Thursday, February 23, 2017

We loaded new certs on our servers

Just a really quick note to say that - yes - it's us and not some nasty MITM - we've changed certificates on our servers. So when you see this...

...then you know what it's about. After our 4.0.5 update we're a little paranoid with checking certificates! You should check that the Modulus is the same, it's signed by Entrust and the Serial number match. If so you can happily click on 'Trust' and be on your merry way.

If you don't see this or the details are different it means you're not speaking to our servers...and you should be worried.

Happy days,

Tuesday, February 14, 2017

Maltego 4.0.15 is here!

We're happy to announce that Maltego 4.0.15 (for XL and Classic) has just been released. With it comes a whole host of bug fixes, improvements and new features.

What's new:
  • New tabular import wizard
    • Much (much!) quicker to import large amounts of data
    • Connectivity matrix helps you connect the dots
    • Auto-detection of columns and column entity types saves you time
    • Import multiple files at once - underrated feature of the month!
  • List view - back by popular demand!
  • Recent entities section in entities pallet so you don't need to search for them
  • Leaf selection (we should have had this in V1)
  • 100+ small bug fixes so things just works better.

Tabular Importer

Connectivity Matrix

The new connectivity matrix allows you to easily define the relationships between the imported entities.

Column Entity Types

You can now specify the entity type in the data headers.
E.g. A column with the heading "maltego.Person" will automatically be recognized as a Person entity, without having to do the mapping manually.

Import Multiple Files at Once

If you have your data split over multiple files, you can configure your column mapping once, and import all the files at once. Please note that the file layouts must all be identical.

List View

The List View can be used as an alternative to the entity view as a way to view a graph in a tabular format. The entity selection behavior and functionality is identical between the entity view and the list view. Changing from "Entity Selection" to "Link Selection" will display all the graph links of entities.

Leaf Selection

The new "Select Leaves" button allows you to quickly select entities that have no outgoing links and a single incoming link (so strictly speaking it's not a "real" leaf node... but we like it like that!).

To update your Maltego client click on the Application Button (left top), Tools -> Check for Updates:
This will update your Maltego to 4.0.15. We hope you're having fun with our latest update!

Thursday, January 19, 2017

Visual link analysis with Splunk (or SQL) and Maltego using the MDS

We're finally ready to release a public beta of the Maltego Data Server (MDS). The MDS is a server that allows you to trivially easy visualize data kept in SQL databases or indexes (such as Splunk) in Maltego - as a graph.

In the most simplest form you only need to write a query (SQL/Splunk) and a tell the MDS how to map the resultant data back to nodes on the graph.

In the most complex form you can write Python code around the query, mapping and nodes as well as use (global) replacement variables anywhere within the items above. With this we mean to say that the MDS can be as easy or as complex as you'd like it to become. The system can grow with your abilities and is very flexible.

With the very basic knowledge of SQL/Splunk and Maltego you can almost immediately get massive insight into the most mundane of logs. With two (basic AF) Splunk-based transforms and three of the standard OSINT transforms that ship with Maltego we can spot fake Googlebots almost instantly in our web server logs:

Keep in mind that the power of the existing Threat Intelligence transforms available in the Transform Hub is at your fingertips - making it possible to enrich your internal data to the max.

If you are interested to test drive the MDS *today* you can simply email us at and we'll send you the server as an OVA to experiment with. You can read the comprehensive documentation for the MDS [here] right now. 

We love to get your feedback on our new project.


PS: the commercial people just told us we should include that we're going to be selling this in future. Don't know why that's important...but ye.

Tuesday, January 17, 2017

Making Buzzfeed's TrumpWorld tables into a Maltego graph

Maltego 4.0.15 is on it's way, and with it a brand new interface for importing data into Maltego. With Buzzfeed's recent data dump of "TrumpWorld" we thought we would have some fun mapping out the data, whilst doing a walk-through of the new Tabular importer.


With just a few easy clicks you can map out hundreds of links and entities. We can see the complex layout of Trump business empire, as well as how his social and business circles overlap.

Maltego provides a wide array of transforms to dig deeper into the information we have here. We'll leave that as an exercise for the reader ;)

Person - Company mapping

Person - Person mapping

Company - Company mapping

Just in case anyone was worried that we were getting too political (we're neutral, like Switzerland), here's a graph of Hillary Clinton's email infrastructure. What's the SSLVPN box by the way? ;)

Try It For Yourself

Here are all the Maltego graphs - feel free to open them in any version of Maltego as long as it starts with a 4.  (including the free (4) CE version!).

Download Graph Files

Maltego 4.0.15's new tabular import (aka how we did it)

Start by clicking "Import Graph from Table" under the "Import|Export" section of the ribbon bar.

Click "Next" and select an Excel or csv file.

In this case we will be using "TrumpWorld Data — Public - Person-Org". Once you have selected your file click "Next".

The Hint at the bottom of the next dialogue explains the different connectivity options. We're going to pick "Sequential" because it's really a A->B mapping, but the other defaults are useful in other situations.

We have to tell Maltego which column represents which type of data. We have chosen to map column 1 to a "Company" entity (we've imported it using the CaseFile entity pack in the Transform Hub) and column 2 to a "Person" entity.

The information in the other two columns we won't be using to make entities, so we set them to "Unmapped".

Under the "Map Columns to Links" tab we can choose to use column 3 as the label for the connection between column 1 and column 2.

We can now see a visual representation of how each row will be imported by going to "Connectivity Graph". We see that a link will be made from the Person to the Company.

The final step is to check that all the settings are correct and click "Next" to import the data into Maltego.

You will then see a summary of what was imported.

