Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.wirespeed.co/llms.txt

Use this file to discover all available pages before exploring further.

Stairwell can send detection events to any HTTP endpoint that accepts JSON. This makes it easy to route Stairwell alerts into Wirespeed using your existing webhook-capable pipeline. When configured events fire (for example, an AV engine match or a YARA rule hit), Stairwell sends a JSON payload to the webhook URI from Wirespeed.

​
Create an authentication token in Stairwell

  1. Log in at app.stairwell.com
  2. Click the Settings icon in the left menu
  3. Select Auth tokens under the Organization section
  4. Click Generate Token and choose API/CLI token
  5. Give the token a descriptive name (e.g., Wirespeed)
  6. Click Generate and copy the token immediately — it will not be displayed again

​
Find your environment ID in Stairwell

  1. In Settings, select the Environments tab
  2. Your environment ID is displayed on the environment detail page

​
Setup in Wirespeed

  1. Login to Wirespeed and navigate to Integrations > Add Integration > Stairwell
  2. Read this documentation and confirm you have completed the required setup steps
  3. Paste the API token from Stairwell into the API Token field
  4. Paste your Environment ID from Stairwell into the Environment ID field
  5. Click Integrate
  6. Select Webhook Details
  7. Copy the Webhook URL — you’ll use this in Stairwell

​
Configure the webhook in Stairwell

  1. Login to your Stairwell environment
  2. Create or update the event forwarding/webhook configuration for the detections you want to send
  3. Paste the Webhook URL from Wirespeed as the destination endpoint
  4. Save the webhook configuration and trigger a test event if available

​
What Gets Ingested

Wirespeed ingests Stairwell detection events as JSON payloads, including webhook events such as:
  • AV engine matches
  • YARA rule hits
  • Other configured Stairwell detections
The webhook expects the Stairwell trigger-match JSON shape: top-level name, label, createTime, matchType, objectMetadata, objectSightings, and triggerCondition (including optional YARA matches, MalEval, opinions, and threat reports). Each event is normalized into a detection record and made searchable in Wirespeed for investigation and triage.