SOCRadar provides extended threat intelligence (XTI). The SOCRadar transforms let you pivot from CVEs, indicators of compromise (IOCs), countries, APT groups, ransomware groups and malware families to the related threat intelligence held on the SOCRadar platform.
The transforms return:
· Vulnerability data for a CVE: CVSS scoring, affected CPEs, public exploit links and the APT groups exploiting it.
· Threat actor intelligence: APT group profiles, aliases, origin and target countries, MITRE ATT&CK techniques, associated malware, IOCs and campaigns.
· Ransomware intelligence: ransomware groups by target country, their victims and IOCs.
· Malware intelligence: malware family details and associated IOCs.
· IOC enrichment: SOCRadar threat score, categorization flags, ASN and country context, cross-source confidence, and the APT groups, malware, campaign, countries and industries linked to an IP address, domain, hostname or file hash.
CVE
Find CVSS related to CVE [SOCRadar]
Returns the CVSS score of the CVE, including exploitability score, impact score and vector string.
Transform Settings
Display Name | Setting Type | Default Value | Optional | Popup | Authentication |
CTI Vulnerability API Key | string | - | false | TBC | true |
Transform Meta Info
Information | Value |
Display Name | Find CVSS related to CVE [SOCRadar] |
Transform Name | find_cvss_related_to_cve |
Author | Maltego Technologies GmbH |
Data Source | SOCRadar |
Input Entities | maltego.CVE |
Output Entities | maltego.CVSS |
Short Description | Returns the CVSS score of the CVE |
Find CPEs related to CVE [SOCRadar]
Returns the CPEs (affected products) listed for the CVE, with vendor, product and version properties.
Transform Settings
Display Name | Setting Type | Default Value | Optional | Popup | Authentication |
CTI Vulnerability API Key | string | - | false | TBC | true |
Transform Meta Info
Information | Value |
Display Name | Find CPEs related to CVE [SOCRadar] |
Transform Name | find_cpes_related_to_cve |
Author | Maltego Technologies GmbH |
Data Source | SOCRadar |
Input Entities | maltego.CVE |
Output Entities | maltego.CPE |
Short Description | Returns the CPEs related to the CVE |
Find Exploits related to CVE [SOCRadar]
Returns links to public exploits for the CVE.
Transform Settings
Display Name | Setting Type | Default Value | Optional | Popup | Authentication |
CTI Vulnerability API Key | string | - | false | TBC | true |
Transform Meta Info
Information | Value |
Display Name | Find Exploits related to CVE [SOCRadar] |
Transform Name | find_exploits_related_to_cve |
Author | Maltego Technologies GmbH |
Data Source | SOCRadar |
Input Entities | maltego.CVE |
Output Entities | maltego.URL |
Short Description | Returns exploit links related to the CVE |
Find APTs exploiting the CVE [SOCRadar]
Returns the APT groups that SOCRadar reports as exploiting the CVE. Each alias carries the group's categories and description.
Transform Settings
Display Name | Setting Type | Default Value | Optional | Popup | Authentication |
CTI Vulnerability API Key | string | - | false | TBC | true |
Transform Meta Info
Information | Value |
Display Name | Find APTs exploiting the CVE [SOCRadar] |
Transform Name | find_apts_exploiting_cve |
Author | Maltego Technologies GmbH |
Data Source | SOCRadar |
Input Entities | maltego.CVE |
Output Entities | maltego.Alias |
Short Description | Returns the APT groups exploiting the CVE |
---
IOC (Hash / Domain / DNS Name / IP Address) (v1)
Find APT associated with the IOC [SOCRadar]
Looks the indicator up in SOCRadar Threat Analysis and returns the APT group named in the findings. IP address inputs are validated before the request is sent.
Transform Settings
Display Name | Setting Type | Default Value | Optional | Popup | Authentication |
Threat Analysis API Key | string | - | false | TBC | true |
Transform Meta Info
Information | Value |
Display Name | Find APT associated with the IOC [SOCRadar] |
Transform Name | find_apt_associated_with_the_ioc |
Author | Maltego Technologies GmbH |
Data Source | SOCRadar |
Input Entities | maltego.Hash, maltego.DNSName, maltego.Domain, maltego.IPv4Address, maltego.IPv6Address |
Output Entities | maltego.Alias |
Short Description | Returns the APT group associated with the IOC |
Find malware associated with the IOC [SOCRadar]
Returns malware groups that SOCRadar associates with the indicator. IP address inputs are validated before the request is sent.
