Transform Descriptions

[tlancaster]

The table lists the transforms available in Maltego, the entity type they operate on, what they return, and notes on how each one works logically.

Transform	Operates On	Returns	Notes	Inbuilt filters (customer view)
AutoFocus - Explode Tags (All)	maltego.Hash	maltego.Tag	Takes a file hash and returns any tags in AutoFocus associated with the file	None
AutoFocus - Explode Tags (U42)	maltego.Hash	maltego.Tag	Takes a file hash and returns any Unit42 Scope tags in AutoFocus associated with the file	None
AutoFocus - Explode Tags (Malware)	maltego.Hash	maltego.Tag	Takes a file hash and returns any Malware Class tags in AutoFocus associated with the file	None
AutoFocus - Explode Tags (Campaign)	maltego.Hash	maltego.Tag	Takes a file hash and returns any Campaign Class tags in AutoFocus associated with the file	None
AutoFocus - Explode Tags (Actor)	maltego.Hash	maltego.Tag	Takes a file hash and returns any Actor Class tags in AutoFocus associated with the file	None
AutoFocus - Fetch File Metadata	maltego.Hash	maltego.Hash	Takes a file hash and returns metadata about that file back to the same entity	None
AutoFocus - Get C2 By Sample	maltego.Hash	maltego.Domain maltego.IPv4Address	Takes a file hash and identifies C2 addresses associated with the samples in the DNS Activity and Connection Activity tabs	No Private IP addresses included; Some background noise domains excluded;
AutoFocus - Get Sample by Mutex	maltego.Mutex	maltego.Hash	Takes a mutex and identifies samples whose Mutex Activity contains that Mutex	None
AutoFocus - Get Sample by IP	maltego.IPv4Address	maltego.Hash	Takes an IP Address and identifies files whose Connection Activity includes the IP Address	None
AutoFocus - Get Sample by Hostname	maltego.Domain	maltego.Hash	Takes a hostname/domain and identifies files whose DNS activity includes the hostname/domain.	None
AutoFocus - Get Sample by Query	PaloAltoNetworks.AFQuery	maltego.Hash	Takes a query exported from AutoFocus and retrieves file hashes matching that query	None
AutoFocus - Get Sample by Tag	PaloAltoNetworks.Tag	maltego.Hash	Takes a tag (note that tags must include the fullname of the tag) and identifies associated files.	None
AutoFocus - Get Sample by URL	maltego.URL	maltego.Hash	Takes a full URL and searches for samples that communicate with that URL (e.g. www.google.com/images.php)	None
AutoFocus - Get Sample by URL Path	maltego.URL	maltego.Hash	Takes a full or partial URL and searches for samples that communicate with the PATH component of the URL, e.g. (www.google.com/images.php --> images.php)	None
AutoFocus - Get URLS by sample	maltego.Hash	maltego.URL	Takes a file hash and identifies full URLs the malware communicates with	None
AutoFocus - Get Mutex By Sample	maltego.Hash	maltego.Mutex	Takes a file hash and identifies associated mutexes	Mutexes which appear in more than 5000 samples are tuned out
AutoFocus - Get Service created by Sample	maltego.Hash	maltego.ServiceName	Takes a file hash and identifies created Service Names	None
AutoFocus - Get Imphash by Sample	maltego.Hash	maltego.Imphash	Takes a file hash and identifies the associated importhash	None
AutoFocus - Get Sample by Imphash	maltego.Imphash	maltego.Hash	Takes an importhash and finds files which have the same importhash	None
AutoFocus - Get Sample by Service	maltego.ServiceName	maltego.Hash	Takes a service name and searches for files which include the servicename	None
AutoFocus - Get Sample by FileActivity	maltego.Filename	maltego.Hash	Takes a filename and returns files whose File Activity includes the supplied filename	None
AutoFocus - Get Sessions by Sample	maltego.Hash	PaloAltoNetworks.WildfireSession	Takes a given file hash and returns sessions observed using the same Hash	Sessions with no company data are excluded
AutoFocus - Get Sessions by Query	PaloAltoNetworks.AutoFocusQuery	PaloAltoNetworks.WildfireSession	Takes a given query exported from AutoFocus and returns associated sessions.	Sessions with no company data are excluded
AutoFocus - Get Sessions by URL Path	maltego.URL	PaloAltoNetworks.WildfireSession	Takes the supplied URL and returns sessions which whose ITW URL contains the supplied URL.	Sessions with no company data are excluded
AutoFocus - Get Sessions by Tag	PaloAltoNetworks.Tag	PaloAltoNetworks.WildfireSession	Takes a supplied tag and returns matching sessions	Sessions with no company data are excluded
AutoFocus - Get ITW data as metadata	maltego.Hash	maltego.Hash	Takes a file hash and returns metadata about that file back to the same entity	Sessions with no company data are excluded
AutoFocus - Get ITW URLs as entities	maltego.Hash	maltego.URL	Takes a file hash and returns associated ITW URLs back as URL entities	None
AutoFocus - Get ITW Host	maltego.Hash	maltego.Domain maltego.IPv4Address	Takes a file hash and returns associated ITW URLs back as domain names and IP addresses.	No Private IP addresses included; Some background noise domains excluded;
AutoFocus - Get ITW Filename by Sample	maltego.Hash	maltego.Filename	Takes a file hash and returns associated ITW filenames with it	None
AutoFocus - Get Sample by Session	PaloAltoNetworks.WildfireSession	maltego.Hash	Takes a session and returns the File analysed as part of the session	Sessions with no company data are excluded
AutoFocus - Get ITW URL by Session	PaloAltoNetworks.WildfireSession	maltego.URL	Takes a session and returns the ITW URL observed as part of the session (if available)	Sessions with no company data are excluded
AutoFocus - Get ITW Host by Session	PaloAltoNetworks.WildfireSession	maltego.Domain maltego.IPv4Address	Takes a session and returns associated ITW URLs back as domain names and IP addresses.	No Private IP addresses included; Some background noise domains excluded;
AutoFocus - Get ITW Filename by Session	PaloAltoNetworks.WildfireSession	maltego.Filename	Takes a session and returns associated ITW filenames with it	None
AutoFocus - Get Sample by ITW Filename	maltego.Filename	maltego.Hash	Takes an ITW filename and returns files seen with the same filename ITW	None
AutoFocus - Get Samples by ITW Hostname	maltego.Domain	maltego.Hash	Takes a hostname and finds files that have been spotted with the same hostname ITW	None
AutoFocus - Get Samples by ITW IP address	maltego.IPv4Address	maltego.Hash	Takes an IP Address and identifies files that have been spotted with the same hostname ITW	None
AutoFocus - Get Samples by ITW URL	maltego.URL	maltego.Hash	Takes a URL and finds files hosted at that URL ITW	None
AutoFocus - Get Digtial Signer By Sample	maltego.Hash	PaloAltoNetworks.DigitalCertificateCN	Takes a sample and returns the name of the listed signer (As shown in AutoFocus)	None
AutoFocus - Get Sample By Digital Signer	PaloAltoNetworks.DigitalCertificateCN	maltego.Hash	Takes a digital signer and returns samples in AutoFocus whose signer matches the provided one	None