Entity Guides
- Maltego Standard Entities
- CaseFile Entities
  - Devices
  - Events
  - Groups
  - Infrastructure
  - Locations
  - People
  - Personal
  - Social Network
  - Tracking
  - Transportation
  - Weapons
- STIX 2 Entities

STIX 2 Domain Objects

Modified on: Wed, 5 May, 2021 at 1:57 AM

STIX2 Grouping

Entity Meta

Information	Value
Display Name	STIX2 Grouping
Entity Name	maltego.STIX2.grouping
Short Description	A Grouping object explicitly asserts that the referenced STIX Objects have a shared content.
Entity Category	STIX 2 domain objects
Base Entities	maltego.STIX2.core

Entity Properties

Display Name	Property Name	Data Type	Short Description	Sample Value
type	type	string	The type of this object, which MUST be the literal `grouping`.	grouping
s pec_version	s pec_version	string	The version of the STIX sp ecification used to represent this object.
id	id	string
cre ated_by_ref	cre ated_by_ref	string	The ID of the Source object that describes who created this object.
labels	labels	string[]	The labels property specifies a set of terms used to describe this object.
created	created	string	The created property represents the time at which the first version of this object was created. The timstamp value MUST be precise to the nearest m illisecond.
modified	modified	string	The modified property represents the time that this particular version of the object was modified. The timstamp value MUST be precise to the nearest m illisecond.
revoked	revoked	string	The revoked property indicates whether the object has been revoked.
confidence	confidence	string	Identifies the confidence that the creator has in the correctness of their data.
lang	lang	string	Identifies the language of the text content in this object.
external _references	external _references	string[]	A list of external references which refers to non-STIX i nformation.
object_m arking_refs	object_m arking_refs	string[]	The list of marking -definition objects to be applied to this object.
granul ar_markings	granul ar_markings	string[]	The set of granular markings that apply to this object.
name	name	string	A name used to identify the Grouping.
description	description	string	A description which provides more details and context about the Grouping, potentially including the purpose and key chara cteristics.
context	context	string	A short description of the particular context shared by the content referenced by the Grouping.
object_refs	object_refs	string[]	The STIX Objects (SDOs and SROs) that are referred to by this Grouping.
rec overy_prope rty_mapping	rec overy_prope rty_mapping	string	The mapping of Maltego internal property names to STIX property names used for this entity.	{}

Entity Description

A Grouping object explicitly asserts that the referenced STIX Objects have a shared content.

STIX2 Note

Entity Meta

Information	Value
Display Name	STIX2 Note
Entity Name	maltego.STIX2.note
Short Description	A Note is a comment or note containing informative text to help explain the context of one or more STIX Objects (SDOs or SROs) or to provide additional analysis that is not contained in the original object.
Entity Category	STIX 2 domain objects
Base Entities	maltego.Phrase, maltego.STIX2.core

Entity Properties

Display Name	Property Name	Data Type	Short Description	Sample Value
type	type	string	The type of this object, which MUST be the literal `note`.	note
s pec_version	s pec_version	string	The version of the STIX sp ecification used to represent this object.
id	id	string
cre ated_by_ref	cre ated_by_ref	string	The ID of the Source object that describes who created this object.
labels	labels	string[]	The labels property specifies a set of terms used to describe this object.
created	created	string	The created property represents the time at which the first version of this object was created. The timstamp value MUST be precise to the nearest m illisecond.
modified	modified	string	The modified property represents the time that this particular version of the object was modified. The timstamp value MUST be precise to the nearest m illisecond.
revoked	revoked	string	The revoked property indicates whether the object has been revoked.
confidence	confidence	string	Identifies the confidence that the creator has in the correctness of their data.
lang	lang	string	Identifies the language of the text content in this object.
external _references	external _references	string[]	A list of external references which refers to non-STIX i nformation.
object_m arking_refs	object_m arking_refs	string[]	The list of marking -definition objects to be applied to this object.
granul ar_markings	granul ar_markings	string[]	The set of granular markings that apply to this object.
text	text	string	The content of the note.
abstract	abstract	string	A brief summary of the note.
authors	authors	string[]	The name of the author(s) of this note (e.g., the analyst(s) that created it).
object_refs	object_refs	string[]	The STIX Objects (SDOs and SROs) that the note is being applied to.
rec overy_prope rty_mapping	rec overy_prope rty_mapping	string	The mapping of Maltego internal property names to STIX property names used for this entity.	{"text": "content"}

Entity Description

A Note is a comment or note containing informative text to help explain the context of one or more STIX Objects (SDOs or SROs) or to provide additional analysis that is not contained in the original object.

