Maltego explained: entities, transforms and how to use it for investigations

Key takeaways

• Maltego builds a visual graph from entities connected by transforms.
• A common defensive use is mapping your own organisation's public footprint.
• A free Community Edition exists with limits; paid editions add more.
• Results depend on data sources and need manual verification.
• Use public data lawfully; do not investigate private individuals without a lawful reason.

What is Maltego?

Maltego is a graphical link-analysis and OSINT tool from Maltego Technologies. You can read about its editions on the Maltego website. It helps you see relationships in data that would be hard to follow in a spreadsheet.

It is a good tool for certain jobs and not the best for every job. Tools like SpiderFoot and Recon-ng approach collection differently, and many investigators use several.

How does it work?

Maltego uses three ideas:

• Entities are things: a domain, an email address, an IP address, a person, a company.
• Transforms are queries that take an entity and return related ones. A transform may find the DNS records of a domain.
• The graph displays entities as nodes and relationships as links.

What does a defensive example look like?

Map your own organisation's public footprint, with permission, so you can reduce it.

1. Add your company's main domain as the first entity.
2. Run transforms to find related DNS names, mail servers and name servers.
3. From those, resolve IP addresses and look at the network ranges they belong to.
4. Look for forgotten subdomains or services nobody remembered. A test server left online is a typical finding.
5. Save the graph and the list of items for the owners to review.

The point is exposure management. Attackers do the same mapping, so doing it first helps you.

What else is it used for?

• Following links between infrastructure used in phishing campaigns.
• Mapping relationships between companies and public domains in fraud investigations.
• Building a picture for threat-intelligence reports. Our CTIA course uses this kind of analysis.

What are the limits?

• Data quality. Transforms depend on external sources that may be stale or wrong.
• Noise. Graphs can get huge. Filter early.
• Licences. The free edition has limits, and some data sources require paid access.
• Privacy. Graphs about individuals can become intrusive. Keep to what your task needs.

What are the legal and ethical rules?

Use public data and lawful access. For work on an organisation, get written authorisation. Do not build profiles of private individuals for no good reason. If your work involves personal data, India's Digital Personal Data Protection Act, 2023 may apply, so take advice.

How do you practise?

Use your own domain, a lab domain you control, or a public example from a training course. Document what you did. Related reading: how to use Maltego for cybersecurity and OSINT investigations and top OSINT tools every professional should know.

Next steps

To learn investigation methods, see our CTIA course. For hands-on use, read how to use Maltego.