Standard Entities Catalog

Modified on Tue, 14 Jul at 11:39 AM

Standard Entities Catalog

Generated reference for maltego-transforms-std-entities. The catalog is grouped by Maltego entity category and includes Casefile entities from the same public package.

Total entity classes: 244.

Use the compact Standard Entities Overview article for installation and browsing guidance. Use this article when you need the exact class name, entity type ID, base class, value property, or field matching rule.

Category	Entities
Cryptocurrency	25
Devices	8
Events	9
Groups	8
Infrastructure	26
Locations	16
Malware	10
Personal	40
Social Network	35
STIX 2 domain objects	20
STIX 2 observables	18
STIX 2 relationship objects	2
Technology	3
Tracking	6
Transportation	7
Weapons	11

Cryptocurrency

Class	Type ID	Display Name	Module	Base	Value Property
BCHAddress	maltego.BCHAddress	Bitcoin Cash Address	Cryptocurrency	CryptocurrencyAddress	properties.cryptocurrencyaddress
BCHBlock	maltego.BCHBlock	Bitcoin Cash Block	Cryptocurrency	CryptocurrencyBlock	properties.cryptocurrencyblock
BCHBlockHeight	maltego.BCHBlockHeight	BitcoinCash Block Height	Cryptocurrency	CryptocurrencyBlockHeight	blockheight
BCHTransaction	maltego.BCHTransaction	Bitcoin Cash Transaction	Cryptocurrency	CryptocurrencyTransaction	properties.cryptocurrencytransaction
BTCAddress	maltego.BTCAddress	Bitcoin Address	Cryptocurrency	CryptocurrencyAddress	properties.cryptocurrencyaddress
BTCBlock	maltego.BTCBlock	Bitcoin Block	Cryptocurrency	CryptocurrencyBlock	properties.cryptocurrencyblock
BTCBlockHeight	maltego.BTCBlockHeight	Bitcoin Block Height	Cryptocurrency	CryptocurrencyBlockHeight	blockheight
BTCTransaction	maltego.BTCTransaction	Bitcoin Transaction	Cryptocurrency	CryptocurrencyTransaction	properties.cryptocurrencytransaction
CryptocurrencyAddress	maltego.CryptocurrencyAddress	Cryptocurrency Address	Cryptocurrency		properties.cryptocurrencyaddress
CryptocurrencyBlock	maltego.CryptocurrencyBlock	Cryptocurrency Block	Cryptocurrency		properties.cryptocurrencyblock
CryptocurrencyBlockHeight	maltego.CryptocurrencyBlockHeight	Cryptocurrency Block Height	Cryptocurrency		blockheight
CryptocurrencyOwner	maltego.CryptocurrencyOwner	Cryptocurrency Owner	Cryptocurrency	Person	OwnerType
CryptocurrencyTransaction	maltego.CryptocurrencyTransaction	Cryptocurrency Transaction	Cryptocurrency		properties.cryptocurrencytransaction
DogecoinAddress	maltego.DogecoinAddress	Dogecoin Address	Cryptocurrency	CryptocurrencyAddress	properties.cryptocurrencyaddress
DogecoinBlock	maltego.DogecoinBlock	Dogecoin Block	Cryptocurrency	CryptocurrencyBlock	properties.cryptocurrencyblock
DogecoinBlockHeight	maltego.DogecoinBlockHeight	Dogecoin Block Height	Cryptocurrency	CryptocurrencyBlockHeight	blockheight
DogecoinTransaction	maltego.DogecoinTransaction	Dogecoin Transaction	Cryptocurrency	CryptocurrencyTransaction	properties.cryptocurrencytransaction
ETHAddress	maltego.ETHAddress	Ethereum Address	Cryptocurrency	CryptocurrencyAddress	properties.cryptocurrencyaddress
ETHBlock	maltego.ETHBlock	Ethereum Block	Cryptocurrency	CryptocurrencyBlock	properties.cryptocurrencyblock
ETHBlockHeight	maltego.ETHBlockHeight	Ethereum Block Height	Cryptocurrency	CryptocurrencyBlockHeight	blockheight
ETHTransaction	maltego.ETHTransaction	Ethereum Transaction	Cryptocurrency	CryptocurrencyTransaction	properties.cryptocurrencytransaction
LTCAddress	maltego.LTCAddress	Litecoin Address	Cryptocurrency	CryptocurrencyAddress	properties.cryptocurrencyaddress
LTCBlock	maltego.LTCBlock	Litecoin Block	Cryptocurrency	CryptocurrencyBlock	properties.cryptocurrencyblock
LTCBlockHeight	maltego.LTCBlockHeight	Litecoin Block Height	Cryptocurrency	CryptocurrencyBlockHeight	blockheight
LTCTransaction	maltego.LTCTransaction	Litecoin Transaction	Cryptocurrency	CryptocurrencyTransaction	properties.cryptocurrencytransaction

Class	Field	Display Name	Type	Matching	Value
BCHAddress	properties.cryptocurrencyaddress	Cryptocurrency Address	str	strict	yes
BCHBlock	properties.cryptocurrencyblock	Cryptocurrency Block	str	strict	yes
BCHBlock	height	Block Height	int	loose
BCHBlock	merkleRoot	Merkle Root	str	loose
BCHBlock	nextBlockHash	Next Block Hash	str	loose
BCHBlock	nonce	Nonce	str	loose
BCHBlock	previousBlockHash	Previous Block Hash	str	loose
BCHBlockHeight	blockheight	Block Height	int	strict	yes
BCHTransaction	properties.cryptocurrencytransaction	Cryptocurrency Transaction	str	strict	yes
BTCAddress	properties.cryptocurrencyaddress	Cryptocurrency Address	str	strict	yes
BTCBlock	properties.cryptocurrencyblock	Cryptocurrency Block	str	strict	yes
BTCBlock	height	Block Height	int	loose
BTCBlock	merkleRoot	Merkle Root	str	loose
BTCBlock	nextBlockHash	Next Block Hash	str	loose
BTCBlock	nonce	Nonce	str	loose
BTCBlock	previousBlockHash	Previous Block Hash	str	loose
BTCBlockHeight	blockheight	Block Height	int	strict	yes
BTCTransaction	properties.cryptocurrencytransaction	Cryptocurrency Transaction	str	strict	yes
CryptocurrencyAddress	properties.cryptocurrencyaddress	Cryptocurrency Address	str	strict	yes
CryptocurrencyBlock	properties.cryptocurrencyblock	Cryptocurrency Block	str	strict	yes
CryptocurrencyBlock	height	Block Height	int	loose
CryptocurrencyBlock	merkleRoot	Merkle Root	str	loose
CryptocurrencyBlock	nextBlockHash	Next Block Hash	str	loose
CryptocurrencyBlock	nonce	Nonce	str	loose
CryptocurrencyBlock	previousBlockHash	Previous Block Hash	str	loose
CryptocurrencyBlockHeight	blockheight	Block Height	int	strict	yes
CryptocurrencyOwner	person.firstnames	First Names	str	loose
CryptocurrencyOwner	person.fullname	Full Name	str	loose
CryptocurrencyOwner	person.lastname	Surname	str	loose
CryptocurrencyOwner	OwnerType	Owner Type	str	loose	yes
CryptocurrencyOwner	OwnerTypeIcon	Owner Type Icon	str	loose
CryptocurrencyTransaction	properties.cryptocurrencytransaction	Cryptocurrency Transaction	str	strict	yes
DogecoinAddress	properties.cryptocurrencyaddress	Cryptocurrency Address	str	strict	yes
DogecoinBlock	properties.cryptocurrencyblock	Cryptocurrency Block	str	strict	yes
DogecoinBlock	height	Block Height	int	loose
DogecoinBlock	merkleRoot	Merkle Root	str	loose
DogecoinBlock	nextBlockHash	Next Block Hash	str	loose
DogecoinBlock	nonce	Nonce	str	loose
DogecoinBlock	previousBlockHash	Previous Block Hash	str	loose
DogecoinBlockHeight	blockheight	Block Height	int	strict	yes
DogecoinTransaction	properties.cryptocurrencytransaction	Cryptocurrency Transaction	str	strict	yes
ETHAddress	properties.cryptocurrencyaddress	Cryptocurrency Address	str	strict	yes
ETHBlock	properties.cryptocurrencyblock	Cryptocurrency Block	str	strict	yes
ETHBlock	height	Block Height	int	loose
ETHBlock	merkleRoot	Merkle Root	str	loose
ETHBlock	nextBlockHash	Next Block Hash	str	loose
ETHBlock	nonce	Nonce	str	loose
ETHBlock	previousBlockHash	Previous Block Hash	str	loose
ETHBlockHeight	blockheight	Block Height	int	strict	yes
ETHTransaction	properties.cryptocurrencytransaction	Cryptocurrency Transaction	str	strict	yes
LTCAddress	properties.cryptocurrencyaddress	Cryptocurrency Address	str	strict	yes
LTCBlock	properties.cryptocurrencyblock	Cryptocurrency Block	str	strict	yes
LTCBlock	height	Block Height	int	loose
LTCBlock	merkleRoot	Merkle Root	str	loose
LTCBlock	nextBlockHash	Next Block Hash	str	loose
LTCBlock	nonce	Nonce	str	loose
LTCBlock	previousBlockHash	Previous Block Hash	str	loose
LTCBlockHeight	blockheight	Block Height	int	strict	yes
LTCTransaction	properties.cryptocurrencytransaction	Cryptocurrency Transaction	str	strict	yes

Devices

Class	Type ID	Display Name	Module	Base	Value Property
Camera	maltego.Camera	Camera	Devices	Device	device
Computer	maltego.Computer	Computer	Devices	Device	device
DesktopComputer	maltego.DesktopComputer	Desktop Computer	Devices	Computer, Device	id
Device	maltego.Device	Device	Devices		device
Lens	maltego.Lens	Lens	Devices	Device	device
MobileComputer	maltego.MobileComputer	Mobile Computer	Devices	Computer, Device	device
MobilePhone	maltego.MobilePhone	Mobile Phone	Devices	Device	device
Smartphone	maltego.Smartphone	Smartphone	Devices	MobilePhone, Device	device

Class	Field	Display Name	Type	Matching	Value
Camera	device	Device	str	strict	yes
Camera	internal_serial_number	Internal Serial Number	str	strict
Camera	make	Make	str	strict
Camera	model	Model	str	strict
Camera	serial_number	Serial Number	str	strict
Computer	device	Device	str	loose	yes
DesktopComputer	device	Device	str	loose
DesktopComputer	id	ID	str	strict	yes
Device	device	Device	str	loose	yes
Lens	device	Device	str	strict	yes
Lens	lens_id	Id	str	strict
Lens	model	Model	str	strict
Lens	serial_number	Serial Number	str	strict
MobileComputer	device	Device	str	loose	yes
MobilePhone	device	Device	str	loose	yes
Smartphone	device	Device	str	loose	yes

Events

Class	Type ID	Display Name	Module	Base	Value Property
Conversation	maltego.Conversation	Conversation	Events		title
ConversationEmail	maltego.ConversationEmail	Conversation (Email)	Events	Conversation	title
ConversationPhone	maltego.ConversationPhone	Conversation (Phone)	Events	Conversation	title
DateTime	maltego.DateTime	DateTime	Events		datetime
Event	maltego.Event	Event	Events	Location	title
Incident	maltego.Incident	Incident	Events	Event, Location	title
Meeting	maltego.Meeting	Meeting	Events	Event, Location	title
MeetingBusiness	maltego.MeetingBusiness	Meeting (Business)	Events	Meeting, Event, Location	title
MeetingSocial	maltego.MeetingSocial	Meeting (Social)	Events	Meeting, Event, Location	title

Class	Field	Display Name	Type	Matching	Value
Conversation	people	People	list[str]	loose
Conversation	title	Title	str	loose	yes
ConversationEmail	email	Sender Email	str	loose
ConversationEmail	people	People	list[str]	loose
ConversationEmail	email.recipients	Recipient Emails	list[str]	loose
ConversationEmail	title	Title	str	loose	yes
ConversationPhone	phonenumber.callee	Callee Number	str	loose
ConversationPhone	phonenumber.caller	Caller Number	str	loose
ConversationPhone	duration	Duration	daterange	loose
ConversationPhone	people	People	list[str]	loose
ConversationPhone	starttime	Start time	datetime	loose
ConversationPhone	title	Title	str	loose	yes
DateTime	date	Date	str	loose
DateTime	datetime	Datetime	str	loose	yes
DateTime	day	Day	str	loose
DateTime	display	Display	str	loose
DateTime	hour	Hour	str	loose
DateTime	minute	Minute	str	loose
DateTime	month	Month	str	loose
DateTime	offset	UTC Offset	str	loose
DateTime	second	Second	str	loose
DateTime	time	Time	str	loose
DateTime	year	Year	str	loose
Event	location.area	Area	str	strict
Event	location.areacode	Area Code	str	strict
Event	city	City	str	strict
Event	country	Country	str	strict
Event	countrycode	Country Code	str	strict
Event	latitude	Latitude	float	strict
Event	longitude	Longitude	float	strict
Event	location.name	Name	str	strict
Event	starttime	Start Time	datetime	loose
Event	stoptime	Stop Time	datetime	loose
Event	streetaddress	Street Address	str	strict
Event	title	Title	str	loose	yes
Incident	location.area	Area	str	strict
Incident	location.areacode	Area Code	str	strict
Incident	city	City	str	strict
Incident	country	Country	str	strict
Incident	countrycode	Country Code	str	strict
Incident	latitude	Latitude	float	strict
Incident	longitude	Longitude	float	strict
Incident	location.name	Name	str	strict
Incident	starttime	Start Time	datetime	loose
Incident	stoptime	Stop Time	datetime	loose
Incident	streetaddress	Street Address	str	strict
Incident	title	Title	str	loose	yes
Meeting	location.area	Area	str	strict
Meeting	location.areacode	Area Code	str	strict
Meeting	city	City	str	strict
Meeting	country	Country	str	strict
Meeting	countrycode	Country Code	str	strict
Meeting	latitude	Latitude	float	strict
Meeting	longitude	Longitude	float	strict
Meeting	location.name	Name	str	strict
Meeting	people	People	list[str]	loose
Meeting	starttime	Start Time	datetime	loose
Meeting	stoptime	Stop Time	datetime	loose
Meeting	streetaddress	Street Address	str	strict
Meeting	title	Title	str	loose	yes
MeetingBusiness	location.area	Area	str	strict
MeetingBusiness	location.areacode	Area Code	str	strict
MeetingBusiness	city	City	str	strict
MeetingBusiness	country	Country	str	strict
MeetingBusiness	countrycode	Country Code	str	strict
MeetingBusiness	latitude	Latitude	float	strict
MeetingBusiness	longitude	Longitude	float	strict
MeetingBusiness	location.name	Name	str	strict
MeetingBusiness	people	People	list[str]	loose
MeetingBusiness	starttime	Start Time	datetime	loose
MeetingBusiness	stoptime	Stop Time	datetime	loose
MeetingBusiness	streetaddress	Street Address	str	strict
MeetingBusiness	title	Title	str	loose	yes
MeetingSocial	location.area	Area	str	strict
MeetingSocial	location.areacode	Area Code	str	strict
MeetingSocial	city	City	str	strict
MeetingSocial	country	Country	str	strict
MeetingSocial	countrycode	Country Code	str	strict
MeetingSocial	latitude	Latitude	float	strict
MeetingSocial	longitude	Longitude	float	strict
MeetingSocial	location.name	Name	str	strict
MeetingSocial	people	People	list[str]	loose
MeetingSocial	starttime	Start Time	datetime	loose
MeetingSocial	stoptime	Stop Time	datetime	loose
MeetingSocial	streetaddress	Street Address	str	strict
MeetingSocial	title	Title	str	loose	yes

Groups

Class	Type ID	Display Name	Module	Base	Value Property
Company	maltego.Company	Company	Groups	Organization	title
EducationInstitution	maltego.EducationInstitution	Education Institution	Groups	Organization	title
Gang	maltego.Gang	Gang	Groups	Organization	title
Industry	maltego.Industry	Industry	Groups		name
OnlineGroup	maltego.OnlineGroup	Online Group	Groups		title
Organization	maltego.Organization	Organization	Groups		title
PoliticalMovement	maltego.PoliticalMovement	Political Movement	Groups	Organization	title
ReligiousGroup	maltego.ReligiousGroup	Religious Group	Groups	Organization	title

Class	Field	Display Name	Type	Matching	Value
Company	title	Name	str	strict	yes
EducationInstitution	title	Name	str	strict	yes
Gang	title	Name	str	strict	yes
Industry	isic	ISIC	str	loose
Industry	nace2	NACE Rev. 2	str	loose
Industry	naics	NAICS	str	loose
Industry	name	Name	str	strict	yes
OnlineGroup	title	Name	str	strict	yes
OnlineGroup	url	URL	str	loose
Organization	title	Name	str	strict	yes
PoliticalMovement	title	Name	str	strict	yes
ReligiousGroup	title	Name	str	strict	yes