Transform Settings
Display Name | Setting Type | Default Value | Optional | Popup | Authentication |
Threat Actor API Key | string | - | false | TBC | true |
Transform Meta Info
Information | Value |
Display Name | Find malware associated with the IOC [SOCRadar] |
Transform Name | find_malware_associated_with_the_ioc |
Author | Maltego Technologies GmbH |
Data Source | SOCRadar |
Input Entities | maltego.Hash, maltego.DNSName, maltego.Domain, maltego.IPv4Address, maltego.IPv6Address |
Output Entities | maltego.Malware |
Short Description | Returns the malware associated with the IOC |
---
Country
Country inputs must have the Country Code property populated. Otherwise the transform returns a message asking you to fill it in.
To APT Groups by Origin Country [SOCRadar]
Returns APT groups attributed to the country as their suspected origin.
Transform Settings
Display Name | Setting Type | Default Value | Optional | Popup | Authentication |
Threat Actor API Key | string | - | false | TBC | true |
Transform Meta Info
Information | Value |
Display Name | To APT Groups by Origin Country [SOCRadar] |
Transform Name | country_to_apt_groups_by_origin |
Author | Maltego Technologies GmbH |
Data Source | SOCRadar |
Input Entities | maltego.Country |
Output Entities | maltego.jinxpy_socradar.APTGroup |
Short Description | Returns APT groups attributed to the country as their suspected origin |
To APT Groups by Target Country [SOCRadar]
Returns APT groups known to target the country.
Transform Settings
Display Name | Setting Type | Default Value | Optional | Popup | Authentication |
Threat Actor API Key | string | - | false | TBC | true |
Transform Meta Info
Information | Value |
Display Name | To APT Groups by Target Country [SOCRadar] |
Transform Name | country_to_apt_groups_by_target |
Author | Maltego Technologies GmbH |
Data Source | SOCRadar |
Input Entities | maltego.Country |
Output Entities | maltego.jinxpy_socradar.APTGroup |
Short Description | Returns APT groups known to target the country |
To Ransomware Groups by Target Country [SOCRadar]
Returns all ransomware groups known to target the country.
Transform Settings
Display Name | Setting Type | Default Value | Optional | Popup | Authentication |
Threat Actor API Key | string | - | false | TBC | true |
Transform Meta Info
Information | Value |
Display Name | To Ransomware Groups by Target Country [SOCRadar] |
Transform Name | country_to_ransomware_groups |
Author | Maltego Technologies GmbH |
Data Source | SOCRadar |
Input Entities | maltego.Country |
Output Entities | maltego.jinxpy_socradar.RansomwareGroup |
Short Description | Returns all ransomware groups known to target the country |
---
APT Group
APT Group inputs are maltego.jinxpy_socradar.APTGroup entities. Where the entity has no SOCRadar Actor ID (for example, an entity you created by hand), the transform looks the group up by name.
To APT Group Details [SOCRadar]
Retrieves the full overview of an APT group and writes it onto the input entity. Populated properties: SOCRadar Actor ID, Aliases, Description, Origin Country, Key Characteristics, First Seen, Last Activity, IOC Count, Campaigns Count, Vulnerabilities Count, Rules Count and News Count.
Transform Settings
Display Name | Setting Type | Default Value | Optional | Popup | Authentication |
Threat Actor API Key | string | - | false | TBC | true |
Transform Meta Info
Information | Value |
Display Name | To APT Group Details [SOCRadar] |
Transform Name | apt_group_to_details |
Author | Maltego Technologies GmbH |
Data Source | SOCRadar |
Input Entities | maltego.jinxpy_socradar.APTGroup |
Output Entities | maltego.jinxpy_socradar.APTGroup (the input entity, enriched) |
Short Description | Retrieves the full detailed overview of an APT group |
To Aliases [SOCRadar]
Returns all known aliases for the APT group.
