Real-World Case Studies: Solving Cyber Investigations with Maltego

How to Build Custom Maltego Transforms for Faster Investigations

Custom Maltego transforms let you automate repetitive OSINT tasks, query internal tools, and surface relationships faster during investigations. This guide walks through planning, building, testing, and deploying transforms so you can integrate data sources and speed up workflows.

1. Plan the transform

• Goal: Define the problem the transform will solve (e.g., enrich an email with breached records, resolve domain WHOIS to owner entities, pull GitHub user repos).
• Input/Output entities: Choose Maltego entity types for input and output (e.g., EmailAddress → Person, Domain → DNSName).
• Data source & API: Identify the API, database, or script you’ll call, and confirm licensing/rate limits.
• Failure modes: Decide how to handle missing data, timeouts, and throttling.

2. Choose transform architecture

• Local (Script) transforms: Simple Python/Node scripts run locally via Maltego’s local transform server—good for internal-only data or fast prototyping.
• Remote (Transform Server) transforms: HTTP(S) endpoints hosted on a server responding to Maltego requests—better for shared, centrally managed, or high-performance transforms.
• Hybrid: Use a lightweight endpoint that proxies to internal services.

3. Set up the environment

• Language & libs: Common choices: Python (requests, flask), Node.js (express, axios). Use virtualenv/npm for isolation.
• Maltego Tramsform Server: For production, deploy transforms behind a stable HTTPS endpoint. For testing, you can use the Maltego local transform client or ngrok to expose local endpoints securely.
• API keys & secrets: Store secrets in environment variables or a secrets manager. Never embed keys in code.

4. Build the transform logic

• Implement these core steps in your script/endpoint:
  1. Parse Maltego request: read input entity and parameters (Maltego sends entity value and transform parameters).
  2. Query the data source: call APIs, query databases, or run analysis scripts. Respect rate limits and use caching where useful.
  3. Map results to Maltego entities: create entities with properties, labels, and links to other entities.
  4. Return Maltego XML/JSON response: Maltego expects a specific result format (Transform Response). Use a helper library if available.

Example (conceptual Python flow):

• Receive HTTP POST with entity value.
• Call external API and parse JSON result.
• For each found item, create an entity object with type and display name.
• Return the transform response.

(For exact request/response fields, consult Maltego transform documentation or SDK for your chosen language.)

5. Use the Maltego Transform Development Kit (TDK)

• Install and use the official TDK or community SDK to simplify request parsing and response generation. TDKs typically provide:
  • Entity classes
  • Response builders
  • Helper functions for transforms and exceptions
• TDKs reduce boilerplate and ensure compatibility with Maltego’s expected XML/JSON.

6. Add robust features

• Rate limiting & retries: Back off on API errors and respect provider limits.
• Caching: Cache frequent lookups (Redis or local cache) to speed repeated queries.
• Pagination: Handle paginated APIs gracefully.
• Concurrency: Use async calls to parallelize API calls for multiple entities.
• Logging & metrics: Log transform runs, errors, latency; expose metrics (Prometheus) for monitoring.
• Input validation & sanitization: Prevent injection or malformed requests.

7. Testing and validation

• Unit tests: Test parsing, API integration (use mocks), and response generation.
• Integration tests: Run transforms against staging APIs or sample data.
• Edge cases: Test empty results, partial failures, and