Transform Sets

Transform sets group related discovery entries so they appear together in Maltego.

If you need a reusable workflow asset instead of a discovery grouping, see the Machines (SDK) article.

When to use a transform set

Use a transform set when you already have the discovery entries you need and only want them to show up together.

TransformSet is a named bundle of discovery IDs:

from maltego.server import TransformSet, register_transform_set


@register_transform_set
class SocialLookupSet(TransformSet):
    description = "Common lookup transforms"
    transforms = [
        "acme.lookup.profile",
        "acme.lookup.posts",
        "acme.lookup.followers",
    ]

This class-based pattern is useful when you want one central definition that curates the full set membership explicitly.

Using a transform set from a transform

Reference the set from a transform with transform_set="..." in register_transform(...) when you want the transform to show up under that group in discovery.

from maltego.entities import Phrase
from maltego.server import register_transform

@register_transform(
    display_name="Lookup profile [Acme]",
    transform_set="SocialLookupSet",
)
async def lookup_profile(input_entity: Phrase) -> Phrase:
    return Phrase(input_entity.value)

This per-transform pattern is useful when each transform can declare its own membership locally.

Choosing between the two patterns

Both patterns work:

• @register_transform_set lets you define a set explicitly as a list of transform IDs.
• transform_set="..." on register_transform(...) adds that transform to a named set during registration.

You can prefer the class-based form when you want a curated, centralized list, and prefer the per-transform form when you want set membership to live next to each transform definition.

If you use the same set name in both places, the SDK merges them into the same discovery set.

Real-world pattern

At larger scale, it is often useful to keep transform-set definitions separate from the transforms themselves and register them at startup:

for transform_set in discover_transform_sets():
    register_transform_set(transform_set)