Entity Meta

Information	Value
Display Name	STIX2 Incident
Entity Name	maltego.STIX2.incident
Short Description	An incident is a grouping of adversary behavior that describes a set of malicious activities or attacks that occur over a period of time against a specific set of targets.
Entity Category	STIX 2 domain objects
Base Entities	maltego.STIX2.core

Entity Properties

Display Name	Property Name	Data Type	Short Description	Sample Value
type	type	string	The type of this object, which MUST be the literal `incident`.	x-openc ti-incident
s pec_version	s pec_version	string	The version of the STIX sp ecification used to represent this object.
id	id	string
cre ated_by_ref	cre ated_by_ref	string	The ID of the Source object that describes who created this object.
labels	labels	string[]	The labels property specifies a set of terms used to describe this object.
created	created	string	The created property represents the time at which the first version of this object was created. The timstamp value MUST be precise to the nearest m illisecond.
modified	modified	string	The modified property represents the time that this particular version of the object was modified. The timstamp value MUST be precise to the nearest m illisecond.
revoked	revoked	string	The revoked property indicates whether the object has been revoked.
confidence	confidence	string	Identifies the confidence that the creator has in the correctness of their data.
lang	lang	string	Identifies the language of the text content in this object.
external _references	external _references	string[]	A list of external references which refers to non-STIX i nformation.
object_m arking_refs	object_m arking_refs	string[]	The list of marking -definition objects to be applied to this object.
granul ar_markings	granul ar_markings	string[]	The set of granular markings that apply to this object.
name	name	string	The name used to identify the Incident.
description	description	string	A description that provides more details and context about the Incident, potentially including its purpose and its key chara cteristics.
aliases	aliases	string[]	Alternative names used to identify this incident.
first_seen	first_seen	string	The time that this Incident was first seen.
last_seen	last_seen	string	The time that this Incident was last seen.
objective	objective	string	This field defines the Incident’s primary goal, objective, desired outcome, or intended effect.
rec overy_prope rty_mapping	rec overy_prope rty_mapping	string	The mapping of Maltego internal property names to STIX property names used for this entity.	{}

Entity Description

An incident is a grouping of adversary behavior that describes a set of malicious activities or attacks that occur over a period of time against a specific set of targets.

STIX2 Location

Entity Meta

Information	Value
Display Name	STIX2 Location
Entity Name	maltego.STIX2.location
Short Description	A Location represents a geographic location. The location may be described as any, some or all of the following: region (e.g., North America), civic address (e.g. New York, US), latitude and longitude.
Entity Category	STIX 2 domain objects
Base Entities	maltego.Location, maltego.STIX2.core

Entity Properties

Display Name	Property Name	Data Type	Short Description	Sample Value
type	type	string	The type of this object, which MUST be the literal `location`.	location
s pec_version	s pec_version	string	The version of the STIX sp ecification used to represent this object.
id	id	string
cre ated_by_ref	cre ated_by_ref	string	The ID of the Source object that describes who created this object.
labels	labels	string[]	The labels property specifies a set of terms used to describe this object.
created	created	string	The created property represents the time at which the first version of this object was created. The timstamp value MUST be precise to the nearest m illisecond.
modified	modified	string	The modified property represents the time that this particular version of the object was modified. The timstamp value MUST be precise to the nearest m illisecond.
revoked	revoked	string	The revoked property indicates whether the object has been revoked.
confidence	confidence	string	Identifies the confidence that the creator has in the correctness of their data.
lang	lang	string	Identifies the language of the text content in this object.
external _references	external _references	string[]	A list of external references which refers to non-STIX i nformation.
object_m arking_refs	object_m arking_refs	string[]	The list of marking -definition objects to be applied to this object.
granul ar_markings	granul ar_markings	string[]	The set of granular markings that apply to this object.
lo cation.name	lo cation.name	string	A name used to identify the Location.
latitude	latitude	string	The latitude of the Location in decimal degrees.
longitude	longitude	string	The longitude of the Location in decimal degrees.
country	country	string	The country that this Location describes.
lo cation.area	lo cation.area	string	The state, province, or other s ub-national adm inistrative area that this Location describes.
city	city	string	The city that this Location describes.
st reetaddress	st reetaddress	string	The street address that this Location describes.
locati on.areacode	locati on.areacode	string	The postal code for this Location.
description	description	string	A textual description of the Location.
precision	precision	string	Defines the precision of the coordinates specified by the latitude and longitude properties, measured in meters.
region	region	string	The region that this Location describes.
rec overy_prope rty_mapping	rec overy_prope rty_mapping	string	The mapping of Maltego internal property names to STIX property names used for this entity.	{"loca tion.name": "name", "latitude": "latitude", " longitude": " longitude", "country": "country", "city": "city", "stre etaddress": "stree t_address", "loca tion.area": "administra tive_area", "location .areacode": "po stal_code"}

Entity Description

A Location represents a geographic location. The location may be described as any, some or all of the following: region (e.g., North America), civic address (e.g. New York, US), latitude and longitude.