Infrastructure

Class	Type ID	Display Name	Module	Base	Value Property
AAAARecord	maltego.AAAARecord	AAAA Record	Infrastructure	DNSName	fqdn
ARecord	maltego.ARecord	A Record	Infrastructure	DNSName	fqdn
AS	maltego.AS	AS	Infrastructure		as.number
Banner	maltego.Banner	Banner	Infrastructure	Phrase	banner.text
CIDR	maltego.CIDR	Netblock CIDR	Infrastructure		cidr
CPE	maltego.CPE	CPE	Infrastructure		text
CVE	maltego.CVE	CVE	Infrastructure	Phrase	text
CWE	maltego.CWE	CWE	Infrastructure		text
DNSName	maltego.DNSName	DNS Name	Infrastructure		fqdn
Domain	maltego.Domain	Domain	Infrastructure		fqdn
IPv4Address	maltego.IPv4Address	IPv4 Address	Infrastructure		ipv4-address
IPv6Address	maltego.IPv6Address	IPv6 Address	Infrastructure		ipv6-address
ISP	maltego.ISP	ISP	Infrastructure	Company, Organization	title
MXRecord	maltego.MXRecord	MX Record	Infrastructure	DNSName	fqdn
MacAddress	maltego.MacAddress	MAC Address	Infrastructure		macaddress
NSRecord	maltego.NSRecord	NS Record	Infrastructure	DNSName	fqdn
Netblock	maltego.Netblock	Netblock	Infrastructure		ipv4-range
Port	maltego.Port	Port	Infrastructure		port.number
Service	maltego.Service	Service	Infrastructure		service.name
Software	maltego.Software	Software	Infrastructure		name
URL	maltego.URL	URL	Infrastructure		url
UniqueIdentifier	maltego.UniqueIdentifier	Tracking Code	Infrastructure		properties.uniqueidentifier
WHOISRecord	maltego.WHOISRecord	WHOIS Record	Infrastructure		name
WebTitle	maltego.WebTitle	Website Title	Infrastructure		title
Website	maltego.Website	Website	Infrastructure	DNSName	fqdn
X509Certificate	maltego.X509Certificate	SSL Certificate	Infrastructure		subject

Class	Field	Display Name	Type	Matching	Value
AAAARecord	fqdn	DNS Name	str	strict	yes
AAAARecord	ipv6-address	IPv6 Address	str	strict
AAAARecord	time-to-live	Time to Live (TTL)	int	loose
ARecord	fqdn	DNS Name	str	strict	yes
ARecord	ipv4-address	IPv4 Address	str	strict
ARecord	time-to-live	Time to Live (TTL)	int	loose
AS	as.number	AS Number	str	strict	yes
Banner	banner.text	Service banner	str	strict	yes
Banner	text	Text	str	strict
CIDR	cidr	CIDR Range	str	strict	yes
CPE	names	CPE Names	str	loose
CPE	text	CPE	str	loose	yes
CPE	version	Version	str	loose
CPE	vulnerable	Vulnerable	str	loose
CVE	cvss	CVSS	float	loose
CVE	cvssRatingColor	CVSS Rating Color	Color	loose
CVE	epss	EPSS	float	loose
CVE	text	CVE	str	strict	yes
CWE	text	CWE	str	strict	yes
DNSName	fqdn	DNS Name	str	strict	yes
Domain	fqdn	Domain Name	str	strict	yes
Domain	whois-info	WHOIS Info	str	loose
IPv4Address	ipaddress.internal	Internal	bool	loose
IPv4Address	ipv4-address	IP Address	str	strict	yes
IPv6Address	ipaddress.internal	Internal	bool	loose
IPv6Address	ipv6-address	IP Address	str	strict	yes
ISP	title	Name	str	strict	yes
MXRecord	fqdn	MX Record	str	strict	yes
MXRecord	mxrecord.priority	Priority	int	loose
MacAddress	macaddress	MAC Address	str	strict	yes
NSRecord	fqdn	NS Record	str	strict	yes
Netblock	ipv4-range	IP Range	str	loose	yes
Port	port.number	Port number	int	strict	yes
Port	properties.port	Port	str	loose
Service	service.name	Description	str	strict	yes
Service	port.number	Port	int	strict
Service	properties.service	Service	str	loose
Service	banner.text	Service banner	str	loose
Software	name	Name	str	strict	yes
Software	version	Version	str	strict
URL	short-title	Short title	str	loose
URL	title	Title	str	loose
URL	url	URL	Url	strict	yes
UniqueIdentifier	identifierType	Identifier Type	str	loose
UniqueIdentifier	properties.uniqueidentifier	UniqueIdentifier	str	strict	yes
WHOISRecord	adminAddress	Admin Address	str	loose
WHOISRecord	adminCity	Admin City	str	loose
WHOISRecord	adminCountry	Admin Country	str	loose
WHOISRecord	adminCountryCode	Admin Country Code	str	loose
WHOISRecord	adminEmail	Admin Email	str	loose
WHOISRecord	adminFax	Admin Fax	str	loose
WHOISRecord	adminFaxExt	Admin Fax Ext	str	loose
WHOISRecord	adminId	Admin ID	str	loose
WHOISRecord	adminName	Admin Name	str	loose
WHOISRecord	adminOrganization	Admin Organization	str	loose
WHOISRecord	adminPhone	Admin Phone	str	loose
WHOISRecord	adminPhoneExt	Admin Phone Ext	str	loose
WHOISRecord	adminPostalCode	Admin Postal Code	str	loose
WHOISRecord	adminStateProvince	Admin State/Province	str	loose
WHOISRecord	adminStreet	Admin Street	str	loose
WHOISRecord	createdBy	Created By	str	loose
WHOISRecord	creationDate	Created Date	str	loose
WHOISRecord	dnssec	DNSSEC	str	loose
WHOISRecord	domainName	Domain Name	str	loose
WHOISRecord	domainStatus	Domain Status	str	loose
WHOISRecord	ensAuthId	ENS AuthId	str	loose
WHOISRecord	entityVersion	Maltego Entity Version	str	loose
WHOISRecord	maintainer	Mantainer	str	loose
WHOISRecord	name	Name	str	loose	yes
WHOISRecord	nameserverIpAddresses	Name Server IP Addresses	str	loose
WHOISRecord	nameservers	Nameservers	str	loose
WHOISRecord	registrantAddress	Registrant Address	str	loose
WHOISRecord	registrantCity	Registrant City	str	loose
WHOISRecord	registrantCountry	Registrant Country	str	loose
WHOISRecord	registrantCountryCode	Registrant Country Code	str	loose
WHOISRecord	registrantEmail	Registrant Email	str	loose
WHOISRecord	registrantFax	Registrant Fax	str	loose
WHOISRecord	registrantFaxExt	Registrant Fax Ext	str	loose
WHOISRecord	registrantName	Registrant Name	str	loose
WHOISRecord	registrantOrganization	Registrant Organization	str	loose
WHOISRecord	registrantPhone	Registrant Phone	str	loose
WHOISRecord	registrantPhoneExt	Registrant Phone Ext	str	loose
WHOISRecord	registrantPostalCode	Registrant Postal Code	str	loose
WHOISRecord	registrantStateProvince	Registrant State/Province	str	loose
WHOISRecord	registrantStreet	Registrant Street	str	loose
WHOISRecord	registrar	Registrar	str	loose
WHOISRecord	registrarAbuseContactEmail	Registrar Abuse Contact Email	str	loose
WHOISRecord	registrarAbuseContactPhone	Registrar Abuse Contact Phone	str	loose
WHOISRecord	registrarAddress	Registrar Address	str	loose
WHOISRecord	registrarCity	Registrar City	str	loose
WHOISRecord	registrarCountry	Registrar Country	str	loose
WHOISRecord	registrarEmail	Registrar Email	str	loose
WHOISRecord	registrarFax	Registrar Fax	str	loose
WHOISRecord	registrarFaxExt	Registrar Fax Ext	str	loose
WHOISRecord	registrarIanaId	Registrar IANA ID	str	loose
WHOISRecord	registrarId	Registrar ID	str	loose
WHOISRecord	registrarPhone	Registrar Phone	str	loose
WHOISRecord	registrarPostalCode	Registrar Postal Code	str	loose
WHOISRecord	registrarRegistrationExpirationDate	Registrar Registration Expiration Date	str	loose
WHOISRecord	registrarStateProvince	Registrar State/Province	str	loose
WHOISRecord	registrarStatus	Registrar Status	str	loose
WHOISRecord	registrarUrl	Registrar URL	str	loose
WHOISRecord	registrarWhoisServer	Registrar WHOIS Server	str	loose
WHOISRecord	registryAdminId	Admin ID	str	loose
WHOISRecord	registryDomainId	Registry Domain ID	str	loose
WHOISRecord	registryExpiryDate	Registry Expiry Date	str	loose
WHOISRecord	registryRegistrantId	Registry Registrant ID	str	loose
WHOISRecord	registryTechId	Tech ID	str	loose
WHOISRecord	sponsoringRegistrar	Sponsoring Registrar	str	loose
WHOISRecord	techAddress	Tech Address	str	loose
WHOISRecord	techCity	Tech City	str	loose
WHOISRecord	techCountry	Tech Country	str	loose
WHOISRecord	techEmail	Tech Email	str	loose
WHOISRecord	techFax	Tech Fax	str	loose
WHOISRecord	techFaxExt	Tech Fax Ext	str	loose
WHOISRecord	techName	Tech Name	str	loose
WHOISRecord	techOrganization	Tech Organization	str	loose
WHOISRecord	techPhone	Tech Phone	str	loose
WHOISRecord	techPhoneExt	Tech Phone Ext	str	loose
WHOISRecord	techPostalCode	Tech Postal Code	str	loose
WHOISRecord	techStateProvince	Tech State/Province	str	loose
WHOISRecord	transferDate	Transfer Date	str	loose
WHOISRecord	updatedBy	Updated By	str	loose
WHOISRecord	updatedDate	Updated Date	str	loose
WHOISRecord	whoisInfo	WHOIS Info	str	loose
WebTitle	title	Title	str	loose	yes
Website	fqdn	Website	str	strict	yes
Website	ports	Ports	list[int]	loose
Website	website.ssl-enabled	SSL Enabled	bool	loose
X509Certificate	aki	AKI	str	loose
X509Certificate	country	Country	str	loose
X509Certificate	issuanceId	Issuance ID	str	loose
X509Certificate	issuer	Issuer	str	loose
X509Certificate	issuerDN	Issuer DN	str	loose
X509Certificate	organization	Organization	str	loose
X509Certificate	san	SAN	list[str]	loose
X509Certificate	serial	Serial	str	strict
X509Certificate	ski	SKI	str	loose
X509Certificate	subject	Subject	str	loose	yes
X509Certificate	subjectDN	Subject DN	str	loose
X509Certificate	usage	Usage	list[str]	loose
X509Certificate	validFrom	Valid From	str	loose
X509Certificate	validTo	Valid Until	str	loose

Locations

Class	Type ID	Display Name	Module	Base	Value Property
Airport	maltego.Airport	Airport	Locations	TransportHub, Location	location.name
Church	maltego.Church	Church	Locations	Location	location.name
CircularArea	maltego.CircularArea	Circular Area	Locations		area.circular
City	maltego.City	City	Locations	Location	location.name
Country	maltego.Country	Country	Locations	Location	location.name
CrimeScene	maltego.CrimeScene	Crime Scene	Locations	Location	location.name
GPS	maltego.GPS	GPS Coordinate	Locations		gps.coordinate
Harbor	maltego.Harbor	Harbor	Locations	TransportHub, Location	location.name
Home	maltego.Home	Home	Locations	Location	location.name
Location	maltego.Location	Location	Locations		location.name
Office	maltego.Office	Office	Locations	Location	location.name
Prison	maltego.Prison	Prison	Locations	Location	location.name
Region	maltego.Region	Region	Locations	Location	location.name
Shop	maltego.Shop	Shop	Locations	Location	location.name
TrainStation	maltego.TrainStation	Train Station	Locations	TransportHub, Location	location.name
TransportHub	maltego.TransportHub	Transport Hub	Locations	Location	location.name

Class	Field	Display Name	Type	Matching	Value
Airport	location.area	Area	str	strict
Airport	location.areacode	Area Code	str	strict
Airport	city	City	str	strict
Airport	country	Country	str	strict
Airport	countrycode	Country Code	str	strict
Airport	latitude	Latitude	float	strict
Airport	longitude	Longitude	float	strict
Airport	location.name	Name	str	loose	yes
Airport	streetaddress	Street Address	str	strict
Church	location.area	Area	str	strict
Church	location.areacode	Area Code	str	strict
Church	city	City	str	loose
Church	country	Country	str	loose
Church	countrycode	Country Code	str	loose
Church	latitude	Latitude	float	strict
Church	longitude	Longitude	float	strict
Church	location.name	Name	str	loose	yes
Church	streetaddress	Street Address	str	strict
CircularArea	area.circular	Circular Area	str	loose	yes
CircularArea	latitude	Latitude	float	loose
CircularArea	longitude	Longitude	float	loose
CircularArea	radius	Radius (m)	int	loose
City	location.area	Area	str	strict
City	location.areacode	Area Code	str	strict
City	city	City	str	strict
City	country	Country	str	strict
City	countrycode	Country Code	str	strict
City	latitude	Latitude	float	strict
City	longitude	Longitude	float	strict
City	location.name	Name	str	strict	yes
City	streetaddress	Street Address	str	strict
Country	location.area	Area	str	strict
Country	location.areacode	Area Code	str	strict
Country	city	City	str	loose
Country	country	Country	str	loose
Country	countrycode	Country Code	str	strict
Country	latitude	Latitude	float	strict
Country	longitude	Longitude	float	strict
Country	location.name	Name	str	strict	yes
Country	streetaddress	Street Address	str	strict
CrimeScene	location.area	Area	str	strict
CrimeScene	location.areacode	Area Code	str	strict
CrimeScene	city	City	str	strict
CrimeScene	country	Country	str	strict
CrimeScene	countrycode	Country Code	str	strict
CrimeScene	latitude	Latitude	float	strict
CrimeScene	longitude	Longitude	float	strict
CrimeScene	location.name	Name	str	strict	yes
CrimeScene	streetaddress	Street Address	str	strict
GPS	gps.coordinate	GPS Coordinate	str	loose	yes
GPS	latitude	Latitude	float	loose
GPS	longitude	Longitude	float	loose
Harbor	location.area	Area	str	strict
Harbor	location.areacode	Area Code	str	strict
Harbor	city	City	str	loose
Harbor	country	Country	str	loose
Harbor	countrycode	Country Code	str	loose
Harbor	latitude	Latitude	float	strict
Harbor	longitude	Longitude	float	strict
Harbor	location.name	Name	str	loose	yes
Harbor	streetaddress	Street Address	str	strict
Home	location.area	Area	str	strict
Home	location.areacode	Area Code	str	strict
Home	city	City	str	strict
Home	country	Country	str	strict
Home	countrycode	Country Code	str	strict
Home	latitude	Latitude	float	strict
Home	longitude	Longitude	float	strict
Home	location.name	Name	str	strict	yes
Home	streetaddress	Street Address	str	strict
Location	location.area	Area	str	strict
Location	location.areacode	Area Code	str	strict
Location	city	City	str	strict
Location	country	Country	str	strict
Location	countrycode	Country Code	str	strict
Location	latitude	Latitude	float	strict
Location	longitude	Longitude	float	strict
Location	location.name	Name	str	strict	yes
Location	streetaddress	Street Address	str	strict
Office	location.area	Area	str	strict
Office	location.areacode	Area Code	str	strict
Office	city	City	str	strict
Office	country	Country	str	strict
Office	countrycode	Country Code	str	strict
Office	latitude	Latitude	float	strict
Office	longitude	Longitude	float	strict
Office	location.name	Name	str	strict	yes
Office	streetaddress	Street Address	str	strict
Prison	location.area	Area	str	strict
Prison	location.areacode	Area Code	str	strict
Prison	city	City	str	loose
Prison	country	Country	str	loose
Prison	countrycode	Country Code	str	loose
Prison	latitude	Latitude	float	strict
Prison	longitude	Longitude	float	strict
Prison	location.name	Name	str	loose	yes
Prison	streetaddress	Street Address	str	strict
Region	location.area	Area	str	strict
Region	location.areacode	Area Code	str	strict
Region	city	City	str	loose
Region	country	Country	str	loose
Region	countrycode	Country Code	str	loose
Region	latitude	Latitude	float	strict
Region	longitude	Longitude	float	strict
Region	location.name	Name	str	loose	yes
Region	streetaddress	Street Address	str	strict
Shop	location.area	Area	str	strict
Shop	location.areacode	Area Code	str	strict
Shop	city	City	str	loose
Shop	country	Country	str	loose
Shop	countrycode	Country Code	str	loose
Shop	latitude	Latitude	float	strict
Shop	longitude	Longitude	float	strict
Shop	location.name	Name	str	loose	yes
Shop	streetaddress	Street Address	str	strict
TrainStation	location.area	Area	str	strict
TrainStation	location.areacode	Area Code	str	strict
TrainStation	city	City	str	strict
TrainStation	country	Country	str	strict
TrainStation	countrycode	Country Code	str	strict
TrainStation	latitude	Latitude	float	strict
TrainStation	longitude	Longitude	float	strict
TrainStation	location.name	Name	str	loose	yes
TrainStation	streetaddress	Street Address	str	strict
TransportHub	location.area	Area	str	strict
TransportHub	location.areacode	Area Code	str	strict
TransportHub	city	City	str	strict
TransportHub	country	Country	str	strict
TransportHub	countrycode	Country Code	str	strict
TransportHub	latitude	Latitude	float	strict
TransportHub	longitude	Longitude	float	strict
TransportHub	location.name	Name	str	loose	yes
TransportHub	streetaddress	Street Address	str	strict

