Maltego for AutoFocus Articles

Smart Filtering in Transforms

by tlancaster ‎05-24-2017 07:29 AM - edited ‎06-09-2017 03:59 AM (4,318 Views)


What it is


When using Maltego, it's a delicate balance of getting to the information you need and not cluttering the graph. A cluttered graph leads to confusion and can easily lead users to pivot on entities which simply aren't interesting. The data in AutoFocus is rich, but contains a lot of data which relates to the general operation of Windows, and other unwanted data. To help address this problem our transforms use a filtering system to attempt to alleviate these issues.


How it works


Before entities are returned by our transforms they are checked against various lists of known entities which users are unlikely to want. These include domain names such as '', parking IP address ranges, Dynamic DNS root domains, and much more. 


Whenever entities are filtered, users can see that this has happened by looking at the "Transform Output" window:


Transform Output Example.JPG


You can see the filtering in action in the video below:



If you believe an entity is being wrongly filtered, please file a bug report in the Forum.


The Future


In future releases of our transforms we will enable users to turn off Smart Filtering, but for the first release this feature will be mandatory.