Aperçu
Enriches file, domain, IP, and ASN observables with Stairwell intelligence: MalEval verdicts, AI file triage, YARA matches, variant discovery, sightings, DNS history, and WHOIS.
The Stairwell internal-enrichment connector enriches OpenCTI observables with intelligence from Stairwell's global file corpus and network telemetry. For file observables it adds MalEval verdicts, Stairwell AI File Triage write-ups, file metadata (magic, imphash, TLSH, entropy, YARA matches), variant discovery with 'derived-from' links, and, when enabled, per-asset sightings from the customer's environment. For domain, IP, and autonomous-system observables it adds DNS resolution history, IP intelligence, and WHOIS. Scores are raised monotonically from MalEval verdicts, and enrichment output is written as STIX Notes, relationships, and custom properties.