> ## Documentation Index
> Fetch the complete documentation index at: https://docs.wirespeed.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Stairwell

> Ingest Stairwell detection events via JSON webhook

Stairwell can send detection events to any HTTP endpoint that accepts JSON. This makes it easy to route Stairwell alerts into Wirespeed using your existing webhook-capable pipeline.

When configured events fire (for example, an AV engine match or a YARA rule hit), Stairwell sends a JSON payload to the webhook URI from Wirespeed.

## Create an authentication token in Stairwell

1. Log in at [app.stairwell.com](https://app.stairwell.com)
2. Click the **Settings** icon in the left menu
3. Select **Auth tokens** under the **Organization** section
4. Click **Generate Token** and choose **API/CLI token**
5. Give the token a descriptive name (e.g., `Wirespeed`)
6. Click **Generate** and copy the token immediately — it will not be displayed again

## Find your environment ID in Stairwell

1. In **Settings**, select the **Environments** tab
2. Your environment ID is displayed on the environment detail page

## Setup in Wirespeed

1. Login to Wirespeed and navigate to Integrations > [**Add Integration**](https://app.wirespeed.co/settings/integrations?tab=browse) > **Stairwell**
2. Read this documentation and confirm you have completed the required setup steps
3. Paste the **API token** from Stairwell into the **API Token** field
4. Paste your **Environment ID** from Stairwell into the **Environment ID** field
5. Click **Integrate**
6. Select **Webhook Details**
7. Copy the **Webhook URL** — you'll use this in Stairwell

## Configure the webhook in Stairwell

1. Login to your Stairwell environment
2. Create or update the event forwarding/webhook configuration for the detections you want to send
3. Paste the **Webhook URL** from Wirespeed as the destination endpoint
4. Save the webhook configuration and trigger a test event if available

## What Gets Ingested

Wirespeed ingests Stairwell detection events as JSON payloads, including webhook events such as:

* **AV engine matches**
* **YARA rule hits**
* **Other configured Stairwell detections**

The webhook expects the Stairwell trigger-match JSON shape: top-level `name`, `label`, `createTime`, `matchType`, `objectMetadata`, `objectSightings`, and `triggerCondition` (including optional YARA matches, MalEval, opinions, and threat reports).

Each event is normalized into a detection record and made searchable in Wirespeed for investigation and triage.