Standard Entities Overview

Modified on Tue, 14 Jul at 11:38 AM

maltego-transforms-std-entities is the companion package that exposes the standard Maltego entity catalog as Python classes. The package re-exports every module through maltego.entities, so most transforms can import from one namespace while still browsing the underlying module families when they need to find the right type.

For the generated class-by-class catalog, including Casefile entities and entity-typed property links, see the Standard Entities Catalog article.

Installing and importing

pip install maltego-transforms-std-entities
from maltego.entities import (
    BTCAddress,
    DNSName,
    IPv4Address,
    Person,
    Phrase,
    Thing,
)

How the package is organized

The local package is organized into module families that map cleanly to the categories surfaced in Maltego. Use this as a browsing guide before you define a custom entity from scratch.

ModuleCategoryRepresentative classesTypical use
coreGenericThing, ItemSimple placeholder or catch-all entities
personalPersonalPerson, Phrase, Alias, EmailAddress, ImagePeople, identifiers, free text, and media
infrastructureInfrastructureDNSName, Domain, IPv4Address, Website, URLInternet, DNS, network, and web artifacts
social_networkSocial NetworkAffiliation, FacebookObject, Hashtag, TwitSocial identities, affiliations, and platform-specific activity types
locationsLocationsLocation, GPS, City, CountryGeographic entities and place groupings
groupsGroupsOrganization, Company, IndustryOrganizations, communities, and institutions
eventsEventsEvent, Incident, MeetingTime-based records and investigative events
devicesDevicesDevice, Smartphone, CameraPhysical devices and hardware
malwareMalwareMalware, AttackPattern, CVSS, HashThreat-intelligence and malware analysis entities
cryptocurrencyCryptocurrencyBTCAddress, ETHTransaction, CryptocurrencyOwnerWallets, blocks, transactions, and crypto ownership
stix2STIX2STIX2indicator, STIX2identity, STIX2malwareSTIX 2 domain, observable, and relationship objects
technologyTechnologyETag, SSLCertificateHash, SSLCertificateSerialWeb and certificate metadata

Using a standard entity in a transform

from maltego.entities import DNSName, IPv4Address
from maltego.server import register_transform

@register_transform
async def dns_to_ip(input_entity: DNSName) -> IPv4Address:
    return IPv4Address("1.1.1.1")

Browsing tips

  • Start with from maltego.entities import ... for day-to-day use.
  • If you need to browse what exists, look by module family first: maltego.entities.personal, maltego.entities.infrastructure, maltego.entities.social_network, and so on.
  • If the package already has the right entity type, prefer reusing it over redefining the same schema locally.

Extending a standard entity

Standard entities are normal Python classes, so you can subclass them when you need extra fields:

from maltego.entities import Person
from maltego.server import (
    MaltegoEntityConfig,
    MaltegoEntityProperty,
    register_entity,
)

@register_entity
class StaffMember(Person):
    Config = MaltegoEntityConfig(display_name="Staff Member")

    employee_id: str = MaltegoEntityProperty(
        display_name="Employee ID",
        sample_value="E-42",
    )

For the custom-entity API, see the SDK API Reference article; see the Composed Entities article when those standard classes need to become nested properties inside another entity.

Was this article helpful?

That’s Great!

Thank you for your feedback

Sorry! We couldn't be helpful

Thank you for your feedback

Let us know how can we improve this article!

Select at least one of the reasons
CAPTCHA verification is required.

Feedback sent

We appreciate your effort and will try to fix the article