Malware

Class	Type ID	Display Name	Module	Base	Value Property
AttackPattern	maltego.AttackPattern	Attack Pattern	Malware	TTP	name
CVSS	maltego.CVSS	CVSS	Malware		base_score
EPSS	maltego.EPSS	EPSS	Malware		cve
Hash	maltego.Hash	Hash	Malware		properties.hash
Infrastructure	maltego.Infrastructure	Infrastructure	Malware	TTP	name
JARMFingerprint	maltego.JARMFingerprint	JARM Fingerprint	Malware	Hash	jarm_fingerprint
Malware	maltego.Malware	Malware	Malware	TTP	name
MalwareFamily	maltego.MalwareFamily	Malware Family	Malware		name
MalwareSignature	maltego.MalwareSignature	Malware Signature	Malware		malware_signature
TTP	maltego.TTP	TTP (Tactics, Techniques, and Procedures)	Malware		name

Class	Field	Display Name	Type	Matching	Value
AttackPattern	attack_technique_id	Attack ID	str	strict
AttackPattern	kill_chain_phases	Kill Chain Phases	list[str]	loose
AttackPattern	name	Name	str	strict	yes
CVSS	access_vector	Access Vector	str	loose
CVSS	base_score	Base Score	float	loose	yes
CVSS	base_severity	Base Severity	str	loose
CVSS	exploitability_score	Exploitability Score	float	loose
CVSS	impact_score	Impact Score	float	loose
CVSS	overlay_colour	Overlay Colour	str	strict
CVSS	vector_string	Vector String	str	loose
CVSS	version	Version	str	loose
EPSS	cve	CVE	str	strict	yes
EPSS	epss	EPSS	float	loose
Hash	properties.hash	Hash	str	strict	yes
Hash	hash_type	Hash Type	str	loose
Infrastructure	kill_chain_phases	Kill Chain Phases	list[str]	loose
Infrastructure	name	Name	str	strict	yes
JARMFingerprint	properties.hash	Hash	str	strict
JARMFingerprint	hash_type	Hash Type	str	loose
JARMFingerprint	jarm_fingerprint	JARM Fingerprint	str	strict	yes
Malware	kill_chain_phases	Kill Chain Phases	list[str]	loose
Malware	name	Name	str	strict	yes
MalwareFamily	author	Author	str	loose
MalwareFamily	category	Category	str	loose
MalwareFamily	name	Name	str	loose	yes
MalwareFamily	platform	Platform	str	loose
MalwareSignature	malware_signature	Malware Signature	str	strict	yes
MalwareSignature	signature_type	Signature Type	str	loose
TTP	kill_chain_phases	Kill Chain Phases	list[str]	loose
TTP	name	Name	str	strict	yes

Personal

Class	Type ID	Display Name	Module	Base	Value Property
BadGuy	maltego.BadGuy	BadGuy	Casefile	Person	person.fullname
BusinessLeader	maltego.BusinessLeader	BusinessLeader	Casefile	Businessman, Person	person.fullname
Businessman	maltego.Businessman	Businessman	Casefile	Person	person.fullname
Child	maltego.Child	Child	Casefile	Person	person.fullname
DrugDealer	maltego.DrugDealer	DrugDealer	Casefile	BadGuy, Person	person.fullname
Female	maltego.Female	Female	Casefile	Person	person.fullname
GangLeader	maltego.GangLeader	GangLeader	Casefile	GangMember, BadGuy, Person	person.fullname
GangMember	maltego.GangMember	GangMember	Casefile	BadGuy, Person	person.fullname
GoodGuy	maltego.GoodGuy	GoodGuy	Casefile	Person	person.fullname
GovernmentOfficial	maltego.GovernmentOfficial	GovernmentOfficial	Casefile	Person	person.fullname
Judge	maltego.Judge	Judge	Casefile	GoodGuy, Person	person.fullname
LawOfficer	maltego.LawOfficer	LawOfficer	Casefile	GoodGuy, Person	person.fullname
Lawyer	maltego.Lawyer	Lawyer	Casefile	Person	person.fullname
Male	maltego.Male	Male	Casefile	Person	person.fullname
MilitaryOfficer	maltego.MilitaryOfficer	MilitaryOfficer	Casefile	GoodGuy, Person	person.fullname
SexOffender	maltego.SexOffender	SexOffender	Casefile	BadGuy, Person	person.fullname
Terrorist	maltego.Terrorist	Terrorist	Casefile	BadGuy, Person	person.fullname
TerroristLeader	maltego.TerroristLeader	TerroristLeader	Casefile	Terrorist, BadGuy, Person	person.fullname
Unsub	maltego.Unsub	Unsub	Casefile	BadGuy, Person	person.fullname
Item	maltego.Item	Item	Core	Thing	thing_value
Thing	maltego.Thing	Thing	Core		thing_value
Alias	maltego.Alias	Alias	Personal	OnlineIdentifier, Identifier	alias
Document	maltego.Document	Document	Personal		url
EmailAddress	maltego.EmailAddress	Email Address	Personal	OnlineIdentifier, Identifier	email
File	maltego.File	File	Personal		description
HashPassword	maltego.HashPassword	Hash Password	Personal	Phrase	text
Identifier	maltego.Identifier	Identifier	Personal		is_partial
Image	maltego.Image	Image	Personal		description
InternalIdentifier	maltego.InternalIdentifier	Internal Identifier	Personal	OnlineIdentifier, Identifier	internal_identifier
Name	maltego.Name	Name	Personal	OnlineIdentifier, Identifier	name
OnlineIdentifier	maltego.OnlineIdentifier	Online Identifier	Personal	Identifier	is_partial
Person	maltego.Person	Person	Personal		person.fullname
PhoneNumber	maltego.PhoneNumber	Phone Number	Personal	OnlineIdentifier, Identifier	phonenumber
PhoneNumberMobile	maltego.PhoneNumberMobile	Phone Number (Mobile)	Personal	PhoneNumber, OnlineIdentifier, Identifier	phonenumber
PhoneNumberOffice	maltego.PhoneNumberOffice	Phone Number (Office)	Personal	PhoneNumber, OnlineIdentifier, Identifier	phonenumber
PhoneNumberResidential	maltego.PhoneNumberResidential	Phone Number (Residential)	Personal	PhoneNumber, OnlineIdentifier, Identifier	phonenumber
Phrase	maltego.Phrase	Phrase	Personal		text
PlaintextPassword	maltego.PlaintextPassword	Plaintext Password	Personal	Phrase	text
Sentiment	maltego.Sentiment	Sentiment	Personal		properties.sentiment
Tag	maltego.Tag	Tag	Personal	Phrase	text

Class	Field	Display Name	Type	Matching	Value
BadGuy	person.firstnames	First Names	str	loose
BadGuy	person.fullname	Full Name	str	loose	yes
BadGuy	person.lastname	Surname	str	loose
BusinessLeader	person.firstnames	First Names	str	loose
BusinessLeader	person.fullname	Full Name	str	loose	yes
BusinessLeader	person.lastname	Surname	str	loose
Businessman	person.firstnames	First Names	str	loose
Businessman	person.fullname	Full Name	str	loose	yes
Businessman	person.lastname	Surname	str	loose
Child	person.firstnames	First Names	str	loose
Child	person.fullname	Full Name	str	loose	yes
Child	person.lastname	Surname	str	loose
DrugDealer	person.firstnames	First Names	str	loose
DrugDealer	person.fullname	Full Name	str	loose	yes
DrugDealer	person.lastname	Surname	str	loose
Female	person.firstnames	First Names	str	loose
Female	person.fullname	Full Name	str	loose	yes
Female	person.lastname	Surname	str	loose
GangLeader	person.firstnames	First Names	str	loose
GangLeader	person.fullname	Full Name	str	loose	yes
GangLeader	person.lastname	Surname	str	loose
GangMember	person.firstnames	First Names	str	loose
GangMember	person.fullname	Full Name	str	loose	yes
GangMember	person.lastname	Surname	str	loose
GoodGuy	person.firstnames	First Names	str	loose
GoodGuy	person.fullname	Full Name	str	loose	yes
GoodGuy	person.lastname	Surname	str	loose
GovernmentOfficial	person.firstnames	First Names	str	loose
GovernmentOfficial	person.fullname	Full Name	str	loose	yes
GovernmentOfficial	person.lastname	Surname	str	loose
Judge	person.firstnames	First Names	str	loose
Judge	person.fullname	Full Name	str	loose	yes
Judge	person.lastname	Surname	str	loose
LawOfficer	person.firstnames	First Names	str	loose
LawOfficer	person.fullname	Full Name	str	loose	yes
LawOfficer	person.lastname	Surname	str	loose
Lawyer	person.firstnames	First Names	str	loose
Lawyer	person.fullname	Full Name	str	loose	yes
Lawyer	person.lastname	Surname	str	loose
Male	person.firstnames	First Names	str	loose
Male	person.fullname	Full Name	str	loose	yes
Male	person.lastname	Surname	str	loose
MilitaryOfficer	person.firstnames	First Names	str	loose
MilitaryOfficer	person.fullname	Full Name	str	loose	yes
MilitaryOfficer	person.lastname	Surname	str	loose
SexOffender	person.firstnames	First Names	str	loose
SexOffender	person.fullname	Full Name	str	loose	yes
SexOffender	person.lastname	Surname	str	loose
Terrorist	person.firstnames	First Names	str	loose
Terrorist	person.fullname	Full Name	str	loose	yes
Terrorist	person.lastname	Surname	str	loose
TerroristLeader	person.firstnames	First Names	str	loose
TerroristLeader	person.fullname	Full Name	str	loose	yes
TerroristLeader	person.lastname	Surname	str	loose
Unsub	person.firstnames	First Names	str	loose
Unsub	person.fullname	Full Name	str	loose	yes
Unsub	person.lastname	Surname	str	loose
Item	thing_value	Thing value	str	strict	yes
Thing	thing_value	Thing value	str	strict	yes
Alias	alias	Alias	str	strict	yes
Alias	is_partial	Is Partial	bool	loose
Document	document.meta-data	Meta-Data	str	loose
Document	title	Title	str	loose
Document	url	URL	Url	loose	yes
EmailAddress	email	Email Address	str	strict	yes
EmailAddress	is_partial	Is Partial	bool	loose
File	description	Description	str	loose	yes
File	source	Source	Url	strict
HashPassword	encrypt_method	Encryption Method	str	loose
HashPassword	text	Text	str	strict	yes
Identifier	is_partial	Is Partial	bool	loose	yes
Image	base64	Base64	str	strict
Image	description	Description	str	loose	yes
Image	url	URL	Url	strict
InternalIdentifier	internal_identifier	Internal Identifier	str	loose	yes
InternalIdentifier	is_partial	Is Partial	bool	loose
Name	is_partial	Is Partial	bool	loose
Name	name	Name	str	loose	yes
OnlineIdentifier	is_partial	Is Partial	bool	loose	yes
Person	person.firstnames	First Names	str	loose
Person	person.fullname	Full Name	str	loose	yes
Person	person.lastname	Surname	str	loose
PhoneNumber	phonenumber.areacode	Area Code	str	loose
PhoneNumber	phonenumber.citycode	City Code	str	loose
PhoneNumber	phonenumber.countrycode	Country Code	str	loose
PhoneNumber	is_partial	Is Partial	bool	loose
PhoneNumber	phonenumber.lastnumbers	Last Digits	str	loose
PhoneNumber	phonenumber	Phone Number	str	strict	yes
PhoneNumberMobile	phonenumber.areacode	Area Code	str	loose
PhoneNumberMobile	phonenumber.citycode	City Code	str	loose
PhoneNumberMobile	phonenumber.countrycode	Country Code	str	loose
PhoneNumberMobile	is_partial	Is Partial	bool	loose
PhoneNumberMobile	phonenumber.lastnumbers	Last Digits	str	loose
PhoneNumberMobile	phonenumber	Phone Number	str	strict	yes
PhoneNumberOffice	phonenumber.areacode	Area Code	str	loose
PhoneNumberOffice	phonenumber.citycode	City Code	str	loose
PhoneNumberOffice	phonenumber.countrycode	Country Code	str	loose
PhoneNumberOffice	is_partial	Is Partial	bool	loose
PhoneNumberOffice	phonenumber.lastnumbers	Last Digits	str	loose
PhoneNumberOffice	phonenumber	Phone Number	str	strict	yes
PhoneNumberResidential	phonenumber.areacode	Area Code	str	loose
PhoneNumberResidential	phonenumber.citycode	City Code	str	loose
PhoneNumberResidential	phonenumber.countrycode	Country Code	str	loose
PhoneNumberResidential	is_partial	Is Partial	bool	loose
PhoneNumberResidential	phonenumber.lastnumbers	Last Digits	str	loose
PhoneNumberResidential	phonenumber	Phone Number	str	strict	yes
Phrase	text	Text	str	strict	yes
PlaintextPassword	text	Text	str	strict	yes
Sentiment	properties.sentiment	Sentiment	str	loose	yes
Tag	text	Text	str	strict	yes

Class	Type ID	Display Name	Module	Base	Value Property
Affiliation	maltego.Affiliation	Affiliation	Social Network		person.name
AffiliationBebo	maltego.affiliation.Bebo	Affiliation - Bebo	Social Network	Affiliation	person.name
AffiliationDiscord	maltego.affiliation.Discord	Affiliation - Discord	Social Network	Affiliation	person.name
AffiliationDuolingo	maltego.affiliation.Duolingo	Affiliation - Duolingo	Social Network	Affiliation	person.name
AffiliationFacebook	maltego.affiliation.Facebook	Affiliation - Facebook	Social Network	Affiliation	person.name
AffiliationFitbit	maltego.affiliation.Fitbit	Affiliation - Fitbit	Social Network	Affiliation	person.name
AffiliationFlickr	maltego.affiliation.Flickr	Affiliation - Flickr	Social Network	Affiliation	person.name
AffiliationGithub	maltego.affiliation.Github	Affiliation - Github	Social Network	Affiliation	person.name
AffiliationGoogle	maltego.affiliation.Google	Affiliation - Google	Social Network	Affiliation	person.name
AffiliationInstagram	maltego.affiliation.Instagram	Affiliation - Instagram	Social Network	Affiliation	person.name
AffiliationLinkedIn	maltego.affiliation.LinkedIn	Affiliation - LinkedIn	Social Network	Affiliation	person.name
AffiliationMyspace	maltego.affiliation.Myspace	Affiliation - Myspace	Social Network	Affiliation	person.name
AffiliationNikerunclub	maltego.affiliation.Nikerunclub	Affiliation -Nikerunclub	Social Network	Affiliation	person.name
AffiliationOK	maltego.affiliation.OK	Affiliation - OK	Social Network	Affiliation	person.name
AffiliationOrkut	maltego.affiliation.Orkut	Affiliation - Orkut	Social Network	Affiliation	person.name
AffiliationPinterest	maltego.affiliation.Pinterest	Affiliation - Pinterest	Social Network	Affiliation	person.name
AffiliationQuora	maltego.affiliation.Quora	Affiliation - Quora	Social Network	Affiliation	person.name
AffiliationReddit	maltego.affiliation.Reddit	Affiliation - Reddit	Social Network	Affiliation	person.name
AffiliationRunkeeper	maltego.affiliation.Runkeeper	Affiliation - Runkeeper	Social Network	Affiliation	person.name
AffiliationRuntastic	maltego.affiliation.Runtastic	Affiliation - Runtastic	Social Network	Affiliation	person.name
AffiliationSkype	maltego.affiliation.Skype	Affiliation - Skype	Social Network	Affiliation	person.name
AffiliationSnapchat	maltego.affiliation.Snapchat	Affiliation - Snapchat	Social Network	Affiliation	person.name
AffiliationSpock	maltego.affiliation.Spock	Affiliation - Spock	Social Network	Affiliation	person.name
AffiliationStrava	maltego.affiliation.Strava	Affiliation - Strava	Social Network	Affiliation	person.name
AffiliationTelegram	maltego.affiliation.Telegram	Affiliation - Telegram	Social Network	Affiliation	person.name
AffiliationTikTok	maltego.affiliation.TikTok	Affiliation - TikTok	Social Network	Affiliation	person.name
AffiliationTwitch	maltego.affiliation.Twitch	Affiliation - Twitch	Social Network	Affiliation	person.name
AffiliationTwitter	maltego.affiliation.Twitter	Affiliation - Twitter	Social Network	Affiliation	person.name
AffiliationVKontakte	maltego.affiliation.VKontakte	Affiliation - VKontakte	Social Network	Affiliation	person.name
AffiliationVivino	maltego.affiliation.Vivino	Affiliation - Vivino	Social Network	Affiliation	person.name
AffiliationWeibo	maltego.affiliation.Weibo	Affiliation - Weibo	Social Network	Affiliation	person.name
AffiliationYouTube	maltego.affiliation.YouTube	Affiliation - YouTube	Social Network	Affiliation	person.name
FacebookObject	maltego.FacebookObject	Facebook Object	Social Network		facebook.object
Hashtag	maltego.hashtag	Hashtag	Social Network		twitter.hashtag
Twit	maltego.Twit	Tweet	Social Network		content