Transform Settings
Display Name | Setting Type | Default Value | Optional | Popup | Authentication |
Threat Actor API Key | string | - | false | TBC | true |
Transform Meta Info
Information | Value |
Display Name | To Aliases [SOCRadar] |
Transform Name | apt_group_to_aliases |
Author | Maltego Technologies GmbH |
Data Source | SOCRadar |
Input Entities | maltego.jinxpy_socradar.APTGroup |
Output Entities | maltego.Alias |
Short Description | Returns all known aliases for the APT group |
To Origin Country [SOCRadar]
Returns the suspected origin country of the APT group. If the entity's Origin Country property is already set, that value is returned without calling SOCRadar.
Transform Settings
Display Name | Setting Type | Default Value | Optional | Popup | Authentication |
Threat Actor API Key | string | - | false | TBC | true |
Transform Meta Info
Information | Value |
Display Name | To Origin Country [SOCRadar] |
Transform Name | apt_group_to_origin_country |
Author | Maltego Technologies GmbH |
Data Source | SOCRadar |
Input Entities | maltego.jinxpy_socradar.APTGroup |
Output Entities | maltego.Country |
Short Description | Returns the suspected origin country of the APT group |
To Target Countries [SOCRadar]
Returns all countries known to be targeted by the APT group.
Transform Settings
Display Name | Setting Type | Default Value | Optional | Popup | Authentication |
Threat Actor API Key | string | - | false | TBC | true |
Transform Meta Info
Information | Value |
Display Name | To Target Countries [SOCRadar] |
Transform Name | apt_group_to_target_countries |
Author | Maltego Technologies GmbH |
Data Source | SOCRadar |
Input Entities | maltego.jinxpy_socradar.APTGroup |
Output Entities | maltego.Country |
Short Description | Returns all countries known to be targeted by the APT group |
To TTPs (ATT&CK Techniques) [SOCRadar]
Returns all MITRE ATT&CK techniques attributed to the APT group.
Transform Settings
Display Name | Setting Type | Default Value | Optional | Popup | Authentication |
Threat Actor API Key | string | - | false | TBC | true |
Transform Meta Info
Information | Value |
Display Name | To TTPs (ATT&CK Techniques) [SOCRadar] |
Transform Name | apt_group_to_ttps |
Author | Maltego Technologies GmbH |
Data Source | SOCRadar |
Input Entities | maltego.jinxpy_socradar.APTGroup |
Output Entities | maltego.AttackPattern |
Short Description | Returns all MITRE ATT&CK techniques attributed to the APT group |
To Associated Malware [SOCRadar]
Returns malware families known to be used by the APT group. This transform always looks the group up by name.
Transform Settings
Display Name | Setting Type | Default Value | Optional | Popup | Authentication |
Threat Actor API Key | string | - | false | TBC | true |
Transform Meta Info
Information | Value |
Display Name | To Associated Malware [SOCRadar] |
Transform Name | apt_group_to_malware |
Author | Maltego Technologies GmbH |
Data Source | SOCRadar |
Input Entities | maltego.jinxpy_socradar.APTGroup |
Output Entities | maltego.jinxpy_socradar.Malware |
Short Description | Returns malware families known to be used by the APT group |
To IOCs [SOCRadar]
Returns the Indicators of Compromise associated with an APT group, ransomware group or malware family. Results are returned as maltego.Hash (with hash type), maltego.DNSName, maltego.IPv4Address, maltego.IPv6Address or maltego.URL entities, each with a Last Seen property. Results are paged and returned progressively.
Transform Settings
Display Name | Setting Type | Default Value | Optional | Popup | Authentication |
Threat Actor API Key | string | - | false | TBC | true |
The APT Group variant has two additional, optional settings:
Display Name | Setting Type | Default Value | Optional | Popup | Authentication |
IOC Types (ip, hash, hostname) | list of strings | none (all types) | true | TBC | false |
IOC Date Range (Days) | integer | none (no date filter) | true | TBC | false |
Transform Meta Info
Information | Value |
Display Name | To IOCs [SOCRadar] |
Author | Maltego Technologies GmbH |
Data Source | SOCRadar |
Input Entities | maltego.jinxpy_socradar.APTGroup, maltego.jinxpy_socradar.RansomwareGroup, maltego.jinxpy_socradar.Malware |
Output Entities | maltego.Hash, maltego.DNSName, maltego.IPv4Address, maltego.IPv6Address, maltego.URL |
Short Description | Returns all Indicators of Compromise associated with the actor or malware |
Variants
Transform Name | Input Entities | Output Entities / Short Description |
apt_group_to_iocs | maltego.jinxpy_socradar.APTGroup | IOCs of the APT group; supports the IOC Types and IOC Date Range filters |
ransomware_group_to_iocs | maltego.jinxpy_socradar.RansomwareGroup | IOCs associated with the ransomware group |
malware_to_iocs | maltego.jinxpy_socradar.Malware | IOCs associated with the malware family |
To Campaigns [SOCRadar]
Returns known campaigns attributed to the APT group. Each campaign carries its title, SOCRadar Campaign ID, description, source URL, campaign date and tags.
