article Transform Descriptions in Maltego for AutoFocus Articles

article Transform Descriptions in Maltego for AutoFocus Articles https://live.paloaltonetworks.com/t5/maltego-for-autofocus-articles/transform-descriptions/ta-p/157012 <P>The table lists the transforms available in Maltego, the entity type they operate on, what they return, and notes on how each one works logically.</P> <P> </P> <TABLE class="confluenceTable"><COLGROUP><COL /><COL /><COL /><COL /><COL /><COL /></COLGROUP> <TBODY> <TR> <TD class="confluenceTd" style="width: 86px;"><STRONG>Transform</STRONG></TD> <TD class="confluenceTd" style="width: 271px;"><STRONG>Operates On</STRONG></TD> <TD class="confluenceTd" style="width: 271px;"><STRONG>Returns</STRONG></TD> <TD class="confluenceTd" style="width: 215px;"><STRONG>Notes</STRONG></TD> <TD class="confluenceTd" style="width: 90px;">Inbuilt filters (customer view)</TD> </TR> <TR> <TD class="confluenceTd" style="width: 86px;">AutoFocus - Explode Tags (All)</TD> <TD class="confluenceTd" style="width: 271px;">maltego.Hash</TD> <TD class="confluenceTd" style="width: 271px;">maltego.Tag</TD> <TD class="confluenceTd" style="width: 215px;">Takes a file hash and returns any tags in AutoFocus associated with the file</TD> <TD class="confluenceTd" style="width: 90px;">None</TD> </TR> <TR> <TD class="confluenceTd" style="width: 86px;">AutoFocus - Explode Tags (U42)</TD> <TD class="confluenceTd" style="width: 271px;">maltego.Hash</TD> <TD class="confluenceTd" style="width: 271px;">maltego.Tag</TD> <TD class="confluenceTd" style="width: 215px;">Takes a file hash and returns any Unit42 Scope tags in AutoFocus associated with the file</TD> <TD class="confluenceTd" style="width: 90px;">None</TD> </TR> <TR> <TD class="confluenceTd" style="width: 86px;">AutoFocus - Explode Tags (Malware)</TD> <TD class="confluenceTd" style="width: 271px;">maltego.Hash</TD> <TD class="confluenceTd" style="width: 271px;">maltego.Tag</TD> <TD class="confluenceTd" style="width: 215px;">Takes a file hash and returns any Malware Class tags in AutoFocus associated with the file</TD> <TD class="confluenceTd" style="width: 90px;">None</TD> </TR> <TR> <TD class="confluenceTd" style="width: 86px;">AutoFocus - Explode Tags (Campaign)</TD> <TD class="confluenceTd" style="width: 271px;">maltego.Hash</TD> <TD class="confluenceTd" style="width: 271px;">maltego.Tag</TD> <TD class="confluenceTd" style="width: 215px;">Takes a file hash and returns any Campaign Class tags in AutoFocus associated with the file</TD> <TD class="confluenceTd" style="width: 90px;">None</TD> </TR> <TR> <TD class="confluenceTd" style="width: 86px;">AutoFocus - Explode Tags (Actor)</TD> <TD class="confluenceTd" style="width: 271px;">maltego.Hash</TD> <TD class="confluenceTd" style="width: 271px;">maltego.Tag</TD> <TD class="confluenceTd" style="width: 215px;">Takes a file hash and returns any Actor Class tags in AutoFocus associated with the file</TD> <TD class="confluenceTd" style="width: 90px;">None</TD> </TR> <TR> <TD class="confluenceTd" style="width: 86px;">AutoFocus - Fetch File Metadata</TD> <TD class="confluenceTd" style="width: 271px;">maltego.Hash</TD> <TD class="confluenceTd" style="width: 271px;">maltego.Hash</TD> <TD class="confluenceTd" style="width: 215px;">Takes a file hash and returns metadata about that file back to the same entity</TD> <TD class="confluenceTd" style="width: 90px;">None</TD> </TR> <TR> <TD class="confluenceTd" style="width: 86px;">AutoFocus - Get C2 By Sample</TD> <TD class="confluenceTd" style="width: 271px;">maltego.Hash</TD> <TD class="confluenceTd" style="width: 271px;">maltego.Domain<BR />maltego.IPv4Address</TD> <TD class="confluenceTd" style="width: 215px;">Takes a file hash and identifies C2 addresses associated with the samples in the DNS Activity and Connection Activity