Class	Field	Display Name	Type	Matching	Value
Affiliation	affiliation.alias	Alias	str	strict
Affiliation	person.name	Name	str	strict	yes
Affiliation	affiliation.network	Network	str	strict
Affiliation	affiliation.profile-image	Profile Image	str	loose
Affiliation	affiliation.profile-url	Profile URL	str	loose
Affiliation	affiliation.uid	UID	str	strict
Affiliation	uid	UID	str	strict
AffiliationBebo	affiliation.alias	Alias	str	strict
AffiliationBebo	person.name	Name	str	strict	yes
AffiliationBebo	affiliation.network	Network	str	strict
AffiliationBebo	affiliation.profile-image	Profile Image	str	loose
AffiliationBebo	affiliation.profile-url	Profile URL	str	loose
AffiliationBebo	affiliation.uid	UID	str	strict
AffiliationBebo	uid	UID	str	strict
AffiliationDiscord	affiliation.alias	Alias	str	strict
AffiliationDiscord	person.name	Name	str	strict	yes
AffiliationDiscord	affiliation.network	Network	str	strict
AffiliationDiscord	affiliation.profile-image	Profile Image	str	loose
AffiliationDiscord	affiliation.profile-url	Profile URL	str	loose
AffiliationDiscord	affiliation.uid	UID	str	strict
AffiliationDiscord	uid	UID	str	strict
AffiliationDuolingo	affiliation.alias	Alias	str	strict
AffiliationDuolingo	person.name	Name	str	strict	yes
AffiliationDuolingo	affiliation.network	Network	str	strict
AffiliationDuolingo	affiliation.profile-image	Profile Image	str	loose
AffiliationDuolingo	affiliation.profile-url	Profile URL	str	loose
AffiliationDuolingo	affiliation.uid	UID	str	strict
AffiliationDuolingo	uid	UID	str	strict
AffiliationFacebook	affiliation.alias	Alias	str	strict
AffiliationFacebook	person.name	Name	str	strict	yes
AffiliationFacebook	affiliation.network	Network	str	strict
AffiliationFacebook	affiliation.profile-image	Profile Image	str	loose
AffiliationFacebook	affiliation.profile-url	Profile URL	str	loose
AffiliationFacebook	affiliation.uid	UID	str	strict
AffiliationFacebook	uid	UID	str	strict
AffiliationFitbit	affiliation.alias	Alias	str	strict
AffiliationFitbit	person.name	Name	str	strict	yes
AffiliationFitbit	affiliation.network	Network	str	strict
AffiliationFitbit	affiliation.profile-image	Profile Image	str	loose
AffiliationFitbit	affiliation.profile-url	Profile URL	str	loose
AffiliationFitbit	affiliation.uid	UID	str	strict
AffiliationFitbit	uid	UID	str	strict
AffiliationFlickr	affiliation.alias	Alias	str	strict
AffiliationFlickr	person.name	Name	str	strict	yes
AffiliationFlickr	affiliation.network	Network	str	strict
AffiliationFlickr	affiliation.profile-image	Profile Image	str	loose
AffiliationFlickr	affiliation.profile-url	Profile URL	str	loose
AffiliationFlickr	affiliation.uid	UID	str	strict
AffiliationFlickr	uid	UID	str	strict
AffiliationGithub	affiliation.alias	Alias	str	strict
AffiliationGithub	person.name	Name	str	strict	yes
AffiliationGithub	affiliation.network	Network	str	strict
AffiliationGithub	affiliation.profile-image	Profile Image	str	loose
AffiliationGithub	affiliation.profile-url	Profile URL	str	loose
AffiliationGithub	affiliation.uid	UID	str	strict
AffiliationGithub	uid	UID	str	strict
AffiliationGoogle	affiliation.alias	Alias	str	strict
AffiliationGoogle	person.name	Name	str	strict	yes
AffiliationGoogle	affiliation.network	Network	str	strict
AffiliationGoogle	affiliation.profile-image	Profile Image	str	loose
AffiliationGoogle	affiliation.profile-url	Profile URL	str	loose
AffiliationGoogle	affiliation.uid	UID	str	strict
AffiliationGoogle	uid	UID	str	strict
AffiliationInstagram	affiliation.alias	Alias	str	strict
AffiliationInstagram	person.name	Name	str	strict	yes
AffiliationInstagram	affiliation.network	Network	str	strict
AffiliationInstagram	affiliation.profile-image	Profile Image	str	loose
AffiliationInstagram	affiliation.profile-url	Profile URL	str	loose
AffiliationInstagram	affiliation.uid	UID	str	strict
AffiliationInstagram	uid	UID	str	strict
AffiliationLinkedIn	affiliation.alias	Alias	str	strict
AffiliationLinkedIn	person.name	Name	str	strict	yes
AffiliationLinkedIn	affiliation.network	Network	str	strict
AffiliationLinkedIn	affiliation.profile-image	Profile Image	str	loose
AffiliationLinkedIn	affiliation.profile-url	Profile URL	str	loose
AffiliationLinkedIn	affiliation.uid	UID	str	strict
AffiliationLinkedIn	uid	UID	str	strict
AffiliationMyspace	affiliation.alias	Alias	str	strict
AffiliationMyspace	person.name	Name	str	strict	yes
AffiliationMyspace	affiliation.network	Network	str	strict
AffiliationMyspace	affiliation.profile-image	Profile Image	str	loose
AffiliationMyspace	affiliation.profile-url	Profile URL	str	loose
AffiliationMyspace	affiliation.uid	UID	str	strict
AffiliationMyspace	uid	UID	str	strict
AffiliationNikerunclub	affiliation.alias	Alias	str	strict
AffiliationNikerunclub	person.name	Name	str	strict	yes
AffiliationNikerunclub	affiliation.network	Network	str	strict
AffiliationNikerunclub	affiliation.profile-image	Profile Image	str	loose
AffiliationNikerunclub	affiliation.profile-url	Profile URL	str	loose
AffiliationNikerunclub	affiliation.uid	UID	str	strict
AffiliationNikerunclub	uid	UID	str	strict
AffiliationOK	affiliation.alias	Alias	str	strict
AffiliationOK	person.name	Name	str	strict	yes
AffiliationOK	affiliation.network	Network	str	strict
AffiliationOK	affiliation.profile-image	Profile Image	str	loose
AffiliationOK	affiliation.profile-url	Profile URL	str	loose
AffiliationOK	affiliation.uid	UID	str	strict
AffiliationOK	uid	UID	str	strict
AffiliationOrkut	affiliation.alias	Alias	str	strict
AffiliationOrkut	person.name	Name	str	strict	yes
AffiliationOrkut	affiliation.network	Network	str	strict
AffiliationOrkut	affiliation.profile-image	Profile Image	str	loose
AffiliationOrkut	affiliation.profile-url	Profile URL	str	loose
AffiliationOrkut	affiliation.uid	UID	str	strict
AffiliationOrkut	uid	UID	str	strict
AffiliationPinterest	affiliation.alias	Alias	str	strict
AffiliationPinterest	person.name	Name	str	strict	yes
AffiliationPinterest	affiliation.network	Network	str	strict
AffiliationPinterest	affiliation.profile-image	Profile Image	str	loose
AffiliationPinterest	affiliation.profile-url	Profile URL	str	loose
AffiliationPinterest	affiliation.uid	UID	str	strict
AffiliationPinterest	uid	UID	str	strict
AffiliationQuora	affiliation.alias	Alias	str	strict
AffiliationQuora	person.name	Name	str	strict	yes
AffiliationQuora	affiliation.network	Network	str	strict
AffiliationQuora	affiliation.profile-image	Profile Image	str	loose
AffiliationQuora	affiliation.profile-url	Profile URL	str	loose
AffiliationQuora	affiliation.uid	UID	str	strict
AffiliationQuora	uid	UID	str	strict
AffiliationReddit	affiliation.alias	Alias	str	strict
AffiliationReddit	person.name	Name	str	strict	yes
AffiliationReddit	affiliation.network	Network	str	strict
AffiliationReddit	affiliation.profile-image	Profile Image	str	loose
AffiliationReddit	affiliation.profile-url	Profile URL	str	loose
AffiliationReddit	affiliation.uid	UID	str	strict
AffiliationReddit	uid	UID	str	strict
AffiliationRunkeeper	affiliation.alias	Alias	str	strict
AffiliationRunkeeper	person.name	Name	str	strict	yes
AffiliationRunkeeper	affiliation.network	Network	str	strict
AffiliationRunkeeper	affiliation.profile-image	Profile Image	str	loose
AffiliationRunkeeper	affiliation.profile-url	Profile URL	str	loose
AffiliationRunkeeper	affiliation.uid	UID	str	strict
AffiliationRunkeeper	uid	UID	str	strict
AffiliationRuntastic	affiliation.alias	Alias	str	strict
AffiliationRuntastic	person.name	Name	str	strict	yes
AffiliationRuntastic	affiliation.network	Network	str	strict
AffiliationRuntastic	affiliation.profile-image	Profile Image	str	loose
AffiliationRuntastic	affiliation.profile-url	Profile URL	str	loose
AffiliationRuntastic	affiliation.uid	UID	str	strict
AffiliationRuntastic	uid	UID	str	strict
AffiliationSkype	affiliation.alias	Alias	str	strict
AffiliationSkype	person.name	Name	str	strict	yes
AffiliationSkype	affiliation.network	Network	str	strict
AffiliationSkype	affiliation.profile-image	Profile Image	str	loose
AffiliationSkype	affiliation.profile-url	Profile URL	str	loose
AffiliationSkype	affiliation.uid	UID	str	strict
AffiliationSkype	uid	UID	str	strict
AffiliationSnapchat	affiliation.alias	Alias	str	strict
AffiliationSnapchat	person.name	Name	str	strict	yes
AffiliationSnapchat	affiliation.network	Network	str	strict
AffiliationSnapchat	affiliation.profile-image	Profile Image	str	loose
AffiliationSnapchat	affiliation.profile-url	Profile URL	str	loose
AffiliationSnapchat	affiliation.uid	UID	str	strict
AffiliationSnapchat	uid	UID	str	strict
AffiliationSpock	affiliation.alias	Alias	str	strict
AffiliationSpock	person.name	Name	str	strict	yes
AffiliationSpock	affiliation.network	Network	str	strict
AffiliationSpock	affiliation.profile-image	Profile Image	str	loose
AffiliationSpock	affiliation.profile-url	Profile URL	str	loose
AffiliationSpock	affiliation.uid	UID	str	strict
AffiliationSpock	uid	UID	str	strict
AffiliationStrava	affiliation.alias	Alias	str	strict
AffiliationStrava	person.name	Name	str	strict	yes
AffiliationStrava	affiliation.network	Network	str	strict
AffiliationStrava	affiliation.profile-image	Profile Image	str	loose
AffiliationStrava	affiliation.profile-url	Profile URL	str	loose
AffiliationStrava	affiliation.uid	UID	str	strict
AffiliationStrava	uid	UID	str	strict
AffiliationTelegram	affiliation.alias	Alias	str	strict
AffiliationTelegram	person.name	Name	str	strict	yes
AffiliationTelegram	affiliation.network	Network	str	strict
AffiliationTelegram	affiliation.profile-image	Profile Image	str	loose
AffiliationTelegram	affiliation.profile-url	Profile URL	str	loose
AffiliationTelegram	affiliation.uid	UID	str	strict
AffiliationTelegram	uid	UID	str	strict
AffiliationTikTok	affiliation.alias	Alias	str	strict
AffiliationTikTok	person.name	Name	str	strict	yes
AffiliationTikTok	affiliation.network	Network	str	strict
AffiliationTikTok	affiliation.profile-image	Profile Image	str	loose
AffiliationTikTok	affiliation.profile-url	Profile URL	str	loose
AffiliationTikTok	affiliation.uid	UID	str	strict
AffiliationTikTok	uid	UID	str	strict
AffiliationTwitch	affiliation.alias	Alias	str	strict
AffiliationTwitch	person.name	Name	str	strict	yes
AffiliationTwitch	affiliation.network	Network	str	strict
AffiliationTwitch	affiliation.profile-image	Profile Image	str	loose
AffiliationTwitch	affiliation.profile-url	Profile URL	str	loose
AffiliationTwitch	affiliation.uid	UID	str	strict
AffiliationTwitch	uid	UID	str	strict
AffiliationTwitter	affiliation.alias	Alias	str	strict
AffiliationTwitter	person.name	Name	str	strict	yes
AffiliationTwitter	affiliation.network	Network	str	strict
AffiliationTwitter	affiliation.profile-image	Profile Image	str	loose
AffiliationTwitter	affiliation.profile-url	Profile URL	str	loose
AffiliationTwitter	affiliation.uid	UID	str	strict
AffiliationTwitter	uid	UID	str	strict
AffiliationVKontakte	affiliation.alias	Alias	str	strict
AffiliationVKontakte	person.name	Name	str	strict	yes
AffiliationVKontakte	affiliation.network	Network	str	strict
AffiliationVKontakte	affiliation.profile-image	Profile Image	str	loose
AffiliationVKontakte	affiliation.profile-url	Profile URL	str	loose
AffiliationVKontakte	affiliation.uid	UID	str	strict
AffiliationVKontakte	uid	UID	str	strict
AffiliationVivino	affiliation.alias	Alias	str	strict
AffiliationVivino	person.name	Name	str	strict	yes
AffiliationVivino	affiliation.network	Network	str	strict
AffiliationVivino	affiliation.profile-image	Profile Image	str	loose
AffiliationVivino	affiliation.profile-url	Profile URL	str	loose
AffiliationVivino	affiliation.uid	UID	str	strict
AffiliationVivino	uid	UID	str	strict
AffiliationWeibo	affiliation.alias	Alias	str	strict
AffiliationWeibo	person.name	Name	str	strict	yes
AffiliationWeibo	affiliation.network	Network	str	strict
AffiliationWeibo	affiliation.profile-image	Profile Image	str	loose
AffiliationWeibo	affiliation.profile-url	Profile URL	str	loose
AffiliationWeibo	affiliation.uid	UID	str	strict
AffiliationWeibo	uid	UID	str	strict
AffiliationYouTube	affiliation.alias	Alias	str	strict
AffiliationYouTube	person.name	Name	str	strict	yes
AffiliationYouTube	affiliation.network	Network	str	strict
AffiliationYouTube	affiliation.profile-image	Profile Image	str	loose
AffiliationYouTube	affiliation.profile-url	Profile URL	str	loose
AffiliationYouTube	affiliation.uid	UID	str	strict
AffiliationYouTube	uid	UID	str	strict
FacebookObject	facebook.object	Facebook Object	str	loose	yes
Hashtag	twitter.hashtag	Hashtag	str	loose	yes
Twit	author	Author	str	loose
Twit	author_uri	Author URI	str	loose
Twit	content	Content	str	loose	yes
Twit	id	Tweet ID	str	loose
Twit	imglink	Image Link	str	loose
Twit	pubdate	Date published	str	loose
Twit	twit.name	Tweet	str	loose

