> ## Documentation Index
> Fetch the complete documentation index at: https://docs.wirespeed.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Stairwell

> Ingest Stairwell detection events via JSON webhook

Stairwell can send detection events to any HTTP endpoint that accepts JSON. This makes it easy to route Stairwell alerts into Wirespeed using your existing webhook-capable pipeline.

When configured events fire (for example, an AV engine match or a YARA rule hit), Stairwell sends a JSON payload to the webhook URI from Wirespeed.

## Create an authentication token in Stairwell

1. Log in at [app.stairwell.com](https://app.stairwell.com)
2. Click the **Settings** icon in the left menu
3. Select **Auth tokens** under the **Organization** section
4. Click **Generate Token** and choose **API/CLI token**
5. Give the token a descriptive name (e.g., `Wirespeed`)
6. Click **Generate** and copy the token immediately — it will not be displayed again

## Find your environment ID in Stairwell

1. In **Settings**, select the **Environments** tab
2. Your environment ID is displayed on the environment detail page

## Setup in Wirespeed

1. Login to Wirespeed and navigate to Integrations > [**Add Integration**](https://app.wirespeed.co/settings/integrations?tab=browse) > **Stairwell**
2. Read this documentation and confirm you have completed the required setup steps
3. Paste the **API token** from Stairwell into the **API Token** field
4. Paste your **Environment ID** from Stairwell into the **Environment ID** field
5. Click **Integrate**
6. Select **Webhook Details**
7. Copy the **Webhook URL** — you'll use this in Stairwell

## Configure the webhook in Stairwell

1. Login to your Stairwell environment
2. Create or update the event forwarding/webhook configuration for the detections you want to send
3. Paste the **Webhook URL** from Wirespeed as the destination endpoint
4. Save the webhook configuration and trigger a test event if available

### Optional webhook authentication

To authenticate callbacks, enable **Verify Webhook Authenticity** on the Stairwell integration and copy its **Webhook Secret** from Wirespeed's Webhook Details.

Prefer `Authorization: Bearer <WEBHOOK_SECRET>` wherever the webhook relay can set headers.

Stairwell's native webhook UI accepts a destination URI rather than custom headers. In that case append `&webhookSecret=<WEBHOOK_SECRET>` as a last resort. The secret then appears in the full request URI, which web servers, reverse proxies, and log collectors often record. Treat a URI-embedded secret as exposed if any intermediary logs query strings, and rotate it if that happens.

If authentication is enabled, callbacks without the correct secret are rejected.

## What Gets Ingested

Wirespeed ingests Stairwell detection events as JSON payloads, including webhook events such as:

* **AV engine matches**
* **YARA rule hits**
* **Other configured Stairwell detections**

The webhook expects the Stairwell trigger-match JSON shape: top-level `name`, `label`, `createTime`, `matchType`, `objectMetadata`, `objectSightings`, and `triggerCondition` (including optional YARA matches, MalEval, opinions, and threat reports).

Each event is normalized into a detection record and made searchable in Wirespeed for investigation and triage.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.