Maltego Improvements, September 2018

The following updates to the Maltego transforms are available as of September 24, 2018.

Besides a few bug fixes, the major changes with this update include:

  1. Analyst Notes Support - transforms now permit expansion to and from analyst notes
  2. Revised API Credit model - calls to the Recorded Future API for Maltego transforms are now discounted; a single transform that hits the Recorded Future API 0.20 credits/call 
  3. Riskier Hashes Returned - only malicious (or worse) hashes, with a risk score >= 65, are included in transforms that return hashes.

Analyst Notes support

Added transforms that fetch Analyst Notes for the following entity types:

(note: only notes written by the Insikt Group are available in these transforms).

  • IP
  • Domain
  • Hash
  • Vulnerability
  • Malware
  • NS Server
  • MX Server
  • URL

Transforms have also been added that fetches the following entity types from an Analyst Note:

  • Attack Vector
  • Domain
  • Email
  • Filename
  • Hash
  • IP
  • Malware Signature
  • Malware
  • Malware Category
  • Registry Key
  • URL
  • Vulnerability

Screen_Shot_2018-09-20_at_2.11.37_PM.png

Revised API crediting model

Because transforms can result in an unexpectedly large number of Connect/RAW API requests, we are pleased to introduce a reduced cost API crediting model.  In particular, every successful API only costs 0.2 credits per API request. Some transforms are composed of several requests and may cost up to a credit.

Return only risky hashes

Transforms that return hashes filter the resulting hashes to those with a risk score greater than or equal to 65; this reduces noise.

Minor changes

  • Added Malware to Email transform
  • The type for hashes has been changed from malformity.Hash to maltego.Hash
  • Added edge weight based on risk score for for entities with risk score
  • Add NVD info to Vulnerabilities
  • Return triggered risk rules
  • Major transform speed ups

Bug fixes

  • Fix media type filters for Malware/Vulnerability Technical reporting
  • Add missing details to IP to Location transform
  • Fix broken IP to Organization transform

 

Was this article helpful?
0 out of 0 found this helpful

The content of this article is confidential and intended solely for the use of individuals with authorized access to the Recorded Future service. Do not download or distribute this article.
Have more questions? Submit a request

Comments

0 comments

Please sign in to leave a comment. Please note that your name will be displayed. If you would like to change how your name appears, please update your profile name.