STIX 2 domain objects

Class	Type ID	Display Name	Module	Base	Value Property
STIX2Core	maltego.STIX2.core	STIX2 Core	STIX 2		id
STIX2attackpattern	maltego.STIX2.attack-pattern	STIX2 Attack Pattern	STIX 2	STIX2Core	id
STIX2campaign	maltego.STIX2.campaign	STIX2 Campaign	STIX 2	Event, Location, STIX2Core	id
STIX2courseofaction	maltego.STIX2.course-of-action	STIX2 Course Of Action	STIX 2	STIX2Core	id
STIX2grouping	maltego.STIX2.grouping	STIX2 Grouping	STIX 2	STIX2Core	id
STIX2identity	maltego.STIX2.identity	STIX2 Identity	STIX 2	Organization, STIX2Core	id
STIX2incident	maltego.STIX2.incident	STIX2 Incident	STIX 2	Incident, Event, Location, STIX2Core	id
STIX2indicator	maltego.STIX2.indicator	STIX2 Indicator	STIX 2	STIX2Core	id
STIX2infrastructure	maltego.STIX2.infrastructure	STIX2 Infrastructure	STIX 2	STIX2Core	id
STIX2intrusionset	maltego.STIX2.intrusion-set	STIX2 Intrusion Set	STIX 2	STIX2Core	id
STIX2location	maltego.STIX2.location	STIX2 Location	STIX 2	Location, STIX2Core	id
STIX2malware	maltego.STIX2.malware	STIX2 Malware	STIX 2	STIX2Core	id
STIX2malwareanalysis	maltego.STIX2.malware-analysis	STIX2 Malware Analysis	STIX 2	STIX2Core	id
STIX2note	maltego.STIX2.note	STIX2 Note	STIX 2	STIX2Core	id
STIX2observeddata	maltego.STIX2.observed-data	STIX2 Observed Data	STIX 2	STIX2Core	id
STIX2opinion	maltego.STIX2.opinion	STIX2 Opinion	STIX 2	STIX2Core	id
STIX2report	maltego.STIX2.report	STIX2 Report	STIX 2	STIX2Core	id
STIX2threatactor	maltego.STIX2.threat-actor	STIX2 Threat Actor	STIX 2	Organization, STIX2Core	id
STIX2tool	maltego.STIX2.tool	STIX2 Tool	STIX 2	STIX2Core	id
STIX2vulnerability	maltego.STIX2.vulnerability	STIX2 Vulnerability	STIX 2	CVE, Phrase, STIX2Core	id

