Overview
The Alerts Bar Transforms surface infostealer-derived credentials and compromised device data harvested from the dark web. Investigators can search stealer logs by email address, phone number, or domain to uncover leaked credentials, then pivot from a stolen credential to its compromised host, or from a host to every other credential harvested from that device.
Search in Stealer Logs [Alerts Bar]
Description: Returns Stolen Credentials linked to an email address or phone number.
Transform Settings
Setting Name | Display Name | Setting Type | Default Value | Optional | Popup | Authentication |
|---|---|---|---|---|---|---|
maltego.alerts-bar.global.global#alerts_bar_api_key | Alerts Bar API Key | string | None | True | False | False |
Transform Meta Info
Information | Value |
|---|---|
Display Name | Search in Stealer Logs [Alerts Bar] |
Owner | Maltego Technologies GmbH |
Author | Maltego Technologies GmbH |
Data Source | Alerts Bar |
Transform Name | maltego.alerts-bar.search_stealer_logs |
Short Description | Returns Stolen Credentials linked to an email address or phone number. |
Input Entities | maltego.EmailAddress, maltego.PhoneNumber |
Output Entities | maltego.AlertsBar.StolenCredential |
Search in Stealer Logs (by Domain) [Alerts Bar]
Description: Returns Stolen Credentials linked to a domain.
Transform Settings
Setting Name | Display Name | Setting Type | Default Value | Optional | Popup | Authentication |
|---|---|---|---|---|---|---|
maltego.alerts-bar.global.global#alerts_bar_api_key | Alerts Bar API Key | string | None | True | False | False |
Transform Meta Info
Information | Value |
|---|---|
Display Name | Search in Stealer Logs [Alerts Bar] |
Owner | Maltego Technologies GmbH |
Author | Maltego Technologies GmbH |
Data Source | Alerts Bar |
Transform Name | maltego.alerts-bar.search_stealer_logs_by_domain |
Short Description | Returns Stolen Credentials linked to a domain. |
Input Entities | maltego.Domain |
Output Entities | maltego.AlertsBar.StolenCredential |
Get Stolen Credentials [Alerts Bar]
Description: Returns all Stolen Credentials associated with a Compromised Host.
Transform Settings
Setting Name | Display Name | Setting Type | Default Value | Optional | Popup | Authentication |
|---|---|---|---|---|---|---|
maltego.alerts-bar.global.global#alerts_bar_api_key | Alerts Bar API Key | string | None | True | False | False |
Transform Meta Info
Information | Value |
|---|---|
Display Name | Get Stolen Credentials [Alerts Bar] |
Owner | Maltego Technologies GmbH |
Author | Maltego Technologies GmbH |
Data Source | Alerts Bar |
Transform Name | maltego.alerts-bar.get_stolen_credentials |
Short Description | Returns all Stolen Credentials associated with a Compromised Host. |
Input Entities | maltego.AlertsBar.CompromisedHost |
Output Entities | maltego.AlertsBar.StolenCredential |
Expand Stolen Credential [Alerts Bar]
Description: Expands a Stolen Credential into its constituent identifier entities. By default the password is returned obscured; enable the Show Full Password setting to return it in full.
Transform Settings
Setting Name | Display Name | Setting Type | Default Value | Optional | Popup | Authentication |
|---|---|---|---|---|---|---|
maltego.alerts-bar.expand_stolen_credential#show_full_password | Show Full Password | boolean | False | True | False | False |
Show Full Password
Off (default): the transform returns a maltego.AlertsBar.ObscuredPassword entity showing only the last three characters (e.g.
hunter2→****er2).On: the transform returns a maltego.Password entity containing the full plaintext password instead of the obscured one.
The full password is only available when the input Stolen Credential carries a Full Password value. If it does not, the transform falls back to the Obscured Password entity even when the setting is on.
Only one password entity is returned per run: either the obscured or the full one, never both.
The setting applies to this transform only; the Alerts Bar API key is not required to change it.
Transform Meta Info
Information | Value |
|---|---|
Display Name | Expand Stolen Credential [Alerts Bar] |
Owner | Maltego Technologies GmbH |
Author | Maltego Technologies GmbH |
Data Source | Alerts Bar |
Transform Name | maltego.alerts-bar.expand_stolen_credential |
Short Description | Expands a Stolen Credential into its constituent identifier entities. |
Input Entities | maltego.AlertsBar.StolenCredential |
Output Entities | maltego.EmailAddress, maltego.PhoneNumber, maltego.Alias, maltego.IPv4Address, maltego.AlertsBar.CompromisedHost, maltego.AlertsBar.ObscuredPassword, maltego.Password (when Show Full Password is enabled) |
Entities
Entity | Description |
|---|---|
maltego.AlertsBar.StolenCredential (Stolen Credential) | A single leaked credential record recovered from a stealer log. May carry an email address, phone number, alias, IP address, compromised host, an obscured password and, where available, the full password as properties. |
maltego.AlertsBar.CompromisedHost (Compromised Host) | A device identified as infected with credential-stealing malware. |
maltego.AlertsBar.ObscuredPassword (Obscured Password) | A masked password value recovered from a stealer log. Only the last three characters are shown (e.g. |
maltego.Password (Password) | The full plaintext password recovered from a stealer log. Returned by Expand Stolen Credential in place of the Obscured Password only when the Show Full Password setting is enabled. |
Example workflow
Start with a known Email Address.
Run Search in Stealer Logs → returns one or more Stolen Credential entities.
Run Expand Stolen Credential on a result → reveals the associated Compromised Host, plus phone, alias, IP, and password artifacts. Enable Show Full Password in the transform settings first if you need the plaintext password rather than the obscured one.
Run Get Stolen Credentials on the Compromised Host → surfaces every other credential stolen from that same device.
Delivery methods
Alerts Bar Transforms are available through three delivery methods, differing only in access model and transform display name:
| Browser | Connector on Desktop | Data Pass on Desktop |
|---|---|---|---|
Access | Included, no setup required | Requires your own Alerts Bar API key (BYOK) | Included, no setup required |
Available on | Organization, Enterprise | Organization, Enterprise — plus an Alerts Bar account and API key | Organization, Enterprise |
Delivery | Maltego-managed, surfaced via Graph Browser discovery/search sets | Customer-managed, installed from Transform Hub | Maltego-managed, bundled into the Darkweb Data Pass |
Transform display name | Generic (e.g. "Search in Stealer Logs") | Provider-attributed (e.g. "Search in Stealer Logs [Alerts Bar]") | Category-prefixed and provider-attributed (e.g. "[Darkweb] Search in Stealer Logs [Alerts Bar]") |
Connector on Desktop setup (BYOK)
Sign up for an account at Alerts Bar and generate an API key.
In Maltego Graph (Desktop), open Transform Hub and locate the Alerts Bar entry.
Install it, then enter your API key when prompted (stored as Alerts Bar API Key).
The transforms become available on their supported entity types, labeled with the
[Alerts Bar]suffix.
The Browser and Data Pass delivery methods require no setup and use the same backing transform server as the Connector; the Connector is billed against your own Alerts Bar account instead of Maltego-managed credits.