tabs</TD> <TD class="confluenceTd" style="width: 90px;">No Private IP addresses included;<BR />Some background noise domains excluded;</TD> </TR> <TR> <TD class="confluenceTd" style="width: 86px;">AutoFocus - Get Sample by Mutex</TD> <TD class="confluenceTd" style="width: 271px;">maltego.Mutex</TD> <TD class="confluenceTd" style="width: 271px;">maltego.Hash</TD> <TD class="confluenceTd" style="width: 215px;">Takes a mutex and identifies samples whose Mutex Activity contains that Mutex</TD> <TD class="confluenceTd" style="width: 90px;">None</TD> </TR> <TR> <TD class="confluenceTd" style="width: 86px;">AutoFocus - Get Sample by IP</TD> <TD class="confluenceTd" style="width: 271px;">maltego.IPv4Address</TD> <TD class="confluenceTd" style="width: 271px;">maltego.Hash</TD> <TD class="confluenceTd" style="width: 215px;">Takes an IP Address and identifies files whose Connection Activity includes the IP Address</TD> <TD class="confluenceTd" style="width: 90px;">None</TD> </TR> <TR> <TD class="confluenceTd" style="width: 86px;">AutoFocus - Get Sample by Hostname</TD> <TD class="confluenceTd" style="width: 271px;">maltego.Domain</TD> <TD class="confluenceTd" style="width: 271px;">maltego.Hash</TD> <TD class="confluenceTd" style="width: 215px;">Takes a hostname/domain and identifies files whose DNS activity includes the hostname/domain.</TD> <TD class="confluenceTd" style="width: 90px;">None</TD> </TR> <TR> <TD class="confluenceTd" style="width: 86px;">AutoFocus - Get Sample by Query</TD> <TD class="confluenceTd" style="width: 271px;">PaloAltoNetworks.AFQuery</TD> <TD class="confluenceTd" style="width: 271px;">maltego.Hash</TD> <TD class="confluenceTd" style="width: 215px;">Takes a query exported from AutoFocus and retrieves file hashes matching that query</TD> <TD class="confluenceTd" style="width: 90px;">None</TD> </TR> <TR> <TD class="confluenceTd" style="width: 86px;">AutoFocus - Get Sample by Tag</TD> <TD class="confluenceTd" style="width: 271px;">PaloAltoNetworks.Tag</TD> <TD class="confluenceTd" style="width: 271px;">maltego.Hash</TD> <TD class="confluenceTd" style="width: 215px;">Takes a tag (note that tags must include the fullname of the tag) and identifies associated files.</TD> <TD class="confluenceTd" style="width: 90px;">None</TD> </TR> <TR> <TD class="confluenceTd" style="width: 86px;">AutoFocus - Get Sample by URL</TD> <TD class="confluenceTd" style="width: 271px;">maltego.URL</TD> <TD class="confluenceTd" style="width: 271px;">maltego.Hash</TD> <TD class="confluenceTd" style="width: 215px;">Takes a full URL and searches for samples that communicate with that URL (e.g. <A class="external-link" href="http://www.google.com/images.php" target="_blank" rel="nofollow noopener" data-ext-link-init="true">www.google.com/images.php</A>)</TD> <TD class="confluenceTd" style="width: 90px;">None</TD> </TR> <TR> <TD class="confluenceTd" style="width: 86px;">AutoFocus - Get Sample by URL Path</TD> <TD class="confluenceTd" style="width: 271px;">maltego.URL</TD> <TD class="confluenceTd" style="width: 271px;">maltego.Hash</TD> <TD class="confluenceTd" style="width: 215px;">Takes a full or partial URL and searches for samples that communicate with the PATH component of the URL, e.g. (<A class="external-link" href="http://www.google.com/images.php" target="_blank" rel="nofollow noopener" data-ext-link-init="true">www.google.com/images.php</A> --> images.php)</TD> <TD class="confluenceTd" style="width: 90px;">None</TD> </TR> <TR> <TD class="confluenceTd" style="width: 86px;">AutoFocus - Get URLS by sample</TD> <TD class="confluenceTd" style="width: 271px;">maltego.Hash</TD> <TD class="confluenceTd" style="width: 271px;">maltego.URL</TD> <TD class="confluenceTd" style="width: 215px;">Takes a file hash and identifies full URLs the malware communicates with</TD> <TD