Maltego 4.0.seventeen. / dezessete / семнадцать / seitsemäntoista / de diecisiete / 17 / 17 / 17 / 17

Hi there all the people of the Internet.

We are happy to show you Maltego 4.0.17. We fixed many mistakes in this release. We now remember proxy settings (again/better). We fixed font scaling in the OAuth service window. Since Ubuntu decided ifconfig no more we worked our way around it. Furthermore - in the transform hub we fixed the refresh button for custom entries.

We also introduced search functionality in the context menu as well as permanent search functionality in the entity palette.

Woot - this is a win!
RT

PS：Japeneseのこのブログ記事全体を翻訳しましたが、ポールはそれがトップ...過ぎていると言っていました。 だから私はそれを取り除いた。 あなたが彼を見る次回は、あなたは彼を蹴るべきです。 ごめんなさい！

Maltego 4.0.16 is out!

Hi there,

We just released Maltego 4.0.16. The delta between version 15 and 16 is mostly bug fixes. We've made Classic and XL available as [downloads] as well as creating update files for people running older versions of Maltego:

From today we're going to try and give you an idea of what features and fixes we've implemented. Some client have asked for it and we think that it's just proper to have some sort of changelog. So here goes!

• Numerous fixes for using Maltego with a proxy server. Specifically surrounding authenticated proxies.
• Start-up stability issues addressed.
• Support for POSTs in OAuth integration. There are a couple of other issues we've addressed in OAuth and there's a few we're still going to address in future releases. But it's a lot better!
• Fair amount of cosmetics, spelling mistakes fixed.
• Refresh button on transform hub items (sure all devs will love us for this!).
• Factory reset now..uhmm... works...better.
• Fixes viewlets that's been with us since - forever.

Hope this helps giving you an idea of what the devs have been up to.
Baby seals / enjoy the weekend!
RT

Maltego documentation is amazing! AMAZINGGG!

It's been said before that Paterva's documentation is not up to scratch and often out-dated. Lies! Lies! And damn lies!! However untrue this might have been I am here today to tell that we have sat down and put some real effort into updating all our documentation for the Maltego client, all our server guides as well as our developer guides. This shiny beacon of Maltego documentation goodness can now be found on the [Maltego Documentation Portal].

All the existing developer portal content has been migrated to this website and can be found under the Developer Portal heading in the navigation bar. We will also be discontinuing the existing Developer Forum on the 'dev portal'. If you've searched our documentation and you still have questions we recommend that you mails friendly questions to support@paterva.com.

That's all for now.

PR

Bing v2 API is dead, long live v5? Also CTAS updates.

As some of you might have notice Microsoft is in the final throes of shutting down Bing API v2 and replacing it with v5 (v3 and v4...well...who knows). The new API is part of [Microsoft Cognitive Services]. MCS have some pretty cool APIs and as soon as they're priced right we might start putting more of them into Maltego. We've put this in here specifically for MS people. You know who you are. We've spoken to you. We know where you live....;)

Currently Maltego uses Bing for all the Search Engine transforms - these all end with '_SE'.

The migration to v5 was not always easy. The question enumerator in the server code had to be changed (a lot). Some options are not supported in v5. There are only 25 results per page. One of the biggest impacts the new API has is that its pricing model is significantly higher than the previous version. Microsoft was pretty helpful in the migration process but less helpful when we complained about the new prices. This means we *might* need to cut down this service for our community edition users - but let's see how it goes.

We will be changing our public servers to v5 when Microsoft literally pull the plug on v2. For our clients that have their own private CTAS servers - you can easily change over to the v5 API by simply applying a patch. Do the following:

Browse to the CTAS web interface. Click on 'Update Server' at the top. Click on 'Update Server Automatically' and .. wait. Soon the server will begin with the updating process. There is no need to reboot the server.

Once you server is up to date it will be using Bing v5 API and your Bing API v2 key will no longer be valid. You may want to read how to enter the Bing v5 API key on your server in our fantastic new CTAS guide here:

https://docs.paterva.com/en/server-guides/ctas-guide/#toc-bing-api-key

If you run into any trouble please drop us a friendly note at support@paterva.com. Enjoy!!

RT

We loaded new certs on our servers

Just a really quick note to say that - yes - it's us and not some nasty MITM - we've changed certificates on our servers. So when you see this...

...then you know what it's about. After our 4.0.5 update we're a little paranoid with checking certificates! You should check that the Modulus is the same, it's signed by Entrust and the Serial number match. If so you can happily click on 'Trust' and be on your merry way.

If you don't see this or the details are different it means you're not speaking to our servers...and you should be worried.

Happy days,
RT

Maltego 4.0.15 is here!

We're happy to announce that Maltego 4.0.15 (for XL and Classic) has just been released. With it comes a whole host of bug fixes, improvements and new features.

What's new:

• New tabular import wizard
• Much (much!) quicker to import large amounts of data
• Connectivity matrix helps you connect the dots
• Auto-detection of columns and column entity types saves you time
• Import multiple files at once - underrated feature of the month!
• List view - back by popular demand!
• Recent entities section in entities pallet so you don't need to search for them
• Leaf selection (we should have had this in V1)
• 100+ small bug fixes so things just works better.

Tabular Importer

Connectivity Matrix

The new connectivity matrix allows you to easily define the relationships between the imported entities.

Column Entity Types

You can now specify the entity type in the data headers.

E.g. A column with the heading "maltego.Person" will automatically be recognized as a Person entity, without having to do the mapping manually.

Import Multiple Files at Once

If you have your data split over multiple files, you can configure your column mapping once, and import all the files at once. Please note that the file layouts must all be identical.

