All investigations in Maltego are based on, and begin with, Transforms and Entities.
Transforms are bits of code which, when run, generate information based on information we already have. We call this information Entities. Transforms search for information related to an Entity on the graph and allow you to query an API or database to show related information on the graph.
Entities are represented as nodes on a graph. Investigations start with one or more Entities, upon which, we run Transforms to explore the relationships between these Entities and other, yet unknown, pieces of information.
For example we can start with the website "www.paterva.com" and transform it into the IP addresses "22.214.171.124" and "126.96.36.199".
Relationships between Entities in the graph that you may not be aware of yet are also identified and explored.
Entities can be many types of information, such as a physical location, a website, a company name, an email address, a person's name, a telephone number, and many more.
Entities are usually divided into different categories in Maltego.
Entity Properties and Values
The most basic Entity in Maltego has a type, for example, a website or email address, and a value. The value of a website could be www.maltego.com, and the value of the mail address could be firstname.lastname@example.org. They can also include things like:
- calculated, static, and dynamic properties
The Maltego Standard Transforms include 39 Entity types, and many Hub Items will also include new Entity types when installed. You can also create your own custom Entities <https://docs.maltego.com/support/solutions/articles/15000010462-create-new-entity>`_ to use with your own custom Transforms. Any properties and values can be set for this Entity, and you can even inherit from another Entity. The Transforms from the parent Entity will work with the child Entity by default, and its properties and values can also be easily inherited.
Be sure to read the custom Entity guidelines when creating new Entities.