Transform Settings
Display Name | Setting Type | Default Value | Optional | Popup | Authentication |
Threat Actor API Key | string | - | false | TBC | true |
Campaign Search Query | string | none | true | TBC | false |
Campaign Date Range | datetime range | none | true | TBC | false |
The date range filter only applies when both start and end dates are set.
Transform Meta Info
Information | Value |
Display Name | To Campaigns [SOCRadar] |
Transform Name | apt_group_to_campaigns |
Author | Maltego Technologies GmbH |
Data Source | SOCRadar |
Input Entities | maltego.jinxpy_socradar.APTGroup |
Output Entities | maltego.jinxpy_socradar.Campaign |
Short Description | Returns known campaigns attributed to the APT group |
---
Ransomware Group
Ransomware Group inputs are maltego.jinxpy_socradar.RansomwareGroup entities. To IOCs for ransomware groups is documented under [To IOCs [SOCRadar]](#to-iocs-socradar).
To Victims [SOCRadar]
Returns known victim organizations of the ransomware group, with website, country and last attack date.
Transform Settings
Display Name | Setting Type | Default Value | Optional | Popup | Authentication |
Threat Actor API Key | string | - | false | TBC | true |
Transform Meta Info
Information | Value |
Display Name | To Victims [SOCRadar] |
Transform Name | ransomware_group_to_victims |
Author | Maltego Technologies GmbH |
Data Source | SOCRadar |
Input Entities | maltego.jinxpy_socradar.RansomwareGroup |
Output Entities | maltego.jinxpy_socradar.RansomwareVictim |
Short Description | Returns known victim organizations of the ransomware group |
---
Malware
Malware inputs are maltego.jinxpy_socradar.Malware entities. To IOCs for malware is documented under [To IOCs [SOCRadar]](#to-iocs-socradar).
To Malware Details [SOCRadar]
Retrieves the full overview of a malware family and writes it onto the input entity. Populated properties: SOCRadar Malware ID, Aliases, Description, Key Characteristics, First Seen, Last Activity, Source Country, IOC Count and Rules Count.
Transform Settings
Display Name | Setting Type | Default Value | Optional | Popup | Authentication |
Threat Actor API Key | string | - | false | TBC | true |
Transform Meta Info
Information | Value |
Display Name | To Malware Details [SOCRadar] |
Transform Name | malware_to_details |
Author | Maltego Technologies GmbH |
Data Source | SOCRadar |
Input Entities | maltego.jinxpy_socradar.Malware |
Output Entities | maltego.jinxpy_socradar.Malware (the input entity, enriched) |
Short Description | Retrieves the full detailed overview of a malware family |
---
IOC Enrichment (Hash / Domain / DNS Name / IP Address)
These six transforms use the IoC Enrichment API Key. Inputs are validated before the request is sent: IP addresses must be valid, hashes must be MD5, SHA1 or SHA256, and domains or hostnames must be valid names. If SOCRadar has no data for the indicator, the transform reports it.
Enrich IOC [SOCRadar]
Enriches the IOC with SOCRadar's threat score, categorization, geo/ASN context and cross-source confidence. The input entity is returned with the following properties: SOCRadar Score, First Seen, Last Seen, ASN Name, ASN Code, SOCRadar Confidence, SOCRadar Signal Strength, Country, and the categorization flags Is Malware, Is Threat Actor, Is Proxy, Is Tor, Is VPN, Is CDN, Is Cloud, Is Honeypot, Is Hosting, Is Scanner and Is Cryptocurrency.