List View

The List View can be used as an alternative to the entity view as a way to view a graph in a tabular format. The entity selection behavior and functionality is identical between the entity view and the list view. Changing from "Entity Selection" to "Link Selection" will display all the graph links of entities.

Leaf Selection

The new "Select Leaves" button allows you to quickly select entities that have no outgoing links and a single incoming link (so strictly speaking it's not a "real" leaf node... but we like it like that!).

To update your Maltego client click on the Application Button (left top), Tools -> Check for Updates:

This will update your Maltego to 4.0.15. We hope you're having fun with our latest update!

Visual link analysis with Splunk (or SQL) and Maltego using the MDS

We're finally ready to release a public beta of the Maltego Data Server (MDS). The MDS is a server that allows you to trivially easy visualize data kept in SQL databases or indexes (such as Splunk) in Maltego - as a graph.

In the most simplest form you only need to write a query (SQL/Splunk) and a tell the MDS how to map the resultant data back to nodes on the graph.

In the most complex form you can write Python code around the query, mapping and nodes as well as use (global) replacement variables anywhere within the items above. With this we mean to say that the MDS can be as easy or as complex as you'd like it to become. The system can grow with your abilities and is very flexible.

With the very basic knowledge of SQL/Splunk and Maltego you can almost immediately get massive insight into the most mundane of logs. With two (basic AF) Splunk-based transforms and three of the standard OSINT transforms that ship with Maltego we can spot fake Googlebots almost instantly in our web server logs:

Keep in mind that the power of the existing Threat Intelligence transforms available in the Transform Hub is at your fingertips - making it possible to enrich your internal data to the max.

If you are interested to test drive the MDS *today* you can simply email us at mds-beta@paterva.com and we'll send you the server as an OVA to experiment with. You can read the comprehensive documentation for the MDS [here] right now. 

We love to get your feedback on our new project.

RT

PS: the commercial people just told us we should include that we're going to be selling this in future. Don't know why that's important...but ye.

Making Buzzfeed's TrumpWorld tables into a Maltego graph

Maltego 4.0.15 is on it's way, and with it a brand new interface for importing data into Maltego. With Buzzfeed's recent data dump of "TrumpWorld" we thought we would have some fun mapping out the data, whilst doing a walk-through of the new Tabular importer.

TL;DR

-----

With just a few easy clicks you can map out hundreds of links and entities. We can see the complex layout of Trump business empire, as well as how his social and business circles overlap.

Maltego provides a wide array of transforms to dig deeper into the information we have here. We'll leave that as an exercise for the reader ;)

Person - Company mapping

Person - Person mapping

Company - Company mapping

Just in case anyone was worried that we were getting too political (we're neutral, like Switzerland), here's a graph of Hillary Clinton's email infrastructure. What's the SSLVPN box by the way? ;)

Try It For Yourself

Here are all the Maltego graphs - feel free to open them in any version of Maltego as long as it starts with a 4.  (including the free (4) CE version!).

Download Graph Files

Maltego 4.0.15's new tabular import (aka how we did it)

Start by clicking "Import Graph from Table" under the "Import|Export" section of the ribbon bar.

Click "Next" and select an Excel or csv file.

In this case we will be using "TrumpWorld Data — Public - Person-Org". Once you have selected your file click "Next".

The Hint at the bottom of the next dialogue explains the different connectivity options. We're going to pick "Sequential" because it's really a A->B mapping, but the other defaults are useful in other situations.

We have to tell Maltego which column represents which type of data. We have chosen to map column 1 to a "Company" entity (we've imported it using the CaseFile entity pack in the Transform Hub) and column 2 to a "Person" entity.

The information in the other two columns we won't be using to make entities, so we set them to "Unmapped".

Under the "Map Columns to Links" tab we can choose to use column 3 as the label for the connection between column 1 and column 2.

We can now see a visual representation of how each row will be imported by going to "Connectivity Graph". We see that a link will be made from the Person to the Company.

The final step is to check that all the settings are correct and click "Next" to import the data into Maltego.

You will then see a summary of what was imported.

Short term (Q1 '17) plans for Maltego

Welcome to 2017. It's only the 3rd of January and we're all back at work. I thought I share some of the exciting things happening with Maltego in the short term.

Awesome documentation

Documentation was never our strong suit and so this year we're setting it right and putting a lot of effort into documenting Maltego. We started with the user guide - it's brand new and shiny and available [here].

We're redoing the transform guide on a wiki - so that other transform writers can also document their stuff a little - so far it's looking grand and useful. We're also doing a lot of maintenance on the developer portal to get that up to date. Let it never be said again that our documentation suck!

Maltego Data Server (MDS)

We're almost done with the MDS. It's currently (almost) in beta. If you want to play or get a copy of the user's manual [drop us a line]. Some time ago we've made a [sneak peek video] of the MDS:

The MDS is going to be 'the next big thing'.

Maltego GUI

In the spirit of making Maltego easier to work with your own data we have a two prong attack. We're doing a lot of work in terms of the tabular data import function for local data files. The partial screenshot below should give you a taste of what's coming:

Import speed has been optimized and we now load 200k records in a mere 11 seconds!

For work with big(ish) data in SQL databases and (Splunk/ELK) indexes we have the MDS (see above).

We are also planning to have a unified Maltego installer and lifelong license keys - meaning you can easily upgrade from CE to Classic to XL. It solves a lot of issues from us building new Maltego releases as well as solving a lot of licensing headaches (think renewal, different license keys every year etc. etc.)

Exciting times and more as it happens,
RT