Overview of Maltego Monitor's (previously PublicSonar) Search Rules:
Proximity Search (NEAR Operator ~n)
Overview & Value
Standard AND searches collect any post containing all keywords anywhere in the text (e.g., a data leak mentioned in paragraph 1 and a company name in paragraph 4). Proximity search requires keywords to appear within n tokens of each other, drastically reducing false positives.
⚙️ Syntax & Examples
"word1 word2 ... wordN"~n
| Query | Explanation |
|---|---|
"apple fraud"~3 | Matches posts where apple and fraud occur within a 3-token span, e.g. "apple identity fraud" or "apple and the fraud", but not "apple was involved in the fraud". |
"data leak account hack"~5 | Matches posts where all 4 terms occur within a maximum span of 5 tokens. |
Rules & Constraints
- Distance Limit: n defaults to
3if omitted and is capped at6(~6). Values > 6 are automatically capped with a non-blocking warning. - Stop-Words Included: Words like the, and, of, in count toward token distance.
- Order Independent: Matching is span-based regardless of word order.
- Unsupported Syntax: Wildcards (
*), boolean operators (AND/OR), or sub-groupings are not supported inside a NEAR phrase (e.g.,"data leak*"~5is invalid).
Inline Exclusions (NOT Operator -term)
Overview & Value
Inline exclusions allow analysts to exclude predictable noise, homonyms, or irrelevant topics directly within the query (e.g., excluding fruit recipes when investigating Apple security breaches).
Syntax & Examples
-<operand>
Where <operand> can be a single term, a double-quoted phrase, or a prefix wildcard.
| Query | Explanation |
|---|---|
tesla -recall | Collects posts about tesla but excludes any containing recall. |
apple -"product recall" | Excludes posts containing the exact phrase "product recall". |
apple -hack* | Excludes posts containing hack, hacker, hacking, etc. (Wildcard exclusions available in Filters). |
apple -recipe -fruit | Multiple exclusions are specified as flat -term markers. |
Rules & Constraints
- Shorthand Only (
-): The keywordNOTis not supported (tesla NOT recallwill throw a validation error). - Flat Structure Only: Exclusions cannot be grouped with parentheses (e.g.,
apple AND NOT (recipe OR fruit)is invalid; useapple -recipe -fruit). - At Least One Positive Term Required: Queries containing only exclusions (e.g.,
-spam) are rejected during validation. - Case-Insensitive: All term exclusions are evaluated case-insensitively.
- Coexistence with Case-Level Excludes: Inline exclusions function per-search/filter and operate alongside (and independently of) case-wide Excludes.
Maltego Monitor does not support wildcard searches (e.g. "vacc*" to look for all variations of the word starting with "vacc").