Bureau van Dijk's Orbis is one of the most comprehensive global private company databases in the world. Orbis features information on hundreds of millions of companies, including associated directors and shareholders, detailed contact information and ownership structures.
To get started, first locate the Orbis Hub item in the Transform Hub and click Install. You will be asked to provide your Orbis API Key and optionally specify the Maximum concurrent API calls to make.
Concurrency and rate-limiting
The Transform server will respect your specified maximum concurrency setting by not sending more concurrent requests to the Orbis API on behalf of your Maltego client than you specify. We strongly recommend that you set the maximum concurrent API call settings in accordance with the maximum concurrent seats of your Orbis subscription. Typically, most Orbis licenses are able to make around 1-10 concurrent requests. If you set the value too high for your license, you may encounter rate-limiting errors (typically manifested in a 429 or 401 error code on your Transforms). You can also change this setting at any time under Details -> Settings on the Orbis Hub item in the Transform Hub. Contact your Orbis sales representative (or Maltego) if you have more questions about Orbis rate-limiting on your license.
Using the Orbis Transforms
Once Orbis is installed, there are various ways the integration can be used to investigate and/or discover companies and individuals.
Searching a company and retrieving information
One of the most common entry points to an investigation using the Orbis Transforms is a name or other identifier of a company. Using a Company or Phrase Entity, we have two ways of searching for a company by name:
These two Transforms are similar, but internally they use two different Orbis APIs to search companies. The Transform marked (Match API) will at most return up to 50 results, however those results will tend to have higher relevancy to the input search. On the other hand, the plain search Transform can return up to 4000 Entities, and will do so quite exhaustively, meaning it might be harder to find the “main” legal Entity of the company being searched for (especially in the case of large corporate structures). In general, if you are looking for one specific legal Entity, the Match API may be better suited, and if you are looking to explore all possibly related companies (or even branches), it may be better to use the Plain Search.
Depending on which kind of search you run, you will have a number of additional filters to optionally supply. For a Match API query (right side), you can be much more specific about geographic and other identifying information (and specificity of the search), while the plain companies search (left side) currently lets you filter by country and type of company only. All such filters are optional and serve to help you narrow down the result set. Orbis typically supports partial name matching, many times companies may even be returned if their name does not match the query at all, but they are a subsidiary or shareholder of a company that does match the query.
Both Transforms will return OrbisCompany Entities that can include a variety of information related to company activities, location, revenue and profit, incorporation dates, status and more
Some of the information on the OrbisCompany Entities can also be put onto the graph directly, using the Get Details Transform set or the individual Transforms contained in within, as illustrated below:
Other ways of searching for companies
You can also search for a company via Website, Email address, Phone number or Location (street address) using the corresponding Entities. Not that Orbis’ address matching is fairly sensitive (little fuzzy matching) and you may get better results if you try multiple formats of the same address.
Finally, you can also search for companies based on events like bankruptcy, AML status change, recent directorship or board-level appointments and other changes. For these searches, the Entity simply called “Orbis” can be used, which you’ll find in your Entity palette.
Many of the event-based searches will have additional Transform settings, most importantly a time-range. If you select a frequently occurring event type and a long time-range with few or no other filters, searches may fail as the Orbis API may take too long to respond to these queries. For best results, select shorter time ranges (a few weeks or months) and specify a geographical or other filter where possible.
Searching for an individuals and retrieving basic information
To search Orbis for people, there are again a variety of entry points that can be used. To search by name, a Person or Phrase Entity can be used. It’s also possible to search by Phone number or Email address (and by company, see next section) using the corresponding Entities as entry points.
As with companies, details can be expanded onto the graph using the corresponding Transforms:
Exploring connections between companies and people
People and Companies are of course connected within Orbis, and these connections can be made visible in Maltego. Starting from a company, you can find associated officers and directors via the Find associated People Transform set.
Similarly, you can find companies that an individual is associated with via Find associated Companies. This can be useful for uncovering indirect connections between multiple companies (or people).
You may have noticed in the previous example that one of the associated persons has a red bookmark and a “Potential sanctions match” note. This indicates that Orbis found a possible WorldCompliance match for this individual and may be an indicator that the person might be sanctioned or otherwise particularly relevant in a Compliance, AML, KYC or related context. However, this flag may also be a false-positive, as it typically shows up for any individual if the WorldCompliance dataset contains any similar name even if it does not necessarily refer to the individual in question. As such, this indicator can be very useful in aiding an investigation, but always requires additional verification.
