Thursday, January 19, 2017

Visual link analysis with Splunk (or SQL) and Maltego using the MDS

We're finally ready to release a public beta of the Maltego Data Server (MDS). The MDS is a server that allows you to trivially easy visualize data kept in SQL databases or indexes (such as Splunk) in Maltego - as a graph.

In the most simplest form you only need to write a query (SQL/Splunk) and a tell the MDS how to map the resultant data back to nodes on the graph.

In the most complex form you can write Python code around the query, mapping and nodes as well as use (global) replacement variables anywhere within the items above. With this we mean to say that the MDS can be as easy or as complex as you'd like it to become. The system can grow with your abilities and is very flexible.

With the very basic knowledge of SQL/Splunk and Maltego you can almost immediately get massive insight into the most mundane of logs. With two (basic AF) Splunk-based transforms and three of the standard OSINT transforms that ship with Maltego we can spot fake Googlebots almost instantly in our web server logs:

Keep in mind that the power of the existing Threat Intelligence transforms available in the Transform Hub is at your fingertips - making it possible to enrich your internal data to the max.

If you are interested to test drive the MDS *today* you can simply email us at and we'll send you the server as an OVA to experiment with. You can read the comprehensive documentation for the MDS [here] right now. 

We love to get your feedback on our new project.


PS: the commercial people just told us we should include that we're going to be selling this in future. Don't know why that's important...but ye.

Tuesday, January 17, 2017

Making Buzzfeed's TrumpWorld tables into a Maltego graph

Maltego 4.0.15 is on it's way, and with it a brand new interface for importing data into Maltego. With Buzzfeed's recent data dump of "TrumpWorld" we thought we would have some fun mapping out the data, whilst doing a walk-through of the new Tabular importer.


With just a few easy clicks you can map out hundreds of links and entities. We can see the complex layout of Trump business empire, as well as how his social and business circles overlap.

Maltego provides a wide array of transforms to dig deeper into the information we have here. We'll leave that as an exercise for the reader ;)

Person - Company mapping

Person - Person mapping

Company - Company mapping

Just in case anyone was worried that we were getting too political (we're neutral, like Switzerland), here's a graph of Hillary Clinton's email infrastructure. What's the SSLVPN box by the way? ;)

Try It For Yourself

Here are all the Maltego graphs - feel free to open them in any version of Maltego as long as it starts with a 4.  (including the free (4) CE version!).

Download Graph Files

Maltego 4.0.15's new tabular import (aka how we did it)

Start by clicking "Import Graph from Table" under the "Import|Export" section of the ribbon bar.

Click "Next" and select an Excel or csv file.

In this case we will be using "TrumpWorld Data — Public - Person-Org". Once you have selected your file click "Next".

The Hint at the bottom of the next dialogue explains the different connectivity options. We're going to pick "Sequential" because it's really a A->B mapping, but the other defaults are useful in other situations.

We have to tell Maltego which column represents which type of data. We have chosen to map column 1 to a "Company" entity (we've imported it using the CaseFile entity pack in the Transform Hub) and column 2 to a "Person" entity.

The information in the other two columns we won't be using to make entities, so we set them to "Unmapped".

Under the "Map Columns to Links" tab we can choose to use column 3 as the label for the connection between column 1 and column 2.

We can now see a visual representation of how each row will be imported by going to "Connectivity Graph". We see that a link will be made from the Person to the Company.

The final step is to check that all the settings are correct and click "Next" to import the data into Maltego.

You will then see a summary of what was imported.

Tuesday, January 3, 2017

Short term (Q1 '17) plans for Maltego

Welcome to 2017. It's only the 3rd of January and we're all back at work. I thought I share some of the exciting things happening with Maltego in the short term.

Awesome documentation

Documentation was never our strong suit and so this year we're setting it right and putting a lot of effort into documenting Maltego. We started with the user guide - it's brand new and shiny and available [here].

We're redoing the transform guide on a wiki - so that other transform writers can also document their stuff a little - so far it's looking grand and useful. We're also doing a lot of maintenance on the developer portal to get that up to date. Let it never be said again that our documentation suck!

Maltego Data Server (MDS)

We're almost done with the MDS. It's currently (almost) in beta. If you want to play or get a copy of the user's manual [drop us a line]. Some time ago we've made a [sneak peek video] of the MDS:

The MDS is going to be 'the next big thing'.

Maltego GUI

In the spirit of making Maltego easier to work with your own data we have a two prong attack. We're doing a lot of work in terms of the tabular data import function for local data files. The partial screenshot below should give you a taste of what's coming:

Import speed has been optimized and we now load 200k records in a mere 11 seconds!

For work with big(ish) data in SQL databases and (Splunk/ELK) indexes we have the MDS (see above).

We are also planning to have a unified Maltego installer and lifelong license keys - meaning you can easily upgrade from CE to Classic to XL. It solves a lot of issues from us building new Maltego releases as well as solving a lot of licensing headaches (think renewal, different license keys every year etc. etc.)

Exciting times and more as it happens,