Skip to main content
Stairwell can send detection events to any HTTP endpoint that accepts JSON. This makes it easy to route Stairwell alerts into Wirespeed using your existing webhook-capable pipeline. When configured events fire (for example, an AV engine match or a YARA rule hit), Stairwell sends a JSON payload to the webhook URI from Wirespeed.

​
Create an authentication token in Stairwell

  1. Log in at app.stairwell.com
  2. Click the Settings icon in the left menu
  3. Select Auth tokens under the Organization section
  4. Click Generate Token and choose API/CLI token
  5. Give the token a descriptive name (e.g., Wirespeed)
  6. Click Generate and copy the token immediately — it will not be displayed again

​
Find your environment ID in Stairwell

  1. In Settings, select the Environments tab
  2. Your environment ID is displayed on the environment detail page

​
Setup in Wirespeed

  1. Login to Wirespeed and navigate to Integrations > Add Integration > Stairwell
  2. Read this documentation and confirm you have completed the required setup steps
  3. Paste the API token from Stairwell into the API Token field
  4. Paste your Environment ID from Stairwell into the Environment ID field
  5. Click Integrate
  6. Select Webhook Details
  7. Copy the Webhook URL — you’ll use this in Stairwell

​
Configure the webhook in Stairwell

  1. Login to your Stairwell environment
  2. Create or update the event forwarding/webhook configuration for the detections you want to send
  3. Paste the Webhook URL from Wirespeed as the destination endpoint
  4. Save the webhook configuration and trigger a test event if available

​
Optional webhook authentication

To authenticate callbacks, enable Verify Webhook Authenticity on the Stairwell integration and copy its Webhook Secret from Wirespeed’s Webhook Details. Prefer Authorization: Bearer <WEBHOOK_SECRET> wherever the webhook relay can set headers. Stairwell’s native webhook UI accepts a destination URI rather than custom headers. In that case append &webhookSecret=<WEBHOOK_SECRET> as a last resort. The secret then appears in the full request URI, which web servers, reverse proxies, and log collectors often record. Treat a URI-embedded secret as exposed if any intermediary logs query strings, and rotate it if that happens. If authentication is enabled, callbacks without the correct secret are rejected.

​
What Gets Ingested

Wirespeed ingests Stairwell detection events as JSON payloads, including webhook events such as:
  • AV engine matches
  • YARA rule hits
  • Other configured Stairwell detections
The webhook expects the Stairwell trigger-match JSON shape: top-level name, label, createTime, matchType, objectMetadata, objectSightings, and triggerCondition (including optional YARA matches, MalEval, opinions, and threat reports). Each event is normalized into a detection record and made searchable in Wirespeed for investigation and triage.