class="confluenceTd" style="width: 90px;">None</TD> </TR> <TR> <TD class="confluenceTd" style="width: 86px;">AutoFocus - Get Mutex By Sample</TD> <TD class="confluenceTd" style="width: 271px;">maltego.Hash</TD> <TD class="confluenceTd" style="width: 271px;">maltego.Mutex</TD> <TD class="confluenceTd" style="width: 215px;">Takes a file hash and identifies associated mutexes</TD> <TD class="confluenceTd" style="width: 90px;">Mutexes which appear in more than 5000 samples are tuned out</TD> </TR> <TR> <TD class="confluenceTd" style="width: 86px;">AutoFocus - Get Service created by Sample</TD> <TD class="confluenceTd" style="width: 271px;">maltego.Hash</TD> <TD class="confluenceTd" style="width: 271px;">maltego.ServiceName</TD> <TD class="confluenceTd" style="width: 215px;">Takes a file hash and identifies created Service Names</TD> <TD class="confluenceTd" style="width: 90px;">None</TD> </TR> <TR> <TD class="confluenceTd" style="width: 86px;">AutoFocus - Get Imphash by Sample</TD> <TD class="confluenceTd" style="width: 271px;">maltego.Hash</TD> <TD class="confluenceTd" style="width: 271px;">maltego.Imphash</TD> <TD class="confluenceTd" style="width: 215px;">Takes a file hash and identifies the associated importhash</TD> <TD class="confluenceTd" style="width: 90px;">None</TD> </TR> <TR> <TD class="confluenceTd" style="width: 86px;">AutoFocus - Get Sample by Imphash</TD> <TD class="confluenceTd" style="width: 271px;">maltego.Imphash</TD> <TD class="confluenceTd" style="width: 271px;">maltego.Hash</TD> <TD class="confluenceTd" style="width: 215px;">Takes an importhash and finds files which have the same importhash</TD> <TD class="confluenceTd" style="width: 90px;">None</TD> </TR> <TR> <TD class="confluenceTd" style="width: 86px;">AutoFocus - Get Sample by Service</TD> <TD class="confluenceTd" style="width: 271px;">maltego.ServiceName</TD> <TD class="confluenceTd" style="width: 271px;">maltego.Hash</TD> <TD class="confluenceTd" style="width: 215px;">Takes a service name and searches for files which include the servicename</TD> <TD class="confluenceTd" style="width: 90px;">None</TD> </TR> <TR> <TD class="confluenceTd" style="width: 86px;">AutoFocus - Get Sample by FileActivity</TD> <TD class="confluenceTd" style="width: 271px;">maltego.Filename</TD> <TD class="confluenceTd" style="width: 271px;">maltego.Hash</TD> <TD class="confluenceTd" style="width: 215px;">Takes a filename and returns files whose File Activity includes the supplied filename</TD> <TD class="confluenceTd" style="width: 90px;">None</TD> </TR> <TR> <TD class="confluenceTd" style="width: 86px;">AutoFocus - Get Sessions by Sample</TD> <TD class="confluenceTd" style="width: 271px;">maltego.Hash</TD> <TD class="confluenceTd" style="width: 271px;">PaloAltoNetworks.WildfireSession</TD> <TD class="confluenceTd" style="width: 215px;">Takes a given file hash and returns sessions observed using the same Hash</TD> <TD class="confluenceTd" style="width: 90px;">Sessions with no company data are excluded</TD> </TR> <TR> <TD class="confluenceTd" style="width: 86px;">AutoFocus - Get Sessions by Query</TD> <TD class="confluenceTd" style="width: 271px;">PaloAltoNetworks.AutoFocusQuery</TD> <TD class="confluenceTd" style="width: 271px;">PaloAltoNetworks.WildfireSession</TD> <TD class="confluenceTd" style="width: 215px;">Takes a given query exported from AutoFocus and returns associated sessions.</TD> <TD class="confluenceTd" style="width: 90px;">Sessions with no company data are excluded</TD> </TR> <TR> <TD class="confluenceTd" style="width: 86px;">AutoFocus - Get Sessions by URL Path</TD> <TD class="confluenceTd" style="width: 271px;">maltego.URL</TD> <TD class="confluenceTd" style="width: 271px;">PaloAltoNetworks.WildfireSession</TD> <TD class="confluenceTd" style="width: 215px;">Takes the supplied URL and returns sessions which whose ITW URL contains the supplied URL.