows.
INTEGRATIONS
DIRECTORY
Enrich Google SecOps investigations with Stairwell verdicts, Backstory cases, and file intelligence.
Send suspicious files and EDR context to Stairwell for independent investigation.
Investigate the files behind SentinelOne alerts and return evidence-backed context to the SOC workflow.
Enrich Splunk events with Stairwell verdicts, investigation context, and Rehunt matches.
Use Stairwell evidence and remediation steps inside automated Cortex workflows.
Automate file submission, Backstory investigations, notifications, and response workflows with Tines templates.
Deliver Stairwell notifications and case updates to the channels where teams coordinate.
Move Stairwell findings into open-source incident management and case workflows.
Connect Stairwell investigations with Wirespeed MDR workflows over HTTPS.
Find and copy hashes from web pages for fast lookup and investigation.
Purchase and deploy Stairwell through Google Cloud Marketplace.
APIs and
DOCUMENTATION
Public
API
Submit evidence, enrich existing data, and bring Stairwell results into custom workflows.
GET STARTED
Webhooks
API
Push Stairwell event notifications to any platform that accepts webhooks.
GET STARTED
Stairwell
Documentation
Access implementation guidance, integration instructions, and API references.
GET STARTED
Stairwell
GitHub
Use Stairwell-maintained repositories and resources to extend your integrations.
GET STARTED
