maltego-transforms-std-entities is the companion package that exposes the standard Maltego entity catalog as Python classes. The package re-exports every module through maltego.entities, so most transforms can import from one namespace while still browsing the underlying module families when they need to find the right type.
For the generated class-by-class catalog, including Casefile entities and entity-typed property links, see the Standard Entities Catalog article.
Installing and importing
pip install maltego-transforms-std-entitiesfrom maltego.entities import (
BTCAddress,
DNSName,
IPv4Address,
Person,
Phrase,
Thing,
)How the package is organized
The local package is organized into module families that map cleanly to the categories surfaced in Maltego. Use this as a browsing guide before you define a custom entity from scratch.
| Module | Category | Representative classes | Typical use |
|---|---|---|---|
core | Generic | Thing, Item | Simple placeholder or catch-all entities |
personal | Personal | Person, Phrase, Alias, EmailAddress, Image | People, identifiers, free text, and media |
infrastructure | Infrastructure | DNSName, Domain, IPv4Address, Website, URL | Internet, DNS, network, and web artifacts |
social_network | Social Network | Affiliation, FacebookObject, Hashtag, Twit | Social identities, affiliations, and platform-specific activity types |
locations | Locations | Location, GPS, City, Country | Geographic entities and place groupings |
groups | Groups | Organization, Company, Industry | Organizations, communities, and institutions |
events | Events | Event, Incident, Meeting | Time-based records and investigative events |
devices | Devices | Device, Smartphone, Camera | Physical devices and hardware |
malware | Malware | Malware, AttackPattern, CVSS, Hash | Threat-intelligence and malware analysis entities |
cryptocurrency | Cryptocurrency | BTCAddress, ETHTransaction, CryptocurrencyOwner | Wallets, blocks, transactions, and crypto ownership |
stix2 | STIX2 | STIX2indicator, STIX2identity, STIX2malware | STIX 2 domain, observable, and relationship objects |
technology | Technology | ETag, SSLCertificateHash, SSLCertificateSerial | Web and certificate metadata |
Using a standard entity in a transform
from maltego.entities import DNSName, IPv4Address
from maltego.server import register_transform
@register_transform
async def dns_to_ip(input_entity: DNSName) -> IPv4Address:
return IPv4Address("1.1.1.1")Browsing tips
- Start with
from maltego.entities import ...for day-to-day use. - If you need to browse what exists, look by module family first:
maltego.entities.personal,maltego.entities.infrastructure,maltego.entities.social_network, and so on. - If the package already has the right entity type, prefer reusing it over redefining the same schema locally.
Extending a standard entity
Standard entities are normal Python classes, so you can subclass them when you need extra fields:
from maltego.entities import Person
from maltego.server import (
MaltegoEntityConfig,
MaltegoEntityProperty,
register_entity,
)
@register_entity
class StaffMember(Person):
Config = MaltegoEntityConfig(display_name="Staff Member")
employee_id: str = MaltegoEntityProperty(
display_name="Employee ID",
sample_value="E-42",
)For the custom-entity API, see the SDK API Reference article; see the Composed Entities article when those standard classes need to become nested properties inside another entity.