Skip to main content
Stairwell can send detection events to any HTTP endpoint that accepts JSON. This makes it easy to route Stairwell alerts into Wirespeed using your existing webhook-capable pipeline. When configured events fire (for example, an AV engine match or a YARA rule hit), Stairwell sends a JSON payload to the webhook URI from Wirespeed.

​
Setup in Wirespeed

  1. Login to Wirespeed and navigate to Integrations > Add Integration > Stairwell
  2. Read this documentation and confirm you have completed the required setup steps
  3. Click Integrate
  4. Select Webhook Details
  5. Copy the Webhook URL — you’ll use this in Stairwell

​
Setup in Stairwell

  1. Login to your Stairwell environment
  2. Create or update the event forwarding/webhook configuration for the detections you want to send
  3. Paste the Webhook URL from Wirespeed as the destination endpoint
  4. Save the webhook configuration and trigger a test event if available

​
What Gets Ingested

Wirespeed ingests Stairwell detection events as JSON payloads, including webhook events such as:
  • AV engine matches
  • YARA rule hits
  • Other configured Stairwell detections
The webhook expects the Stairwell trigger-match JSON shape: top-level name, label, createTime, matchType, objectMetadata, objectSightings, and triggerCondition (including optional YARA matches, MalEval, opinions, and threat reports). Each event is normalized into a detection record and made searchable in Wirespeed for investigation and triage.