The Orbis API currently does not directly provide any additional information on WorldCompliance matches, it only indicates the presence of a potential match. For more information, additional (third party) data sources would need to be consulted. If you have a LexisNexis subscription, you may find more information by directly searching for the individual in WorldCompliance.
Exploring ownership structures
The Orbis Ownership Explorer allows discovery of detailed ownership information for many companies, both privately held and publicly traded. This information can also be fully queried within Maltego, but special note should be made of how these Transforms work in detail.
A short summary of what is explained below: if what you want to achieve is to simply explore the full tree of owners and subsidiaries of a given Orbis Company, the most convenient and reliable way is to use the Ownership Explorer Machine instead of running individual Transforms manually.
First, the basics: there are three (plus one) Transforms to explore ownership: Get parent companies & owners, Get subsidiaries and Explore ownership (owners and subsidiaries) (simply equivalent to the running both of the first two). The names of each of these are self-explanatory, they simply differ in the “direction” of the ownership tree that will be explored. There is also a fourth ownership-explorer related Transform, Explore ownership (owners and subsidiaries) (force API call), which is almost identical to its near-namesake. To understand its purpose, a brief look at how the Orbis Ownership Explorer API and the Maltego Transforms work internally is helpful.
The Ownership Explorer API returns the entire graph of all direct and indirect owners and subsidiaries at once, while Maltego Transforms currently only return one “hop” of a graph at a time. Maltego therefore temporarily caches the complete graph and can rely on this cache when running Transforms. In practice, when an Ownership Explorer Transform is run on a company, if no ownership information is cached for the company, a new API call is made (this may take some time) and the full Ownership tree relative to that company is cached by the server for some hours (currently 24h, subject to change). On one hand, this means that subsequent ownership-related Transforms on the returned companies will return much faster. On the other hand, importantly, it means that those subsequent Transforms will only explore ownership relative to the initially queried company, unless a new API request is forced. Relative to a company means that only direct parents, grandparents, etc. as well as children, grandchildren, etc. are returned, no siblings, cousins, uncles, nephews, etc.
In this example, the initial ownership explorer Transform may be slow, however, the subsequent Transform will return almost instantly.
You can also use the corresponding Transform on all ownership Transforms setting to allow or disallow new Orbis API calls (with exception of the … (force API call) Transform). This can be used to make sure you don’t branch out of the ownership tree relative to your starting point. If you use this feature, remember to re-allow API calls again afterwards so that your Transforms continue to function as expected.
For a given owner or subsidiary company (including grandparent or grandchild, etc.), Maltego will also display the overall “integrated percentage” relative to any Companies API call to the ownership explorer was started on, i.e. an API call was made (if it’s in the ownership tree). This information can be found in the Display Information of the Maltego client. If multiple API calls were made (or forced), it is possible that multiple such Ownership Explorer display information items are present on an Entity.
As mentioned, the easiest way to fully explore an ownership tree relative to one company is to use the provided “Ownership Explorer” Machine. Internally, it will force an API call on the first Transform and subsequently attempt to recursively return all owners and subsidiaries exhaustively while disallowing additional API calls. This should reproduce the default Ownership Explorer tree that Orbis would display on the web (if no “connected” ownership structures were already cached).
Finding links between companies in practice
If you want to investigate how two (or more) seemingly disparate companies may be connected, you may start by finding one of the central legal Entities for each of them and running an ownership explorer machine on each separately, one after the other. If you wind up with one interconnected graph, you’ve found a link, if not, you may need to branch into more associated directors, explore ownership of other relevant legal Entities in your graph, or look for links in other associated information (e.g. two companies or directors may share an address).
If no link can be made within Orbis alone, there are many other Maltego integrations that may help you connect the dots. Reach out to Maltego for assistance in identifying the most relevant ones for your investigations.
API requests are cached specific to a user’s Orbis API key and Maltego Key, so any two users will never access the same cache. In practice, this means that you will may get a slightly different ownership tree depending on which Company you begin exploring ownership relative to, however for any given company the ownership you see (without forcing new API calls) will be the same as in Orbis’ own web application–with the key difference that you can build multiple ownership trees on the same graph and pull in any other information you’re interested in via Transforms.