Transform Descriptions

Printer Friendly Page

The table lists the transforms available in Maltego, the entity type they operate on, what they return, and notes on how each one works logically.

 

Transform Operates On Returns Notes Inbuilt filters (customer view)
AutoFocus - Explode Tags (All) maltego.Hash maltego.Tag Takes a file hash and returns any tags in AutoFocus associated with the file None
AutoFocus - Explode Tags (U42) maltego.Hash maltego.Tag Takes a file hash and returns any Unit42 Scope tags in AutoFocus associated with the file None
AutoFocus - Explode Tags (Malware) maltego.Hash maltego.Tag Takes a file hash and returns any Malware Class tags in AutoFocus associated with the file None
AutoFocus - Explode Tags (Campaign) maltego.Hash maltego.Tag Takes a file hash and returns any Campaign Class tags in AutoFocus associated with the file None
AutoFocus - Explode Tags (Actor) maltego.Hash maltego.Tag Takes a file hash and returns any Actor Class tags in AutoFocus associated with the file None
AutoFocus - Fetch File Metadata maltego.Hash maltego.Hash Takes a file hash and returns metadata about that file back to the same entity None
AutoFocus - Get C2 By Sample maltego.Hash maltego.Domain
maltego.IPv4Address
Takes a file hash and identifies C2 addresses associated with the samples in the DNS Activity and Connection Activity tabs No Private IP addresses included;
Some background noise domains excluded;
AutoFocus - Get Sample by Mutex maltego.Mutex maltego.Hash Takes a mutex and identifies samples whose Mutex Activity contains that Mutex None
AutoFocus - Get Sample by IP maltego.IPv4Address maltego.Hash Takes an IP Address and identifies files whose Connection Activity includes the IP Address None
AutoFocus - Get Sample by Hostname maltego.Domain maltego.Hash Takes a hostname/domain and identifies files whose DNS activity includes the hostname/domain. None
AutoFocus - Get Sample by Query PaloAltoNetworks.AFQuery maltego.Hash Takes a query exported from AutoFocus and retrieves file hashes matching that query None
AutoFocus - Get Sample by Tag PaloAltoNetworks.Tag maltego.Hash Takes a tag (note that tags must include the fullname of the tag) and identifies associated files. None
AutoFocus - Get Sample by URL maltego.URL maltego.Hash Takes a full URL and searches for samples that communicate with that URL (e.g. www.google.com/images.php) None
AutoFocus - Get Sample by URL Path maltego.URL maltego.Hash Takes a full or partial URL and searches for samples that communicate with the PATH component of the URL, e.g. (www.google.com/images.php --> images.php) None
AutoFocus - Get URLS by sample maltego.Hash maltego.URL Takes a file hash and identifies full URLs the malware communicates with None
AutoFocus - Get Mutex By Sample maltego.Hash maltego.Mutex Takes a file hash and identifies associated mutexes Mutexes which appear in more than 5000 samples are tuned out
AutoFocus - Get Service created by Sample maltego.Hash maltego.ServiceName Takes a file hash and identifies created Service Names None
AutoFocus - Get Imphash by Sample maltego.Hash maltego.Imphash Takes a file hash and identifies the associated importhash None
AutoFocus - Get Sample by Imphash maltego.Imphash maltego.Hash Takes an importhash and finds files which have the same importhash None
AutoFocus - Get Sample by Service maltego.ServiceName maltego.Hash Takes a service name and searches for files which include the servicename None
AutoFocus - Get Sample by FileActivity maltego.Filename maltego.Hash Takes a filename and returns files whose File Activity includes the supplied filename None
AutoFocus - Get Sessions by Sample maltego.Hash PaloAltoNetworks.WildfireSession Takes a given file hash and returns sessions observed using the same Hash Sessions with no company data are excluded
AutoFocus - Get Sessions by Query PaloAltoNetworks.AutoFocusQuery PaloAltoNetworks.WildfireSession Takes a given query exported from AutoFocus and returns associated sessions. Sessions with no company data are excluded
AutoFocus - Get Sessions by URL Path maltego.URL PaloAltoNetworks.WildfireSession Takes the supplied URL and returns sessions which whose ITW URL contains the supplied URL. Sessions with no company data are excluded
AutoFocus - Get Sessions by Tag PaloAltoNetworks.Tag PaloAltoNetworks.WildfireSession Takes a supplied tag and returns matching sessions Sessions with no company data are excluded
AutoFocus - Get ITW data as metadata maltego.Hash maltego.Hash Takes a file hash and returns metadata about that file back to the same entity Sessions with no company data are excluded
AutoFocus - Get ITW URLs as entities maltego.Hash maltego.URL Takes a file hash and returns associated ITW URLs back as URL entities None
AutoFocus - Get ITW Host maltego.Hash maltego.Domain
maltego.IPv4Address
Takes a file hash and returns associated ITW URLs back as domain names and IP addresses. No Private IP addresses included;
Some background noise domains excluded;
AutoFocus - Get ITW Filename by Sample maltego.Hash maltego.Filename Takes a file hash and returns associated ITW filenames with it None
AutoFocus - Get Sample by Session PaloAltoNetworks.WildfireSession maltego.Hash Takes a session and returns the File analysed as part of the session Sessions with no company data are excluded
AutoFocus - Get ITW URL by Session PaloAltoNetworks.WildfireSession maltego.URL Takes a session and returns the ITW URL observed as part of the session (if available) Sessions with no company data are excluded
AutoFocus - Get ITW Host by Session PaloAltoNetworks.WildfireSession maltego.Domain
maltego.IPv4Address
Takes a session and returns associated ITW URLs back as domain names and IP addresses. No Private IP addresses included;
Some background noise domains excluded;
AutoFocus - Get ITW Filename by Session PaloAltoNetworks.WildfireSession maltego.Filename Takes a session and returns associated ITW filenames with it None
AutoFocus - Get Sample by ITW Filename maltego.Filename maltego.Hash Takes an ITW filename and returns files seen with the same filename ITW None
AutoFocus - Get Samples by ITW Hostname maltego.Domain maltego.Hash Takes a hostname and finds files that have been spotted with the same hostname ITW None
AutoFocus - Get Samples by ITW IP address maltego.IPv4Address maltego.Hash Takes an IP Address and identifies files that have been spotted with the same hostname ITW None
AutoFocus - Get Samples by ITW URL maltego.URL maltego.Hash Takes a URL and finds files hosted at that URL ITW None
AutoFocus - Get Digtial Signer By Sample maltego.Hash PaloAltoNetworks.DigitalCertificateCN Takes a sample and returns the name of the listed signer (As shown in AutoFocus) None
AutoFocus - Get Sample By Digital Signer PaloAltoNetworks.DigitalCertificateCN maltego.Hash Takes a digital signer and returns samples in AutoFocus whose signer matches the provided one None
Tags (3)
Ask Questions Get Answers Join the Live Community
Version history
Revision #:
5 of 5
Last update:
3 weeks ago
Updated by:
 
Contributors