Tuesday, January 3, 2017

Short term (Q1 '17) plans for Maltego

Welcome to 2017. It's only the 3rd of January and we're all back at work. I thought I share some of the exciting things happening with Maltego in the short term.

Awesome documentation

Documentation was never our strong suit and so this year we're setting it right and putting a lot of effort into documenting Maltego. We started with the user guide - it's brand new and shiny and available [here].

We're redoing the transform guide on a wiki - so that other transform writers can also document their stuff a little - so far it's looking grand and useful. We're also doing a lot of maintenance on the developer portal to get that up to date. Let it never be said again that our documentation suck!

Maltego Data Server (MDS)

We're almost done with the MDS. It's currently (almost) in beta. If you want to play or get a copy of the user's manual [drop us a line]. Some time ago we've made a [sneak peek video] of the MDS:

The MDS is going to be 'the next big thing'.

Maltego GUI

In the spirit of making Maltego easier to work with your own data we have a two prong attack. We're doing a lot of work in terms of the tabular data import function for local data files. The partial screenshot below should give you a taste of what's coming:

Import speed has been optimized and we now load 200k records in a mere 11 seconds!

For work with big(ish) data in SQL databases and (Splunk/ELK) indexes we have the MDS (see above).

We are also planning to have a unified Maltego installer and lifelong license keys - meaning you can easily upgrade from CE to Classic to XL. It solves a lot of issues from us building new Maltego releases as well as solving a lot of licensing headaches (think renewal, different license keys every year etc. etc.)

Exciting times and more as it happens,

Friday, December 23, 2016

Christmas Special & State of the Nation. It's a thing!

Here we are – at the end of 2016. For some 2016 was a great year. For others... not so much. It was indeed a year where we saw many changes around the world. And you know what they say about change. No no - not the holiday thing, that funny thing about not wearing ski pants in the desert. 

Was 2016 a bad year for Maltego? Hmm - no. We released a major version (M4) this year. We fixed a lot of bugs in it and we’re now up to the 12th update for the 4.0 version. We finally had the courage to split it into two flavors (Classic and XL). We built the MDS this year. A few more tests and it’s ready for production in early 2017. Every time I play with the MDS I smile. It’s truly a thing of beauty. Maltego 4 + MDS is going to turn out to be VERY powerful.

The company has grown too – not just with clients and sales – but with people too. Yesterday another recruit started with the company. His name is Andrew. How is it that we have five people working in one office and two of them are called Andrew?  Don’t ask – it’s still 2016. We now have proper offices in Pretoria(here and here) having moved from Cape Town. Yes – we moved there and then moved back. I said don’t ask. 

After almost 10 years around people tend to think we need to “grow up”. Become a “proper company”.  Focus more on “making the numbers” and thus less on making cool and useful tech anymore. Cut the intros for our videos and use "sensible fonts". Find a receptionist and a PABX and a stall at *that* conference and a real company letterhead. Well |=|_|[|< all that.  We fight against that on a daily basis.  We resist to conform, to become a “me too!”. And after every Maltego design meeting we sit down again and question our decisions and ask if it’s REALLY the direction we want to take.

I know you’re actually only here for the Christmas special coupon code. It’s a tradition we’ve kept going for the last few years. The plan here is that you can buy Maltego as a gift to your partner/wife/husband/girlfriend/boyfriend/dog/parakeet/goldfish/cactus/athlete's foot at a real bargain and that you don’t need to buy them socks - again. 

The coupon is all lower case. It contains no spaces. It’s the new server we’re releasing in 2017 – append to that the name of person that just joined the company. You can of course Tweet this coupon to the world. Do that and we'll give your Twitter alias to a South African traditional healer which in turn will give you a penis enlargement. Even if you’re not male. And keep in mind they’re not always super reliable so stuff might go wrong. It’s up to you.

The coupon gives you 40% off Maltego Classic and XL (discount do not apply to renewal free). The coupon is valid from now to the 27th of Dec (00h00, GMT+2).

Baby seals,

Thursday, September 29, 2016

Maltego 4 CE / Kali Linux release is ready for download!

Hi there,

We're happy to announce that Maltego 4 is now (finally) ready for the masses! We're releasing the community (free) edition today and the Kali distros have been updated by the kind people from Offensive Security (thanks Dookie/Muts!).  In other words - we're ready to roll on a major upgrade of your favorite information visualization tool.

(click on the image above to see our very grown-up/proper promotional video of Sandra the 15 year old Dachshund and Maltego/Kali Linux. !(We plan to screen this at our booth at a major conference.))

Our decision to make CaseFile free with the release of Maltego 4 had some interesting side-effects. In CaseFile importing data from CSV/XLS was enabled. So too printing. And reporting. So when we made CaseFile free it did not make sense to limit the Kali/CE releases - you'd simply open CaseFile, import the data and save the graph - then open in CE.

So - bottom line - reporting/printing/CSV import is now enabled in the free release!

The major changes from 3.6 to 4.0 is the ability to render and use large graphs, the use of collection nodes and a brand new interface. To see a more complete overview of the improvements in Maltego 4 you might want to view our release video [HERE].

For the CE version (OSX/Windows/Linux/SNES/ZX81/C64) click [HERE], download and install.

For Kali Linux - if you're running 2016.2 (recommended) you can simply type:

# apt-get update && apt-get install maltegoce

If you're using Kali Linux 2016.1 it's a bit of a bigger mission but you can open a terminal and type:

# apt-get update && apt-get dist-upgrade

This will upgrade your Kali to the latest - and it's good thing(tm) anyhow.
Once you're good to go start Maltego like you normally do.

We hope you have endless fun using Maltego 4 and that you find it super useful in your explorations.