Class	Field	Display Name	Type	Matching	Value
STIX2Core	id	Id	str	strict	yes
STIX2Core	x_maltego_marking_color	X_Maltego_Marking_Color	str	loose
STIX2Core	x_maltego_marking_text	X_Maltego_Marking_Text	str	loose
STIX2attackpattern	aliases	Aliases	list[str]	loose
STIX2attackpattern	confidence	Confidence	str	loose
STIX2attackpattern	created	Created	str	loose
STIX2attackpattern	created_by_ref	Created_By_Ref	str	loose
STIX2attackpattern	description	Description	str	loose
STIX2attackpattern	extensions	Extensions	str	loose
STIX2attackpattern	external_references	External_References	list[str]	loose
STIX2attackpattern	granular_markings	Granular_Markings	list[str]	loose
STIX2attackpattern	id	Id	str	strict	yes
STIX2attackpattern	kill_chain_phases	Kill_Chain_Phases	list[str]	loose
STIX2attackpattern	labels	Labels	list[str]	loose
STIX2attackpattern	lang	Lang	str	loose
STIX2attackpattern	modified	Modified	str	loose
STIX2attackpattern	name	Name	str	loose
STIX2attackpattern	object_marking_refs	Object_Marking_Refs	list[str]	loose
STIX2attackpattern	revoked	Revoked	str	loose
STIX2attackpattern	spec_version	Spec_Version	str	loose
STIX2attackpattern	type	Type	str	loose
STIX2attackpattern	x_maltego_marking_color	X_Maltego_Marking_Color	str	loose
STIX2attackpattern	x_maltego_marking_text	X_Maltego_Marking_Text	str	loose
STIX2attackpattern	x_maltego_recovery_property_mapping	x_maltego_recovery_property_mapping	str	loose
STIX2campaign	aliases	Aliases	list[str]	loose
STIX2campaign	location.area	Area	str	strict
STIX2campaign	location.areacode	Area Code	str	strict
STIX2campaign	city	City	str	strict
STIX2campaign	confidence	Confidence	str	loose
STIX2campaign	country	Country	str	strict
STIX2campaign	countrycode	Country Code	str	strict
STIX2campaign	created	Created	str	loose
STIX2campaign	created_by_ref	Created_By_Ref	str	loose
STIX2campaign	description	Description	str	loose
STIX2campaign	extensions	Extensions	str	loose
STIX2campaign	external_references	External_References	list[str]	loose
STIX2campaign	granular_markings	Granular_Markings	list[str]	loose
STIX2campaign	id	Id	str	strict	yes
STIX2campaign	labels	Labels	list[str]	loose
STIX2campaign	lang	Lang	str	loose
STIX2campaign	latitude	Latitude	float	strict
STIX2campaign	longitude	Longitude	float	strict
STIX2campaign	modified	Modified	str	loose
STIX2campaign	location.name	Name	str	strict
STIX2campaign	object_marking_refs	Object_Marking_Refs	list[str]	loose
STIX2campaign	objective	Objective	str	loose
STIX2campaign	revoked	Revoked	str	loose
STIX2campaign	spec_version	Spec_Version	str	loose
STIX2campaign	starttime	Starttime	str	loose
STIX2campaign	stoptime	Stoptime	str	loose
STIX2campaign	streetaddress	Street Address	str	strict
STIX2campaign	title	Title	str	loose
STIX2campaign	type	Type	str	loose
STIX2campaign	x_maltego_marking_color	X_Maltego_Marking_Color	str	loose
STIX2campaign	x_maltego_marking_text	X_Maltego_Marking_Text	str	loose
STIX2campaign	x_maltego_recovery_property_mapping	x_maltego_recovery_property_mapping	str	loose
STIX2courseofaction	confidence	Confidence	str	loose
STIX2courseofaction	created	Created	str	loose
STIX2courseofaction	created_by_ref	Created_By_Ref	str	loose
STIX2courseofaction	description	Description	str	loose
STIX2courseofaction	extensions	Extensions	str	loose
STIX2courseofaction	external_references	External_References	list[str]	loose
STIX2courseofaction	granular_markings	Granular_Markings	list[str]	loose
STIX2courseofaction	id	Id	str	strict	yes
STIX2courseofaction	labels	Labels	list[str]	loose
STIX2courseofaction	lang	Lang	str	loose
STIX2courseofaction	modified	Modified	str	loose
STIX2courseofaction	name	Name	str	loose
STIX2courseofaction	object_marking_refs	Object_Marking_Refs	list[str]	loose
STIX2courseofaction	revoked	Revoked	str	loose
STIX2courseofaction	spec_version	Spec_Version	str	loose
STIX2courseofaction	type	Type	str	loose
STIX2courseofaction	x_maltego_marking_color	X_Maltego_Marking_Color	str	loose
STIX2courseofaction	x_maltego_marking_text	X_Maltego_Marking_Text	str	loose
STIX2courseofaction	x_maltego_recovery_property_mapping	x_maltego_recovery_property_mapping	str	loose
STIX2grouping	confidence	Confidence	str	loose
STIX2grouping	context	Context	str	loose
STIX2grouping	created	Created	str	loose
STIX2grouping	created_by_ref	Created_By_Ref	str	loose
STIX2grouping	description	Description	str	loose
STIX2grouping	extensions	Extensions	str	loose
STIX2grouping	external_references	External_References	list[str]	loose
STIX2grouping	granular_markings	Granular_Markings	list[str]	loose
STIX2grouping	id	Id	str	strict	yes
STIX2grouping	labels	Labels	list[str]	loose
STIX2grouping	lang	Lang	str	loose
STIX2grouping	modified	Modified	str	loose
STIX2grouping	name	Name	str	loose
STIX2grouping	object_marking_refs	Object_Marking_Refs	list[str]	loose
STIX2grouping	object_refs	Object_Refs	list[str]	loose
STIX2grouping	revoked	Revoked	str	loose
STIX2grouping	spec_version	Spec_Version	str	loose
STIX2grouping	type	Type	str	loose
STIX2grouping	x_maltego_marking_color	X_Maltego_Marking_Color	str	loose
STIX2grouping	x_maltego_marking_text	X_Maltego_Marking_Text	str	loose
STIX2grouping	x_maltego_recovery_property_mapping	x_maltego_recovery_property_mapping	str	loose
STIX2identity	confidence	Confidence	str	loose
STIX2identity	contact_information	Contact_Information	str	loose
STIX2identity	created	Created	str	loose
STIX2identity	created_by_ref	Created_By_Ref	str	loose
STIX2identity	description	Description	str	loose
STIX2identity	extensions	Extensions	str	loose
STIX2identity	external_references	External_References	list[str]	loose
STIX2identity	granular_markings	Granular_Markings	list[str]	loose
STIX2identity	id	Id	str	strict	yes
STIX2identity	identity_class	Identity_Class	str	loose
STIX2identity	labels	Labels	list[str]	loose
STIX2identity	lang	Lang	str	loose
STIX2identity	modified	Modified	str	loose
STIX2identity	object_marking_refs	Object_Marking_Refs	list[str]	loose
STIX2identity	revoked	Revoked	str	loose
STIX2identity	roles	Roles	list[str]	loose
STIX2identity	sectors	Sectors	list[str]	loose
STIX2identity	spec_version	Spec_Version	str	loose
STIX2identity	title	Title	str	loose
STIX2identity	type	Type	str	loose
STIX2identity	x_maltego_marking_color	X_Maltego_Marking_Color	str	loose
STIX2identity	x_maltego_marking_text	X_Maltego_Marking_Text	str	loose
STIX2identity	x_maltego_recovery_property_mapping	x_maltego_recovery_property_mapping	str	loose
STIX2incident	location.area	Area	str	strict
STIX2incident	location.areacode	Area Code	str	strict
STIX2incident	city	City	str	strict
STIX2incident	confidence	Confidence	str	loose
STIX2incident	country	Country	str	strict
STIX2incident	countrycode	Country Code	str	strict
STIX2incident	created	Created	str	loose
STIX2incident	created_by_ref	Created_By_Ref	str	loose
STIX2incident	description	Description	str	loose
STIX2incident	extensions	Extensions	str	loose
STIX2incident	external_references	External_References	list[str]	loose
STIX2incident	granular_markings	Granular_Markings	list[str]	loose
STIX2incident	id	Id	str	strict	yes
STIX2incident	labels	Labels	list[str]	loose
STIX2incident	lang	Lang	str	loose
STIX2incident	latitude	Latitude	float	strict
STIX2incident	longitude	Longitude	float	strict
STIX2incident	modified	Modified	str	loose
STIX2incident	location.name	Name	str	strict
STIX2incident	object_marking_refs	Object_Marking_Refs	list[str]	loose
STIX2incident	revoked	Revoked	str	loose
STIX2incident	spec_version	Spec_Version	str	loose
STIX2incident	starttime	Start Time	datetime	loose
STIX2incident	stoptime	Stop Time	datetime	loose
STIX2incident	streetaddress	Street Address	str	strict
STIX2incident	title	Title	str	loose
STIX2incident	type	Type	str	loose
STIX2incident	x_maltego_marking_color	X_Maltego_Marking_Color	str	loose
STIX2incident	x_maltego_marking_text	X_Maltego_Marking_Text	str	loose
STIX2incident	x_maltego_recovery_property_mapping	x_maltego_recovery_property_mapping	str	loose
STIX2indicator	confidence	Confidence	str	loose
STIX2indicator	created	Created	str	loose
STIX2indicator	created_by_ref	Created_By_Ref	str	loose
STIX2indicator	description	Description	str	loose
STIX2indicator	extensions	Extensions	str	loose
STIX2indicator	external_references	External_References	list[str]	loose
STIX2indicator	granular_markings	Granular_Markings	list[str]	loose
STIX2indicator	id	Id	str	strict	yes
STIX2indicator	indicator_types	Indicator_Types	list[str]	loose
STIX2indicator	kill_chain_phases	Kill_Chain_Phases	list[str]	loose
STIX2indicator	labels	Labels	list[str]	loose
STIX2indicator	lang	Lang	str	loose
STIX2indicator	modified	Modified	str	loose
STIX2indicator	name	Name	str	loose
STIX2indicator	object_marking_refs	Object_Marking_Refs	list[str]	loose
STIX2indicator	pattern	Pattern	str	loose
STIX2indicator	pattern_type	Pattern_Type	str	loose
STIX2indicator	pattern_version	Pattern_Version	str	loose
STIX2indicator	revoked	Revoked	str	loose
STIX2indicator	spec_version	Spec_Version	str	loose
STIX2indicator	type	Type	str	loose
STIX2indicator	valid_from	Valid_From	str	loose
STIX2indicator	valid_until	Valid_Until	str	loose
STIX2indicator	x_maltego_marking_color	X_Maltego_Marking_Color	str	loose
STIX2indicator	x_maltego_marking_text	X_Maltego_Marking_Text	str	loose
STIX2indicator	x_maltego_recovery_property_mapping	x_maltego_recovery_property_mapping	str	loose
STIX2infrastructure	aliases	Aliases	list[str]	loose
STIX2infrastructure	confidence	Confidence	str	loose
STIX2infrastructure	created	Created	str	loose
STIX2infrastructure	created_by_ref	Created_By_Ref	str	loose
STIX2infrastructure	description	Description	str	loose
STIX2infrastructure	extensions	Extensions	str	loose
STIX2infrastructure	external_references	External_References	list[str]	loose
STIX2infrastructure	first_seen	First_Seen	str	loose
STIX2infrastructure	granular_markings	Granular_Markings	list[str]	loose
STIX2infrastructure	id	Id	str	strict	yes
STIX2infrastructure	infrastructure_types	Infrastructure_Types	list[str]	loose
STIX2infrastructure	kill_chain_phases	Kill_Chain_Phases	list[str]	loose
STIX2infrastructure	labels	Labels	list[str]	loose
STIX2infrastructure	lang	Lang	str	loose
STIX2infrastructure	last_seen	Last_Seen	str	loose
STIX2infrastructure	modified	Modified	str	loose
STIX2infrastructure	name	Name	str	loose
STIX2infrastructure	object_marking_refs	Object_Marking_Refs	list[str]	loose
STIX2infrastructure	revoked	Revoked	str	loose
STIX2infrastructure	spec_version	Spec_Version	str	loose
STIX2infrastructure	type	Type	str	loose
STIX2infrastructure	x_maltego_marking_color	X_Maltego_Marking_Color	str	loose
STIX2infrastructure	x_maltego_marking_text	X_Maltego_Marking_Text	str	loose
STIX2infrastructure	x_maltego_recovery_property_mapping	x_maltego_recovery_property_mapping	str	loose
STIX2intrusionset	aliases	Aliases	list[str]	loose
STIX2intrusionset	confidence	Confidence	str	loose
STIX2intrusionset	created	Created	str	loose
STIX2intrusionset	created_by_ref	Created_By_Ref	str	loose
STIX2intrusionset	description	Description	str	loose
STIX2intrusionset	extensions	Extensions	str	loose
STIX2intrusionset	external_references	External_References	list[str]	loose
STIX2intrusionset	first_seen	First_Seen	str	loose
STIX2intrusionset	granular_markings	Granular_Markings	list[str]	loose
STIX2intrusionset	id	Id	str	strict	yes
STIX2intrusionset	labels	Labels	list[str]	loose
STIX2intrusionset	lang	Lang	str	loose
STIX2intrusionset	last_seen	Last_Seen	str	loose
STIX2intrusionset	modified	Modified	str	loose
STIX2intrusionset	name	Name	str	loose
STIX2intrusionset	object_marking_refs	Object_Marking_Refs	list[str]	loose
STIX2intrusionset	primary_motivation	Primary_Motivation	str	loose
STIX2intrusionset	resource_level	Resource_Level	str	loose
STIX2intrusionset	revoked	Revoked	str	loose
STIX2intrusionset	goals	Goals	list[str]	loose
STIX2intrusionset	secondary_motivations	Secondary_Motivations	list[str]	loose
STIX2intrusionset	spec_version	Spec_Version	str	loose
STIX2intrusionset	type	Type	str	loose
STIX2intrusionset	x_maltego_marking_color	X_Maltego_Marking_Color	str	loose
STIX2intrusionset	x_maltego_marking_text	X_Maltego_Marking_Text	str	loose
STIX2intrusionset	x_maltego_recovery_property_mapping	x_maltego_recovery_property_mapping	str	loose
STIX2location	location.area	Location.Area	str	loose
STIX2location	location.areacode	Location.Areacode	str	loose
STIX2location	city	City	str	loose
STIX2location	confidence	Confidence	str	loose
STIX2location	country	Country	str	loose
STIX2location	countrycode	Country Code	str	strict
STIX2location	created	Created	str	loose
STIX2location	created_by_ref	Created_By_Ref	str	loose
STIX2location	description	Description	str	loose
STIX2location	extensions	Extensions	str	loose
STIX2location	external_references	External_References	list[str]	loose
STIX2location	granular_markings	Granular_Markings	list[str]	loose
STIX2location	id	Id	str	strict	yes
STIX2location	labels	Labels	list[str]	loose
STIX2location	lang	Lang	str	loose
STIX2location	latitude	Latitude	str	loose
STIX2location	longitude	Longitude	str	loose
STIX2location	modified	Modified	str	loose
STIX2location	location.name	Location.Name	str	loose
STIX2location	object_marking_refs	Object_Marking_Refs	list[str]	loose
STIX2location	precision	Precision	str	loose
STIX2location	region	Region	str	loose
STIX2location	revoked	Revoked	str	loose
STIX2location	spec_version	Spec_Version	str	loose
STIX2location	streetaddress	Streetaddress	str	loose
STIX2location	type	Type	str	loose
STIX2location	x_maltego_marking_color	X_Maltego_Marking_Color	str	loose
STIX2location	x_maltego_marking_text	X_Maltego_Marking_Text	str	loose
STIX2location	x_maltego_recovery_property_mapping	x_maltego_recovery_property_mapping	str	loose
STIX2malware	aliases	Aliases	list[str]	loose
STIX2malware	architecture_execution_envs	Architecture_Execution_Envs	list[str]	loose
STIX2malware	capabilities	Capabilities	list[str]	loose
STIX2malware	confidence	Confidence	str	loose
STIX2malware	created	Created	str	loose
STIX2malware	created_by_ref	Created_By_Ref	str	loose
STIX2malware	description	Description	str	loose
STIX2malware	extensions	Extensions	str	loose
STIX2malware	external_references	External_References	list[str]	loose
STIX2malware	first_seen	First_Seen	str	loose
STIX2malware	granular_markings	Granular_Markings	list[str]	loose
STIX2malware	id	Id	str	strict	yes
STIX2malware	implementation_languages	Implementation_Languages	list[str]	loose
STIX2malware	is_family	Is_Family	str	loose
STIX2malware	kill_chain_phases	Kill_Chain_Phases	list[str]	loose
STIX2malware	labels	Labels	list[str]	loose
STIX2malware	lang	Lang	str	loose
STIX2malware	last_seen	Last_Seen	str	loose
STIX2malware	malware_types	Malware_Types	list[str]	loose
STIX2malware	modified	Modified	str	loose
STIX2malware	name	Name	str	loose
STIX2malware	object_marking_refs	Object_Marking_Refs	list[str]	loose
STIX2malware	operating_system_refs	Operating_System_Refs	list[str]	loose
STIX2malware	revoked	Revoked	str	loose
STIX2malware	sample_refs	Sample_Refs	list[str]	loose
STIX2malware	spec_version	Spec_Version	str	loose
STIX2malware	type	Type	str	loose
STIX2malware	x_maltego_marking_color	X_Maltego_Marking_Color	str	loose
STIX2malware	x_maltego_marking_text	X_Maltego_Marking_Text	str	loose
STIX2malware	x_maltego_recovery_property_mapping	x_maltego_recovery_property_mapping	str	loose
STIX2malwareanalysis	analysis_definition_version	Analysis_Definition_Version	str	loose
STIX2malwareanalysis	analysis_ended	Analysis_Ended	str	loose
STIX2malwareanalysis	analysis_engine_version	Analysis_Engine_Version	str	loose
STIX2malwareanalysis	analysis_sco_refs	Analysis_Sco_Refs	list[str]	loose
STIX2malwareanalysis	analysis_started	Analysis_Started	str	loose
STIX2malwareanalysis	confidence	Confidence	str	loose
STIX2malwareanalysis	configuration_version	Configuration_Version	str	loose
STIX2malwareanalysis	created	Created	str	loose
STIX2malwareanalysis	created_by_ref	Created_By_Ref	str	loose
STIX2malwareanalysis	extensions	Extensions	str	loose
STIX2malwareanalysis	external_references	External_References	list[str]	loose
STIX2malwareanalysis	granular_markings	Granular_Markings	list[str]	loose
STIX2malwareanalysis	host_vm_ref	Host_Vm_Ref	str	loose
STIX2malwareanalysis	id	Id	str	strict	yes
STIX2malwareanalysis	installed_software_refs	Installed_Software_Refs	list[str]	loose
STIX2malwareanalysis	labels	Labels	list[str]	loose
STIX2malwareanalysis	lang	Lang	str	loose
STIX2malwareanalysis	modified	Modified	str	loose
STIX2malwareanalysis	modules	Modules	list[str]	loose
STIX2malwareanalysis	object_marking_refs	Object_Marking_Refs	list[str]	loose
STIX2malwareanalysis	operating_system_ref	Operating_System_Ref	str	loose
STIX2malwareanalysis	product	Product	str	loose
STIX2malwareanalysis	result	Result	str	loose
STIX2malwareanalysis	result_name	Result_Name	str	loose
STIX2malwareanalysis	revoked	Revoked	str	loose
STIX2malwareanalysis	sample_ref	Sample_Ref	str	loose
STIX2malwareanalysis	spec_version	Spec_Version	str	loose
STIX2malwareanalysis	submitted	Submitted	str	loose
STIX2malwareanalysis	type	Type	str	loose
STIX2malwareanalysis	version	Version	str	loose
STIX2malwareanalysis	x_maltego_marking_color	X_Maltego_Marking_Color	str	loose
STIX2malwareanalysis	x_maltego_marking_text	X_Maltego_Marking_Text	str	loose
STIX2malwareanalysis	x_maltego_recovery_property_mapping	x_maltego_recovery_property_mapping	str	loose
STIX2note	abstract	Abstract	str	loose
STIX2note	authors	Authors	list[str]	loose
STIX2note	confidence	Confidence	str	loose
STIX2note	content	Content	str	loose
STIX2note	created	Created	str	loose
STIX2note	created_by_ref	Created_By_Ref	str	loose
STIX2note	extensions	Extensions	str	loose
STIX2note	external_references	External_References	list[str]	loose
STIX2note	granular_markings	Granular_Markings	list[str]	loose
STIX2note	id	Id	str	strict	yes
STIX2note	labels	Labels	list[str]	loose
STIX2note	lang	Lang	str	loose
STIX2note	modified	Modified	str	loose
STIX2note	object_marking_refs	Object_Marking_Refs	list[str]	loose
STIX2note	object_refs	Object_Refs	list[str]	loose
STIX2note	revoked	Revoked	str	loose
STIX2note	spec_version	Spec_Version	str	loose
STIX2note	type	Type	str	loose
STIX2note	x_maltego_marking_color	X_Maltego_Marking_Color	str	loose
STIX2note	x_maltego_marking_text	X_Maltego_Marking_Text	str	loose
STIX2note	x_maltego_recovery_property_mapping	x_maltego_recovery_property_mapping	str	loose
STIX2observeddata	confidence	Confidence	str	loose
STIX2observeddata	created	Created	str	loose
STIX2observeddata	created_by_ref	Created_By_Ref	str	loose
STIX2observeddata	extensions	Extensions	str	loose
STIX2observeddata	external_references	External_References	list[str]	loose
STIX2observeddata	first_observed	First_Observed	str	loose
STIX2observeddata	granular_markings	Granular_Markings	list[str]	loose
STIX2observeddata	id	Id	str	strict	yes
STIX2observeddata	labels	Labels	list[str]	loose
STIX2observeddata	lang	Lang	str	loose
STIX2observeddata	last_observed	Last_Observed	str	loose
STIX2observeddata	modified	Modified	str	loose
STIX2observeddata	number_observed	Number_Observed	str	loose
STIX2observeddata	object_marking_refs	Object_Marking_Refs	list[str]	loose
STIX2observeddata	object_refs	Object_Refs	list[str]	loose
STIX2observeddata	objects	Objects	str	loose
STIX2observeddata	revoked	Revoked	str	loose
STIX2observeddata	spec_version	Spec_Version	str	loose
STIX2observeddata	type	Type	str	loose
STIX2observeddata	x_maltego_marking_color	X_Maltego_Marking_Color	str	loose
STIX2observeddata	x_maltego_marking_text	X_Maltego_Marking_Text	str	loose
STIX2observeddata	x_maltego_recovery_property_mapping	x_maltego_recovery_property_mapping	str	loose
STIX2opinion	authors	Authors	list[str]	loose
STIX2opinion	confidence	Confidence	str	loose
STIX2opinion	created	Created	str	loose
STIX2opinion	created_by_ref	Created_By_Ref	str	loose
STIX2opinion	explanation	Explanation	str	loose
STIX2opinion	extensions	Extensions	str	loose
STIX2opinion	external_references	External_References	list[str]	loose
STIX2opinion	granular_markings	Granular_Markings	list[str]	loose
STIX2opinion	id	Id	str	strict	yes
STIX2opinion	labels	Labels	list[str]	loose
STIX2opinion	lang	Lang	str	loose
STIX2opinion	modified	Modified	str	loose
STIX2opinion	object_marking_refs	Object_Marking_Refs	list[str]	loose
STIX2opinion	object_refs	Object_Refs	list[str]	loose
STIX2opinion	opinion	Opinion	str	loose
STIX2opinion	revoked	Revoked	str	loose
STIX2opinion	spec_version	Spec_Version	str	loose
STIX2opinion	type	Type	str	loose
STIX2opinion	x_maltego_marking_color	X_Maltego_Marking_Color	str	loose
STIX2opinion	x_maltego_marking_text	X_Maltego_Marking_Text	str	loose
STIX2opinion	x_maltego_recovery_property_mapping	x_maltego_recovery_property_mapping	str	loose
STIX2report	confidence	Confidence	str	loose
STIX2report	created	Created	str	loose
STIX2report	created_by_ref	Created_By_Ref	str	loose
STIX2report	description	Description	str	loose
STIX2report	extensions	Extensions	str	loose
STIX2report	external_references	External_References	list[str]	loose
STIX2report	granular_markings	Granular_Markings	list[str]	loose
STIX2report	id	Id	str	strict	yes
STIX2report	labels	Labels	list[str]	loose
STIX2report	lang	Lang	str	loose
STIX2report	modified	Modified	str	loose
STIX2report	name	Name	str	loose
STIX2report	object_marking_refs	Object_Marking_Refs	list[str]	loose
STIX2report	object_refs	Object_Refs	list[str]	loose
STIX2report	published	Published	str	loose
STIX2report	report_types	Report_Types	list[str]	loose
STIX2report	revoked	Revoked	str	loose
STIX2report	spec_version	Spec_Version	str	loose
STIX2report	type	Type	str	loose
STIX2report	x_maltego_marking_color	X_Maltego_Marking_Color	str	loose
STIX2report	x_maltego_marking_text	X_Maltego_Marking_Text	str	loose
STIX2report	x_maltego_recovery_property_mapping	x_maltego_recovery_property_mapping	str	loose
STIX2threatactor	aliases	Aliases	list[str]	loose
STIX2threatactor	confidence	Confidence	str	loose
STIX2threatactor	created	Created	str	loose
STIX2threatactor	created_by_ref	Created_By_Ref	str	loose
STIX2threatactor	description	Description	str	loose
STIX2threatactor	extensions	Extensions	str	loose
STIX2threatactor	external_references	External_References	list[str]	loose
STIX2threatactor	first_seen	First_Seen	str	loose
STIX2threatactor	goals	Goals	list[str]	loose
STIX2threatactor	granular_markings	Granular_Markings	list[str]	loose
STIX2threatactor	id	Id	str	strict	yes
STIX2threatactor	labels	Labels	list[str]	loose
STIX2threatactor	lang	Lang	str	loose
STIX2threatactor	last_seen	Last_Seen	str	loose
STIX2threatactor	modified	Modified	str	loose
STIX2threatactor	object_marking_refs	Object_Marking_Refs	list[str]	loose
STIX2threatactor	personal_motivations	Personal_Motivations	list[str]	loose
STIX2threatactor	primary_motivation	Primary_Motivation	str	loose
STIX2threatactor	resource_level	Resource_Level	str	loose
STIX2threatactor	revoked	Revoked	str	loose
STIX2threatactor	roles	Roles	list[str]	loose
STIX2threatactor	secondary_motivations	Secondary_Motivations	list[str]	loose
STIX2threatactor	sophistication	Sophistication	str	loose
STIX2threatactor	spec_version	Spec_Version	str	loose
STIX2threatactor	threat_actor_types	Threat_Actor_Types	list[str]	loose
STIX2threatactor	title	Title	str	loose
STIX2threatactor	type	Type	str	loose
STIX2threatactor	x_maltego_marking_color	X_Maltego_Marking_Color	str	loose
STIX2threatactor	x_maltego_marking_text	X_Maltego_Marking_Text	str	loose
STIX2threatactor	x_maltego_recovery_property_mapping	x_maltego_recovery_property_mapping	str	loose
STIX2tool	aliases	Aliases	list[str]	loose
STIX2tool	confidence	Confidence	str	loose
STIX2tool	created	Created	str	loose
STIX2tool	created_by_ref	Created_By_Ref	str	loose
STIX2tool	description	Description	str	loose
STIX2tool	extensions	Extensions	str	loose
STIX2tool	external_references	External_References	list[str]	loose
STIX2tool	granular_markings	Granular_Markings	list[str]	loose
STIX2tool	id	Id	str	strict	yes
STIX2tool	kill_chain_phases	Kill_Chain_Phases	list[str]	loose
STIX2tool	labels	Labels	list[str]	loose
STIX2tool	lang	Lang	str	loose
STIX2tool	modified	Modified	str	loose
STIX2tool	name	Name	str	loose
STIX2tool	object_marking_refs	Object_Marking_Refs	list[str]	loose
STIX2tool	revoked	Revoked	str	loose
STIX2tool	spec_version	Spec_Version	str	loose
STIX2tool	tool_types	Tool_Types	list[str]	loose
STIX2tool	tool_version	Tool_Version	str	loose
STIX2tool	type	Type	str	loose
STIX2tool	x_maltego_marking_color	X_Maltego_Marking_Color	str	loose
STIX2tool	x_maltego_marking_text	X_Maltego_Marking_Text	str	loose
STIX2tool	x_maltego_recovery_property_mapping	x_maltego_recovery_property_mapping	str	loose
STIX2vulnerability	confidence	Confidence	str	loose
STIX2vulnerability	created	Created	str	loose
STIX2vulnerability	created_by_ref	Created_By_Ref	str	loose
STIX2vulnerability	cvss	CVSS	float	loose
STIX2vulnerability	cvssRatingColor	CVSS Rating Color	Color	loose
STIX2vulnerability	description	Description	str	loose
STIX2vulnerability	epss	EPSS	float	loose
STIX2vulnerability	extensions	Extensions	str	loose
STIX2vulnerability	external_references	External_References	list[str]	loose
STIX2vulnerability	granular_markings	Granular_Markings	list[str]	loose
STIX2vulnerability	id	Id	str	strict	yes
STIX2vulnerability	labels	Labels	list[str]	loose
STIX2vulnerability	lang	Lang	str	loose
STIX2vulnerability	modified	Modified	str	loose
STIX2vulnerability	object_marking_refs	Object_Marking_Refs	list[str]	loose
STIX2vulnerability	revoked	Revoked	str	loose
STIX2vulnerability	spec_version	Spec_Version	str	loose
STIX2vulnerability	text	Text	str	loose
STIX2vulnerability	type	Type	str	loose
STIX2vulnerability	x_maltego_marking_color	X_Maltego_Marking_Color	str	loose
STIX2vulnerability	x_maltego_marking_text	X_Maltego_Marking_Text	str	loose
STIX2vulnerability	x_maltego_recovery_property_mapping	x_maltego_recovery_property_mapping	str	loose