</TD> <TD class="confluenceTd" style="width: 90px;">Sessions with no company data are excluded</TD> </TR> <TR> <TD class="confluenceTd" style="width: 86px;">AutoFocus - Get Sessions by Tag</TD> <TD class="confluenceTd" style="width: 271px;">PaloAltoNetworks.Tag</TD> <TD class="confluenceTd" style="width: 271px;">PaloAltoNetworks.WildfireSession</TD> <TD class="confluenceTd" style="width: 215px;">Takes a supplied tag and returns matching sessions</TD> <TD class="confluenceTd" style="width: 90px;">Sessions with no company data are excluded</TD> </TR> <TR> <TD class="confluenceTd" style="width: 86px;">AutoFocus - Get ITW data as metadata</TD> <TD class="confluenceTd" style="width: 271px;">maltego.Hash</TD> <TD class="confluenceTd" style="width: 271px;">maltego.Hash</TD> <TD class="confluenceTd" style="width: 215px;">Takes a file hash and returns metadata about that file back to the same entity</TD> <TD class="confluenceTd" style="width: 90px;">Sessions with no company data are excluded</TD> </TR> <TR> <TD class="confluenceTd" style="width: 86px;">AutoFocus - Get ITW URLs as entities</TD> <TD class="confluenceTd" style="width: 271px;">maltego.Hash</TD> <TD class="confluenceTd" style="width: 271px;">maltego.URL</TD> <TD class="confluenceTd" style="width: 215px;">Takes a file hash and returns associated ITW URLs back as URL entities</TD> <TD class="confluenceTd" style="width: 90px;">None</TD> </TR> <TR> <TD class="confluenceTd" style="width: 86px;">AutoFocus - Get ITW Host</TD> <TD class="confluenceTd" style="width: 271px;">maltego.Hash</TD> <TD class="confluenceTd" style="width: 271px;">maltego.Domain<BR />maltego.IPv4Address</TD> <TD class="confluenceTd" style="width: 215px;">Takes a file hash and returns associated ITW URLs back as domain names and IP addresses.</TD> <TD class="confluenceTd" style="width: 90px;">No Private IP addresses included;<BR />Some background noise domains excluded;</TD> </TR> <TR> <TD class="confluenceTd" style="width: 86px;">AutoFocus - Get ITW Filename by Sample</TD> <TD class="confluenceTd" style="width: 271px;">maltego.Hash</TD> <TD class="confluenceTd" style="width: 271px;">maltego.Filename</TD> <TD class="confluenceTd" style="width: 215px;">Takes a file hash and returns associated ITW filenames with it</TD> <TD class="confluenceTd" style="width: 90px;">None</TD> </TR> <TR> <TD class="confluenceTd" style="width: 86px;">AutoFocus - Get Sample by Session</TD> <TD class="confluenceTd" style="width: 271px;">PaloAltoNetworks.WildfireSession</TD> <TD class="confluenceTd" style="width: 271px;">maltego.Hash</TD> <TD class="confluenceTd" style="width: 215px;">Takes a session and returns the File analysed as part of the session</TD> <TD class="confluenceTd" style="width: 90px;">Sessions with no company data are excluded</TD> </TR> <TR> <TD class="confluenceTd" style="width: 86px;">AutoFocus - Get ITW URL by Session</TD> <TD class="confluenceTd" style="width: 271px;">PaloAltoNetworks.WildfireSession</TD> <TD class="confluenceTd" style="width: 271px;">maltego.URL</TD> <TD class="confluenceTd" style="width: 215px;">Takes a session and returns the ITW URL observed as part of the session (if available)</TD> <TD class="confluenceTd" style="width: 90px;">Sessions with no company data are excluded</TD> </TR> <TR> <TD class="confluenceTd" style="width: 86px;">AutoFocus - Get ITW Host by Session</TD> <TD class="confluenceTd" style="width: 271px;">PaloAltoNetworks.WildfireSession</TD> <TD class="confluenceTd" style="width: 271px;">maltego.Domain<BR />maltego.IPv4Address</TD> <TD class="confluenceTd" style="width: 215px;">Takes a session and returns associated ITW URLs back as domain names and IP addresses.