Transform Settings
Display Name | Setting Type | Default Value | Optional | Popup | Authentication |
IoC Enrichment API Key | string | - | TBC | TBC | TBC |
Transform Meta Info
Information | Value |
Display Name | Enrich IOC [SOCRadar] |
Transform Name | enrich_ioc |
Author | Maltego Technologies GmbH |
Data Source | SOCRadar |
Input Entities | maltego.Hash, maltego.DNSName, maltego.Domain, maltego.IPv4Address, maltego.IPv6Address |
Output Entities | The input entity, enriched |
Short Description | Enriches an IOC with SOCRadar's threat score, categorization, geo/ASN context, and cross-source confidence |
To APT Groups [SOCRadar]
Returns the APT groups SOCRadar attributes to the IOC.
Transform Settings
Display Name | Setting Type | Default Value | Optional | Popup | Authentication |
IoC Enrichment API Key | string | - | TBC | TBC | TBC |
Transform Meta Info
Information | Value |
Display Name | To APT Groups [SOCRadar] |
Transform Name | ioc_to_apt_groups |
Author | Maltego Technologies GmbH |
Data Source | SOCRadar |
Input Entities | maltego.Hash, maltego.DNSName, maltego.Domain, maltego.IPv4Address, maltego.IPv6Address |
Output Entities | maltego.jinxpy_socradar.APTGroup |
Short Description | Returns APT groups SOCRadar attributes to the IOC |
To Malware [SOCRadar]
Returns the malware families SOCRadar attributes to the IOC.
Transform Settings
Display Name | Setting Type | Default Value | Optional | Popup | Authentication |
IoC Enrichment API Key | string | - | TBC | TBC | TBC |
Transform Meta Info
Information | Value |
Display Name | To Malware [SOCRadar] |
Transform Name | ioc_to_malware |
Author | Maltego Technologies GmbH |
Data Source | SOCRadar |
Input Entities | maltego.Hash, maltego.DNSName, maltego.Domain, maltego.IPv4Address, maltego.IPv6Address |
Output Entities | maltego.jinxpy_socradar.Malware |
Short Description | Returns malware families SOCRadar attributes to the IOC |
To Countries [SOCRadar]
Returns the IOC's origin country and any countries targeted by campaigns or actors linked to it. Links are labeled Origin or Target, and each country has a SOCRadar Country Role property.
Transform Settings
Display Name | Setting Type | Default Value | Optional | Popup | Authentication |
IoC Enrichment API Key | string | - | TBC | TBC | TBC |
Transform Meta Info
Information | Value |
Display Name | To Countries [SOCRadar] |
Transform Name | ioc_to_countries |
Author | Maltego Technologies GmbH |
Data Source | SOCRadar |
Input Entities | maltego.Hash, maltego.DNSName, maltego.Domain, maltego.IPv4Address, maltego.IPv6Address |
Output Entities | maltego.Country |
Short Description | Returns the IOC's origin country and the countries targeted by linked campaigns/actors |
To Campaign [SOCRadar]
Returns the campaign SOCRadar associates with the IOC.
Transform Settings
Display Name | Setting Type | Default Value | Optional | Popup | Authentication |
IoC Enrichment API Key | string | - | TBC | TBC | TBC |
Transform Meta Info
Information | Value |
Display Name | To Campaign [SOCRadar] |
Transform Name | ioc_to_campaign |
Author | Maltego Technologies GmbH |
Data Source | SOCRadar |
Input Entities | maltego.Hash, maltego.DNSName, maltego.Domain, maltego.IPv4Address, maltego.IPv6Address |
Output Entities | maltego.jinxpy_socradar.Campaign |
Short Description | Returns the campaign SOCRadar associates with the IOC |
To Target Industries [SOCRadar]
Returns the target industries SOCRadar associates with the IOC.
Transform Settings
Display Name | Setting Type | Default Value | Optional | Popup | Authentication |
IoC Enrichment API Key | string | - | TBC | TBC | TBC |
Transform Meta Info
Information | Value |
Display Name | To Target Industries [SOCRadar] |
Transform Name | ioc_to_target_industries |
Author | Maltego Technologies GmbH |
Data Source | SOCRadar |
Input Entities | maltego.Hash, maltego.DNSName, maltego.Domain, maltego.IPv4Address, maltego.IPv6Address |
Output Entities | maltego.Industry |
Short Description | Returns the target industries SOCRadar associates with the IOC |
---