STIX 2 observables

Class	Type ID	Display Name	Module	Base	Value Property
STIX2artifact	maltego.STIX2.artifact	STIX2 Artifact	STIX 2	STIX2Core	id
STIX2autonomoussystem	maltego.STIX2.autonomous-system	STIX2 Autonomous System	STIX 2	AS, STIX2Core	id
STIX2directory	maltego.STIX2.directory	STIX2 Directory	STIX 2	STIX2Core	id
STIX2domainname	maltego.STIX2.domain-name	STIX2 Domain Name	STIX 2	Domain, STIX2Core	id
STIX2emailaddr	maltego.STIX2.email-addr	STIX2 Email Addr	STIX 2	EmailAddress, OnlineIdentifier, Identifier, STIX2Core	id
STIX2emailmessage	maltego.STIX2.email-message	STIX2 Email Message	STIX 2	ConversationEmail, Conversation, STIX2Core	id
STIX2file	maltego.STIX2.file	STIX2 File	STIX 2	STIX2Core	id
STIX2ipv4addr	maltego.STIX2.ipv4-addr	STIX2 Ipv4 Addr	STIX 2	IPv4Address, STIX2Core	id
STIX2ipv6addr	maltego.STIX2.ipv6-addr	STIX2 Ipv6 Addr	STIX 2	IPv6Address, STIX2Core	id
STIX2macaddr	maltego.STIX2.mac-addr	STIX2 Mac Addr	STIX 2	MacAddress, STIX2Core	id
STIX2mutex	maltego.STIX2.mutex	STIX2 Mutex	STIX 2	STIX2Core	id
STIX2networktraffic	maltego.STIX2.network-traffic	STIX2 Network Traffic	STIX 2	STIX2Core	id
STIX2process	maltego.STIX2.process	STIX2 Process	STIX 2	STIX2Core	id
STIX2software	maltego.STIX2.software	STIX2 Software	STIX 2	STIX2Core	id
STIX2url	maltego.STIX2.url	STIX2 Url	STIX 2	URL, STIX2Core	id
STIX2useraccount	maltego.STIX2.user-account	STIX2 User Account	STIX 2	Alias, OnlineIdentifier, Identifier, STIX2Core	id
STIX2windowsregistrykey	maltego.STIX2.windows-registry-key	STIX2 Windows Registry Key	STIX 2	STIX2Core	id
STIX2x509certificate	maltego.STIX2.x509-certificate	STIX2 X509 Certificate	STIX 2	X509Certificate, STIX2Core	id

Class	Field	Display Name	Type	Matching	Value
STIX2artifact	decryption_key	Decryption_Key	str	loose
STIX2artifact	defanged	Defanged	str	loose
STIX2artifact	encryption_algorithm	Encryption_Algorithm	str	loose
STIX2artifact	extensions	Extensions	str	loose
STIX2artifact	granular_markings	Granular_Markings	list[str]	loose
STIX2artifact	hashes	Hashes	str	loose
STIX2artifact	id	Id	str	strict	yes
STIX2artifact	mime_type	Mime_Type	str	loose
STIX2artifact	object_marking_refs	Object_Marking_Refs	list[str]	loose
STIX2artifact	payload_bin	Payload_Bin	str	loose
STIX2artifact	spec_version	Spec_Version	str	loose
STIX2artifact	type	Type	str	loose
STIX2artifact	url	Url	str	loose
STIX2artifact	x_maltego_marking_color	X_Maltego_Marking_Color	str	loose
STIX2artifact	x_maltego_marking_text	X_Maltego_Marking_Text	str	loose
STIX2artifact	x_maltego_recovery_property_mapping	x_maltego_recovery_property_mapping	str	loose
STIX2autonomoussystem	defanged	Defanged	str	loose
STIX2autonomoussystem	extensions	Extensions	str	loose
STIX2autonomoussystem	granular_markings	Granular_Markings	list[str]	loose
STIX2autonomoussystem	id	Id	str	strict	yes
STIX2autonomoussystem	name	Name	str	loose
STIX2autonomoussystem	as.number	As.Number	str	loose
STIX2autonomoussystem	object_marking_refs	Object_Marking_Refs	list[str]	loose
STIX2autonomoussystem	rir	Rir	str	loose
STIX2autonomoussystem	spec_version	Spec_Version	str	loose
STIX2autonomoussystem	type	Type	str	loose
STIX2autonomoussystem	x_maltego_marking_color	X_Maltego_Marking_Color	str	loose
STIX2autonomoussystem	x_maltego_marking_text	X_Maltego_Marking_Text	str	loose
STIX2autonomoussystem	x_maltego_recovery_property_mapping	x_maltego_recovery_property_mapping	str	loose
STIX2directory	atime	Atime	str	loose
STIX2directory	contains_refs	Contains_Refs	list[str]	loose
STIX2directory	ctime	Ctime	str	loose
STIX2directory	defanged	Defanged	str	loose
STIX2directory	extensions	Extensions	str	loose
STIX2directory	granular_markings	Granular_Markings	list[str]	loose
STIX2directory	id	Id	str	strict	yes
STIX2directory	mtime	Mtime	str	loose
STIX2directory	object_marking_refs	Object_Marking_Refs	list[str]	loose
STIX2directory	path	Path	str	loose
STIX2directory	path_enc	Path_Enc	str	loose
STIX2directory	spec_version	Spec_Version	str	loose
STIX2directory	type	Type	str	loose
STIX2directory	x_maltego_marking_color	X_Maltego_Marking_Color	str	loose
STIX2directory	x_maltego_marking_text	X_Maltego_Marking_Text	str	loose
STIX2directory	x_maltego_recovery_property_mapping	x_maltego_recovery_property_mapping	str	loose
STIX2domainname	defanged	Defanged	str	loose
STIX2domainname	extensions	Extensions	str	loose
STIX2domainname	fqdn	Fqdn	str	loose
STIX2domainname	granular_markings	Granular_Markings	list[str]	loose
STIX2domainname	id	Id	str	strict	yes
STIX2domainname	object_marking_refs	Object_Marking_Refs	list[str]	loose
STIX2domainname	resolves_to_refs	Resolves_To_Refs	list[str]	loose
STIX2domainname	spec_version	Spec_Version	str	loose
STIX2domainname	type	Type	str	loose
STIX2domainname	whois-info	WHOIS Info	str	loose
STIX2domainname	x_maltego_marking_color	X_Maltego_Marking_Color	str	loose
STIX2domainname	x_maltego_marking_text	X_Maltego_Marking_Text	str	loose
STIX2domainname	x_maltego_recovery_property_mapping	x_maltego_recovery_property_mapping	str	loose
STIX2emailaddr	belongs_to_ref	Belongs_To_Ref	str	loose
STIX2emailaddr	defanged	Defanged	str	loose
STIX2emailaddr	display_name	Display_Name	str	loose
STIX2emailaddr	email	Email	str	loose
STIX2emailaddr	extensions	Extensions	str	loose
STIX2emailaddr	granular_markings	Granular_Markings	list[str]	loose
STIX2emailaddr	id	Id	str	strict	yes
STIX2emailaddr	is_partial	Is Partial	bool	loose
STIX2emailaddr	object_marking_refs	Object_Marking_Refs	list[str]	loose
STIX2emailaddr	spec_version	Spec_Version	str	loose
STIX2emailaddr	type	Type	str	loose
STIX2emailaddr	x_maltego_marking_color	X_Maltego_Marking_Color	str	loose
STIX2emailaddr	x_maltego_marking_text	X_Maltego_Marking_Text	str	loose
STIX2emailaddr	x_maltego_recovery_property_mapping	x_maltego_recovery_property_mapping	str	loose
STIX2emailmessage	additional_header_fields	Additional_Header_Fields	str	loose
STIX2emailmessage	bcc_refs	Bcc_Refs	list[str]	loose
STIX2emailmessage	body	Body	str	loose
STIX2emailmessage	body_multipart	Body_Multipart	list[str]	loose
STIX2emailmessage	cc_refs	Cc_Refs	list[str]	loose
STIX2emailmessage	content_type	Content_Type	str	loose
STIX2emailmessage	date	Date	str	loose
STIX2emailmessage	defanged	Defanged	str	loose
STIX2emailmessage	email	Email	str	loose
STIX2emailmessage	extensions	Extensions	str	loose
STIX2emailmessage	granular_markings	Granular_Markings	list[str]	loose
STIX2emailmessage	id	Id	str	strict	yes
STIX2emailmessage	is_multipart	Is_Multipart	str	loose
STIX2emailmessage	message_id	Message_Id	str	loose
STIX2emailmessage	object_marking_refs	Object_Marking_Refs	list[str]	loose
STIX2emailmessage	people	People	list[str]	loose
STIX2emailmessage	raw_email_ref	Raw_Email_Ref	str	loose
STIX2emailmessage	received_lines	Received_Lines	list[str]	loose
STIX2emailmessage	email.recipients	Email.Recipients	list[str]	loose
STIX2emailmessage	sender_ref	Sender_Ref	str	loose
STIX2emailmessage	spec_version	Spec_Version	str	loose
STIX2emailmessage	title	Title	str	loose
STIX2emailmessage	type	Type	str	loose
STIX2emailmessage	x_maltego_marking_color	X_Maltego_Marking_Color	str	loose
STIX2emailmessage	x_maltego_marking_text	X_Maltego_Marking_Text	str	loose
STIX2emailmessage	x_maltego_recovery_property_mapping	x_maltego_recovery_property_mapping	str	loose
STIX2file	atime	Atime	str	loose
STIX2file	contains_refs	Contains_Refs	list[str]	loose
STIX2file	content_ref	Content_Ref	str	loose
STIX2file	ctime	Ctime	str	loose
STIX2file	defanged	Defanged	str	loose
STIX2file	extensions	Extensions	str	loose
STIX2file	granular_markings	Granular_Markings	list[str]	loose
STIX2file	hashes	Hashes	str	loose
STIX2file	id	Id	str	strict	yes
STIX2file	magic_number_hex	Magic_Number_Hex	str	loose
STIX2file	mime_type	Mime_Type	str	loose
STIX2file	mtime	Mtime	str	loose
STIX2file	name	Name	str	loose
STIX2file	name_enc	Name_Enc	str	loose
STIX2file	object_marking_refs	Object_Marking_Refs	list[str]	loose
STIX2file	parent_directory_ref	Parent_Directory_Ref	str	loose
STIX2file	size	Size	str	loose
STIX2file	spec_version	Spec_Version	str	loose
STIX2file	type	Type	str	loose
STIX2file	x_maltego_marking_color	X_Maltego_Marking_Color	str	loose
STIX2file	x_maltego_marking_text	X_Maltego_Marking_Text	str	loose
STIX2file	x_maltego_recovery_property_mapping	x_maltego_recovery_property_mapping	str	loose
STIX2ipv4addr	belongs_to_refs	Belongs_To_Refs	list[str]	loose
STIX2ipv4addr	defanged	Defanged	str	loose
STIX2ipv4addr	extensions	Extensions	str	loose
STIX2ipv4addr	granular_markings	Granular_Markings	list[str]	loose
STIX2ipv4addr	id	Id	str	strict	yes
STIX2ipv4addr	ipaddress.internal	Internal	bool	loose
STIX2ipv4addr	ipv4-address	Ipv4-Address	str	loose
STIX2ipv4addr	object_marking_refs	Object_Marking_Refs	list[str]	loose
STIX2ipv4addr	resolves_to_refs	Resolves_To_Refs	list[str]	loose
STIX2ipv4addr	spec_version	Spec_Version	str	loose
STIX2ipv4addr	type	Type	str	loose
STIX2ipv4addr	x_maltego_marking_color	X_Maltego_Marking_Color	str	loose
STIX2ipv4addr	x_maltego_marking_text	X_Maltego_Marking_Text	str	loose
STIX2ipv4addr	x_maltego_recovery_property_mapping	x_maltego_recovery_property_mapping	str	loose
STIX2ipv6addr	belongs_to_refs	Belongs_To_Refs	list[str]	loose
STIX2ipv6addr	defanged	Defanged	str	loose
STIX2ipv6addr	extensions	Extensions	str	loose
STIX2ipv6addr	granular_markings	Granular_Markings	list[str]	loose
STIX2ipv6addr	id	Id	str	strict	yes
STIX2ipv6addr	ipaddress.internal	Internal	bool	loose
STIX2ipv6addr	ipv6-address	Ipv6-Address	str	loose
STIX2ipv6addr	object_marking_refs	Object_Marking_Refs	list[str]	loose
STIX2ipv6addr	resolves_to_refs	Resolves_To_Refs	list[str]	loose
STIX2ipv6addr	spec_version	Spec_Version	str	loose
STIX2ipv6addr	type	Type	str	loose
STIX2ipv6addr	x_maltego_marking_color	X_Maltego_Marking_Color	str	loose
STIX2ipv6addr	x_maltego_marking_text	X_Maltego_Marking_Text	str	loose
STIX2ipv6addr	x_maltego_recovery_property_mapping	x_maltego_recovery_property_mapping	str	loose
STIX2macaddr	defanged	Defanged	str	loose
STIX2macaddr	extensions	Extensions	str	loose
STIX2macaddr	granular_markings	Granular_Markings	list[str]	loose
STIX2macaddr	id	Id	str	strict	yes
STIX2macaddr	macaddress	Macaddress	str	loose
STIX2macaddr	object_marking_refs	Object_Marking_Refs	list[str]	loose
STIX2macaddr	spec_version	Spec_Version	str	loose
STIX2macaddr	type	Type	str	loose
STIX2macaddr	x_maltego_marking_color	X_Maltego_Marking_Color	str	loose
STIX2macaddr	x_maltego_marking_text	X_Maltego_Marking_Text	str	loose
STIX2macaddr	x_maltego_recovery_property_mapping	x_maltego_recovery_property_mapping	str	loose
STIX2mutex	defanged	Defanged	str	loose
STIX2mutex	extensions	Extensions	str	loose
STIX2mutex	granular_markings	Granular_Markings	list[str]	loose
STIX2mutex	id	Id	str	strict	yes
STIX2mutex	name	Name	str	loose
STIX2mutex	object_marking_refs	Object_Marking_Refs	list[str]	loose
STIX2mutex	spec_version	Spec_Version	str	loose
STIX2mutex	type	Type	str	loose
STIX2mutex	x_maltego_marking_color	X_Maltego_Marking_Color	str	loose
STIX2mutex	x_maltego_marking_text	X_Maltego_Marking_Text	str	loose
STIX2mutex	x_maltego_recovery_property_mapping	x_maltego_recovery_property_mapping	str	loose
STIX2networktraffic	defanged	Defanged	str	loose
STIX2networktraffic	dst_byte_count	Dst_Byte_Count	str	loose
STIX2networktraffic	dst_packets	Dst_Packets	str	loose
STIX2networktraffic	dst_payload_ref	Dst_Payload_Ref	str	loose
STIX2networktraffic	dst_port	Dst_Port	str	loose
STIX2networktraffic	dst_ref	Dst_Ref	str	loose
STIX2networktraffic	encapsulated_by_ref	Encapsulated_By_Ref	str	loose
STIX2networktraffic	encapsulates_refs	Encapsulates_Refs	list[str]	loose
STIX2networktraffic	end	End	str	loose
STIX2networktraffic	extensions	Extensions	str	loose
STIX2networktraffic	granular_markings	Granular_Markings	list[str]	loose
STIX2networktraffic	id	Id	str	strict	yes
STIX2networktraffic	ipfix	Ipfix	str	loose
STIX2networktraffic	is_active	Is_Active	str	loose
STIX2networktraffic	object_marking_refs	Object_Marking_Refs	list[str]	loose
STIX2networktraffic	protocols	Protocols	list[str]	loose
STIX2networktraffic	spec_version	Spec_Version	str	loose
STIX2networktraffic	src_byte_count	Src_Byte_Count	str	loose
STIX2networktraffic	src_packets	Src_Packets	str	loose
STIX2networktraffic	src_payload_ref	Src_Payload_Ref	str	loose
STIX2networktraffic	src_port	Src_Port	str	loose
STIX2networktraffic	src_ref	Src_Ref	str	loose
STIX2networktraffic	start	Start	str	loose
STIX2networktraffic	type	Type	str	loose
STIX2networktraffic	x_maltego_marking_color	X_Maltego_Marking_Color	str	loose
STIX2networktraffic	x_maltego_marking_text	X_Maltego_Marking_Text	str	loose
STIX2networktraffic	x_maltego_recovery_property_mapping	x_maltego_recovery_property_mapping	str	loose
STIX2process	child_refs	Child_Refs	list[str]	loose
STIX2process	command_line	Command_Line	str	loose
STIX2process	created_time	Created_Time	str	loose
STIX2process	creator_user_ref	Creator_User_Ref	str	loose
STIX2process	cwd	Cwd	str	loose
STIX2process	defanged	Defanged	str	loose
STIX2process	environment_variables	Environment_Variables	str	loose
STIX2process	extensions	Extensions	str	loose
STIX2process	granular_markings	Granular_Markings	list[str]	loose
STIX2process	id	Id	str	strict	yes
STIX2process	image_ref	Image_Ref	str	loose
STIX2process	is_hidden	Is_Hidden	str	loose
STIX2process	object_marking_refs	Object_Marking_Refs	list[str]	loose
STIX2process	opened_connection_refs	Opened_Connection_Refs	list[str]	loose
STIX2process	parent_ref	Parent_Ref	str	loose
STIX2process	pid	Pid	str	loose
STIX2process	spec_version	Spec_Version	str	loose
STIX2process	type	Type	str	loose
STIX2process	x_maltego_marking_color	X_Maltego_Marking_Color	str	loose
STIX2process	x_maltego_marking_text	X_Maltego_Marking_Text	str	loose
STIX2process	x_maltego_recovery_property_mapping	x_maltego_recovery_property_mapping	str	loose
STIX2software	cpe	Cpe	str	loose
STIX2software	defanged	Defanged	str	loose
STIX2software	extensions	Extensions	str	loose
STIX2software	granular_markings	Granular_Markings	list[str]	loose
STIX2software	id	Id	str	strict	yes
STIX2software	languages	Languages	list[str]	loose
STIX2software	name	Name	str	loose
STIX2software	object_marking_refs	Object_Marking_Refs	list[str]	loose
STIX2software	spec_version	Spec_Version	str	loose
STIX2software	swid	Swid	str	loose
STIX2software	type	Type	str	loose
STIX2software	vendor	Vendor	str	loose
STIX2software	version	Version	str	loose
STIX2software	x_maltego_marking_color	X_Maltego_Marking_Color	str	loose
STIX2software	x_maltego_marking_text	X_Maltego_Marking_Text	str	loose
STIX2software	x_maltego_recovery_property_mapping	x_maltego_recovery_property_mapping	str	loose
STIX2url	defanged	Defanged	str	loose
STIX2url	extensions	Extensions	str	loose
STIX2url	granular_markings	Granular_Markings	list[str]	loose
STIX2url	id	Id	str	strict	yes
STIX2url	object_marking_refs	Object_Marking_Refs	list[str]	loose
STIX2url	short-title	Short title	str	loose
STIX2url	spec_version	Spec_Version	str	loose
STIX2url	title	Title	str	loose
STIX2url	type	Type	str	loose
STIX2url	url	Url	Url	loose
STIX2url	x_maltego_marking_color	X_Maltego_Marking_Color	str	loose
STIX2url	x_maltego_marking_text	X_Maltego_Marking_Text	str	loose
STIX2url	x_maltego_recovery_property_mapping	x_maltego_recovery_property_mapping	str	loose
STIX2useraccount	account_created	Account_Created	str	loose
STIX2useraccount	account_expires	Account_Expires	str	loose
STIX2useraccount	account_first_login	Account_First_Login	str	loose
STIX2useraccount	account_last_login	Account_Last_Login	str	loose
STIX2useraccount	account_login	Account_Login	str	loose
STIX2useraccount	account_type	Account_Type	str	loose
STIX2useraccount	alias	Alias	str	loose
STIX2useraccount	can_escalate_privs	Can_Escalate_Privs	str	loose
STIX2useraccount	credential	Credential	str	loose
STIX2useraccount	credential_last_changed	Credential_Last_Changed	str	loose
STIX2useraccount	defanged	Defanged	str	loose
STIX2useraccount	display_name	Display_Name	str	loose
STIX2useraccount	extensions	Extensions	str	loose
STIX2useraccount	granular_markings	Granular_Markings	list[str]	loose
STIX2useraccount	id	Id	str	strict	yes
STIX2useraccount	is_disabled	Is_Disabled	str	loose
STIX2useraccount	is_partial	Is Partial	bool	loose
STIX2useraccount	is_privileged	Is_Privileged	str	loose
STIX2useraccount	is_service_account	Is_Service_Account	str	loose
STIX2useraccount	object_marking_refs	Object_Marking_Refs	list[str]	loose
STIX2useraccount	spec_version	Spec_Version	str	loose
STIX2useraccount	type	Type	str	loose
STIX2useraccount	x_maltego_marking_color	X_Maltego_Marking_Color	str	loose
STIX2useraccount	x_maltego_marking_text	X_Maltego_Marking_Text	str	loose
STIX2useraccount	x_maltego_recovery_property_mapping	x_maltego_recovery_property_mapping	str	loose
STIX2windowsregistrykey	creator_user_ref	Creator_User_Ref	str	loose
STIX2windowsregistrykey	defanged	Defanged	str	loose
STIX2windowsregistrykey	extensions	Extensions	str	loose
STIX2windowsregistrykey	granular_markings	Granular_Markings	list[str]	loose
STIX2windowsregistrykey	id	Id	str	strict	yes
STIX2windowsregistrykey	key	Key	str	loose
STIX2windowsregistrykey	modified_time	Modified_Time	str	loose
STIX2windowsregistrykey	number_of_subkeys	Number_Of_Subkeys	str	loose
STIX2windowsregistrykey	object_marking_refs	Object_Marking_Refs	list[str]	loose
STIX2windowsregistrykey	spec_version	Spec_Version	str	loose
STIX2windowsregistrykey	type	Type	str	loose
STIX2windowsregistrykey	values	Values	list[str]	loose
STIX2windowsregistrykey	x_maltego_marking_color	X_Maltego_Marking_Color	str	loose
STIX2windowsregistrykey	x_maltego_marking_text	X_Maltego_Marking_Text	str	loose
STIX2windowsregistrykey	x_maltego_recovery_property_mapping	x_maltego_recovery_property_mapping	str	loose
STIX2x509certificate	aki	AKI	str	loose
STIX2x509certificate	country	Country	str	loose
STIX2x509certificate	defanged	Defanged	str	loose
STIX2x509certificate	extensions	Extensions	str	loose
STIX2x509certificate	granular_markings	Granular_Markings	list[str]	loose
STIX2x509certificate	hashes	Hashes	str	loose
STIX2x509certificate	id	Id	str	strict	yes
STIX2x509certificate	is_self_signed	Is_Self_Signed	str	loose
STIX2x509certificate	issuanceId	Issuance ID	str	loose
STIX2x509certificate	issuer	Issuer	str	loose
STIX2x509certificate	issuerDN	Issuer DN	str	loose
STIX2x509certificate	object_marking_refs	Object_Marking_Refs	list[str]	loose
STIX2x509certificate	organization	Organization	str	loose
STIX2x509certificate	san	SAN	list[str]	loose
STIX2x509certificate	serial	Serial	str	loose
STIX2x509certificate	signature_algorithm	Signature_Algorithm	str	loose
STIX2x509certificate	ski	SKI	str	loose
STIX2x509certificate	spec_version	Spec_Version	str	loose
STIX2x509certificate	subject	Subject	str	loose
STIX2x509certificate	subjectDN	Subject DN	str	loose
STIX2x509certificate	subject_public_key_algorithm	Subject_Public_Key_Algorithm	str	loose
STIX2x509certificate	subject_public_key_exponent	Subject_Public_Key_Exponent	str	loose
STIX2x509certificate	subject_public_key_modulus	Subject_Public_Key_Modulus	str	loose
STIX2x509certificate	type	Type	str	loose
STIX2x509certificate	usage	Usage	list[str]	loose
STIX2x509certificate	validFrom	Validfrom	str	loose
STIX2x509certificate	validTo	Validto	str	loose
STIX2x509certificate	version	Version	str	loose
STIX2x509certificate	x509_v3_extensions	X509_V3_Extensions	str	loose
STIX2x509certificate	x_maltego_marking_color	X_Maltego_Marking_Color	str	loose
STIX2x509certificate	x_maltego_marking_text	X_Maltego_Marking_Text	str	loose
STIX2x509certificate	x_maltego_recovery_property_mapping	x_maltego_recovery_property_mapping	str	loose