</TD> <TD class="confluenceTd" style="width: 90px;">No Private IP addresses included;<BR />Some background noise domains excluded;</TD> </TR> <TR> <TD class="confluenceTd" style="width: 86px;">AutoFocus - Get ITW Filename by Session</TD> <TD class="confluenceTd" style="width: 271px;">PaloAltoNetworks.WildfireSession</TD> <TD class="confluenceTd" style="width: 271px;">maltego.Filename</TD> <TD class="confluenceTd" style="width: 215px;">Takes a session and returns associated ITW filenames with it</TD> <TD class="confluenceTd" style="width: 90px;">None</TD> </TR> <TR> <TD class="confluenceTd" style="width: 86px;">AutoFocus - Get Sample by ITW Filename</TD> <TD class="confluenceTd" style="width: 271px;">maltego.Filename</TD> <TD class="confluenceTd" style="width: 271px;">maltego.Hash</TD> <TD class="confluenceTd" style="width: 215px;">Takes an ITW filename and returns files seen with the same filename ITW</TD> <TD class="confluenceTd" style="width: 90px;">None</TD> </TR> <TR> <TD colspan="1" class="confluenceTd" style="width: 86px;">AutoFocus - Get Samples by ITW Hostname</TD> <TD colspan="1" class="confluenceTd" style="width: 271px;">maltego.Domain</TD> <TD colspan="1" class="confluenceTd" style="width: 271px;">maltego.Hash</TD> <TD colspan="1" class="confluenceTd" style="width: 215px;">Takes a hostname and finds files that have been spotted with the same hostname ITW</TD> <TD colspan="1" class="confluenceTd" style="width: 90px;">None</TD> </TR> <TR> <TD colspan="1" class="confluenceTd" style="width: 86px;">AutoFocus - Get Samples by ITW IP address</TD> <TD colspan="1" class="confluenceTd" style="width: 271px;">maltego.IPv4Address</TD> <TD colspan="1" class="confluenceTd" style="width: 271px;">maltego.Hash</TD> <TD colspan="1" class="confluenceTd" style="width: 215px;">Takes an IP Address and identifies files that have been spotted with the same hostname ITW</TD> <TD colspan="1" class="confluenceTd" style="width: 90px;">None</TD> </TR> <TR> <TD colspan="1" class="confluenceTd" style="width: 86px;">AutoFocus - Get Samples by ITW URL</TD> <TD colspan="1" class="confluenceTd" style="width: 271px;">maltego.URL</TD> <TD colspan="1" class="confluenceTd" style="width: 271px;">maltego.Hash</TD> <TD colspan="1" class="confluenceTd" style="width: 215px;">Takes a URL and finds files hosted at that URL ITW</TD> <TD colspan="1" class="confluenceTd" style="width: 90px;">None</TD> </TR> <TR> <TD colspan="1" class="confluenceTd" style="width: 86px;">AutoFocus - Get Digtial Signer By Sample</TD> <TD colspan="1" class="confluenceTd" style="width: 271px;">maltego.Hash</TD> <TD colspan="1" class="confluenceTd" style="width: 271px;">PaloAltoNetworks.DigitalCertificateCN</TD> <TD colspan="1" class="confluenceTd" style="width: 215px;">Takes a sample and returns the name of the listed signer (As shown in AutoFocus)</TD> <TD colspan="1" class="confluenceTd" style="width: 90px;">None</TD> </TR> <TR> <TD colspan="1" class="confluenceTd" style="width: 86px;">AutoFocus - Get Sample By Digital Signer</TD> <TD colspan="1" class="confluenceTd" style="width: 271px;"><SPAN>PaloAltoNetworks.DigitalCertificateCN</SPAN></TD> <TD colspan="1" class="confluenceTd" style="width: 271px;">maltego.Hash</TD> <TD colspan="1" class="confluenceTd" style="width: 215px;">Takes a digital signer and returns samples in AutoFocus whose signer matches the provided one</TD> <TD colspan="1" class="confluenceTd" style="width: 90px;">None</TD> </TR> </TBODY> </TABLE> Thu, 24 Oct 2019 15:51:30 GMT tlancaster 2019-10-24T15:51:30Z Transform Descriptions https://live.paloaltonetworks.com/t5/maltego-for-autofocus-articles/transform-descriptions/ta-p/157012 <P>Learn about the different transforms available in Maltego to interact with AutoFocus data</P> Thu, 24 Oct 2019 15:51:30 GMT https://live.paloaltonetworks.com/t5/maltego-for-autofocus-articles/transform-descriptions/ta-p/157012 tlancaster 2019-10-24T15:51:30Z