STIX 2 relationship objects

Class	Type ID	Display Name	Module	Base	Value Property
STIX2relationship	maltego.STIX2.relationship	STIX2 Relationship	STIX 2	STIX2Core	id
STIX2sighting	maltego.STIX2.sighting	STIX2 Sighting	STIX 2	STIX2Core	id

Class	Field	Display Name	Type	Matching	Value
STIX2relationship	confidence	Confidence	str	loose
STIX2relationship	created	Created	str	loose
STIX2relationship	created_by_ref	Created_By_Ref	str	loose
STIX2relationship	description	Description	str	loose
STIX2relationship	extensions	Extensions	str	loose
STIX2relationship	external_references	External_References	list[str]	loose
STIX2relationship	granular_markings	Granular_Markings	list[str]	loose
STIX2relationship	id	Id	str	strict	yes
STIX2relationship	labels	Labels	list[str]	loose
STIX2relationship	lang	Lang	str	loose
STIX2relationship	modified	Modified	str	loose
STIX2relationship	object_marking_refs	Object_Marking_Refs	list[str]	loose
STIX2relationship	relationship_type	Relationship_Type	str	loose
STIX2relationship	revoked	Revoked	str	loose
STIX2relationship	source_ref	Source_Ref	str	loose
STIX2relationship	spec_version	Spec_Version	str	loose
STIX2relationship	start_time	Start_Time	str	loose
STIX2relationship	stop_time	Stop_Time	str	loose
STIX2relationship	target_ref	Target_Ref	str	loose
STIX2relationship	type	Type	str	loose
STIX2relationship	x_maltego_marking_color	X_Maltego_Marking_Color	str	loose
STIX2relationship	x_maltego_marking_text	X_Maltego_Marking_Text	str	loose
STIX2relationship	x_maltego_recovery_property_mapping	x_maltego_recovery_property_mapping	str	loose
STIX2sighting	confidence	Confidence	str	loose
STIX2sighting	count	Count	str	loose
STIX2sighting	created	Created	str	loose
STIX2sighting	created_by_ref	Created_By_Ref	str	loose
STIX2sighting	description	Description	str	loose
STIX2sighting	extensions	Extensions	str	loose
STIX2sighting	external_references	External_References	list[str]	loose
STIX2sighting	first_seen	First_Seen	str	loose
STIX2sighting	granular_markings	Granular_Markings	list[str]	loose
STIX2sighting	id	Id	str	strict	yes
STIX2sighting	labels	Labels	list[str]	loose
STIX2sighting	lang	Lang	str	loose
STIX2sighting	last_seen	Last_Seen	str	loose
STIX2sighting	modified	Modified	str	loose
STIX2sighting	object_marking_refs	Object_Marking_Refs	list[str]	loose
STIX2sighting	observed_data_refs	Observed_Data_Refs	list[str]	loose
STIX2sighting	revoked	Revoked	str	loose
STIX2sighting	sighting_of_ref	Sighting_Of_Ref	str	loose
STIX2sighting	spec_version	Spec_Version	str	loose
STIX2sighting	summary	Summary	str	loose
STIX2sighting	type	Type	str	loose
STIX2sighting	where_sighted_refs	Where_Sighted_Refs	list[str]	loose
STIX2sighting	x_maltego_marking_color	X_Maltego_Marking_Color	str	loose
STIX2sighting	x_maltego_marking_text	X_Maltego_Marking_Text	str	loose
STIX2sighting	x_maltego_recovery_property_mapping	x_maltego_recovery_property_mapping	str	loose

Technology

Class	Type ID	Display Name	Module	Base	Value Property
ETag	maltego.ETag	ETag	Technology	Hash	properties.hash
SSLCertificateHash	maltego.SSLCertificateHash	SSL Certificate Hash	Technology	Hash	properties.hash
SSLCertificateSerial	maltego.SSLCertificateSerial	SSL Certificate Serial	Technology	Hash	properties.hash

Class	Field	Display Name	Type	Matching	Value
ETag	properties.hash	Hash	str	loose	yes
ETag	hash_type	Hash Type	str	loose
ETag	type	Hash Type	str	loose
SSLCertificateHash	properties.hash	Hash	str	loose	yes
SSLCertificateHash	hash_type	Hash Type	str	loose
SSLCertificateSerial	properties.hash	Hash	str	loose	yes
SSLCertificateSerial	hash_type	Hash Type	str	loose

Tracking

Class	Type ID	Display Name	Module	Base	Value Property
BankAccount	maltego.BankAccount	Bank Account	Casefile		bank.accnumber
FlightNumber	maltego.FlightNumber	Flight Number	Casefile		flight.id
IdentificationNumber	maltego.IdentificationNumber	Identification Number	Casefile		identification.number
PassportNumber	maltego.PassportNumber	PassportNumber	Casefile	IdentificationNumber	identification.number
VehicleRegistration	maltego.VehicleRegistration	Vehicle Registration	Casefile		vehicle.registration
VinNumber	maltego.VinNumber	VIN Number	Casefile		vinnumber

Class	Field	Display Name	Type	Matching	Value
BankAccount	bank.accnumber	Account Number	str	loose	yes
BankAccount	bank.branch	Branch Code	str	loose
BankAccount	bank.name	Bank	str	loose
FlightNumber	flight.airline	Airline	str	loose
FlightNumber	flight.date	Date	date	loose
FlightNumber	flight.id	Flight ID	str	loose	yes
FlightNumber	flight.number	Flight Number	str	loose
IdentificationNumber	identification.number	Number	str	loose	yes
PassportNumber	identification.number	Number	str	loose	yes
VehicleRegistration	vehicle.registration	Registration Number	str	loose	yes
VinNumber	vinnumber	VIN Number	str	loose	yes

Transportation

Class	Type ID	Display Name	Module	Base	Value Property
Bike	maltego.Bike	Bike	Casefile	Transport	transport.name
Boat	maltego.Boat	Boat	Casefile	Transport	transport.name
Bus	maltego.Bus	Bus	Casefile	Transport	transport.name
Car	maltego.Car	Car	Casefile	Transport	transport.name
Plane	maltego.Plane	Plane	Casefile	Transport	transport.name
Train	maltego.Train	Train	Casefile	Transport	transport.name
Transport	maltego.Transport	Transport	Casefile		transport.name

Class	Field	Display Name	Type	Matching	Value
Bike	transport.make	Make	str	loose
Bike	transport.model	Model	str	loose
Bike	transport.name	Name	str	loose	yes
Boat	transport.make	Make	str	loose
Boat	transport.model	Model	str	loose
Boat	transport.name	Name	str	loose	yes
Bus	transport.make	Make	str	loose
Bus	transport.model	Model	str	loose
Bus	transport.name	Name	str	loose	yes
Car	transport.make	Make	str	loose
Car	transport.model	Model	str	loose
Car	transport.name	Name	str	loose	yes
Plane	transport.make	Make	str	loose
Plane	transport.model	Model	str	loose
Plane	transport.name	Name	str	loose	yes
Train	transport.make	Make	str	loose
Train	transport.model	Model	str	loose
Train	transport.name	Name	str	loose	yes
Transport	transport.make	Make	str	loose
Transport	transport.model	Model	str	loose
Transport	transport.name	Name	str	loose	yes

Weapons

Class	Type ID	Display Name	Module	Base	Value Property
Ammunition	maltego.Ammunition	Ammunition	Casefile	Weapon	weapon.type
BioWeapon	maltego.BioWeapon	BioWeapon	Casefile	WMD, Weapon	weapon.type
Blade	maltego.Blade	Blade	Casefile	Weapon	weapon.type
ChemicalWeapon	maltego.ChemicalWeapon	ChemicalWeapon	Casefile	WMD, Weapon	weapon.type
Explosive	maltego.Explosive	Explosive	Casefile	Weapon	weapon.type
Gun	maltego.Gun	Gun	Casefile	Weapon	weapon.type
IED	maltego.IED	IED	Casefile	Weapon	weapon.type
Missile	maltego.Missile	Missile	Casefile	Weapon	weapon.type
NuclearWeapon	maltego.NuclearWeapon	NuclearWeapon	Casefile	WMD, Weapon	weapon.type
WMD	maltego.WMD	WMD	Casefile	Weapon	weapon.type
Weapon	maltego.Weapon	Weapon	Casefile		weapon.type

Class	Field	Display Name	Type	Matching	Value
Ammunition	weapon.type	Type	str	loose	yes
BioWeapon	weapon.type	Type	str	loose	yes
Blade	weapon.type	Type	str	loose	yes
ChemicalWeapon	weapon.type	Type	str	loose	yes
Explosive	weapon.type	Type	str	loose	yes
Gun	weapon.type	Type	str	loose	yes
IED	weapon.type	Type	str	loose	yes
Missile	weapon.type	Type	str	loose	yes
NuclearWeapon	weapon.type	Type	str	loose	yes
WMD	weapon.type	Type	str	loose	yes
Weapon	weapon.type	Type	str	loose	yes

Standard Entities Catalog

Standard Entities Catalog

Cryptocurrency

Devices

Events

Groups

Infrastructure

Locations

Malware

Personal

Social Network

STIX 2 domain objects

STIX 2 observables

STIX 2 relationship objects

Technology

Tracking

Transportation

Weapons