STIX2 Opinion

Entity Meta

Information	Value
Display Name	STIX2 Opinion
Entity Name	maltego.STIX2.opinion
Short Description	An Opinion is an assessment of the correctness of the information in a STIX Object produced by a different entity and captures the level of agreement or disagreement using a fixed scale.
Entity Category	STIX 2 domain objects
Base Entities	maltego.STIX2.core

Entity Properties

Display Name	Property Name	Data Type	Short Description	Sample Value
type	type	string	The type of this object, which MUST be the literal `opinion`.	opinion
s pec_version	s pec_version	string	The version of the STIX sp ecification used to represent this object.
id	id	string
cre ated_by_ref	cre ated_by_ref	string	The ID of the Source object that describes who created this object.
labels	labels	string[]	The labels property specifies a set of terms used to describe this object.
created	created	string	The created property represents the time at which the first version of this object was created. The timstamp value MUST be precise to the nearest m illisecond.
modified	modified	string	The modified property represents the time that this particular version of the object was modified. The timstamp value MUST be precise to the nearest m illisecond.
revoked	revoked	string	The revoked property indicates whether the object has been revoked.
confidence	confidence	string	Identifies the confidence that the creator has in the correctness of their data.
lang	lang	string	Identifies the language of the text content in this object.
external _references	external _references	string[]	A list of external references which refers to non-STIX i nformation.
object_m arking_refs	object_m arking_refs	string[]	The list of marking -definition objects to be applied to this object.
granul ar_markings	granul ar_markings	string[]	The set of granular markings that apply to this object.
explanation	explanation	string	An explanation of why the producer has this Opinion.
authors	authors	string[]	The name of the author(s) of this opinion (e.g., the analyst(s) that created it).
object_refs	object_refs	string[]	The STIX Objects (SDOs and SROs) that the opinion is being applied to.
opinion	opinion	string	The opinion that the producer has about about all of the STIX Object(s) listed in the object_refs property.
rec overy_prope rty_mapping	rec overy_prope rty_mapping	string	The mapping of Maltego internal property names to STIX property names used for this entity.	{}

Entity Description

An Opinion is an assessment of the correctness of the information in a STIX Object produced by a different entity and captures the level of agreement or disagreement using a fixed scale.

STIX2 Vulnerability

Entity Meta

Information	Value
Display Name	STIX2 Vulnerability
Entity Name	maltego.STIX2.vulnerability
Short Description	A Vulnerability is a mistake in software that can be directly used by a hacker to gain access to a system or network.
Entity Category	STIX 2 domain objects
Base Entities	maltego.STIX2.core

Entity Properties

Display Name	Property Name	Data Type	Short Description	Sample Value
type	type	string	The type of this object, which MUST be the literal `vulne rability`.	vu lnerability
s pec_version	s pec_version	string	The version of the STIX sp ecification used to represent this object.
id	id	string
cre ated_by_ref	cre ated_by_ref	string	The ID of the Source object that describes who created this object.
labels	labels	string[]	The labels property specifies a set of terms used to describe this object.
created	created	string	The created property represents the time at which the first version of this object was created. The timstamp value MUST be precise to the nearest m illisecond.
modified	modified	string	The modified property represents the time that this particular version of the object was modified. The timstamp value MUST be precise to the nearest m illisecond.
revoked	revoked	string	The revoked property indicates whether the object has been revoked.
confidence	confidence	string	Identifies the confidence that the creator has in the correctness of their data.
lang	lang	string	Identifies the language of the text content in this object.
external _references	external _references	string[]	A list of external references which refers to non-STIX i nformation.
object_m arking_refs	object_m arking_refs	string[]	The list of marking -definition objects to be applied to this object.
granul ar_markings	granul ar_markings	string[]	The set of granular markings that apply to this object.
name	name	string	The name used to identify the Vul nerability.
description	description	string	A description that provides more details and context about the Vul nerability.
rec overy_prope rty_mapping	rec overy_prope rty_mapping	string	The mapping of Maltego internal property names to STIX property names used for this entity.	{}

Entity Description

A Vulnerability is a mistake in software that can be directly used by a hacker to gain access to a system or network.

STIX2 Malware

Entity Meta

Information	Value
Display Name	STIX2 Malware
Entity Name	maltego.STIX2.malware
Short Description	Malware is a type of TTP that is also known as malicious code and malicious software, refers to a program that is inserted into a system, usually covertly, with the intent of compromising the confidentiality, integrity, or availability of the victim's data, applications, or operating system (OS) or of otherwise annoying or disrupting the victim.
Entity Category	STIX 2 domain objects
Base Entities	maltego.STIX2.core

Entity Properties

Display Name	Property Name	Data Type	Short Description	Sample Value
type	type	string	The type of this object, which MUST be the literal `malware`.	malware
s pec_version	s pec_version	string	The version of the STIX sp ecification used to represent this object.
id	id	string
cre ated_by_ref	cre ated_by_ref	string	The ID of the Source object that describes who created this object.
labels	labels	string[]	The labels property specifies a set of terms used to describe this object.
created	created	string	The created property represents the time at which the first version of this object was created. The timstamp value MUST be precise to the nearest m illisecond.
modified	modified	string	The modified property represents the time that this particular version of the object was modified. The timstamp value MUST be precise to the nearest m illisecond.
revoked	revoked	string	The revoked property indicates whether the object has been revoked.
confidence	confidence	string	Identifies the confidence that the creator has in the correctness of their data.
lang	lang	string	Identifies the language of the text content in this object.
external _references	external _references	string[]	A list of external references which refers to non-STIX i nformation.
object_m arking_refs	object_m arking_refs	string[]	The list of marking -definition objects to be applied to this object.
granul ar_markings	granul ar_markings	string[]	The set of granular markings that apply to this object.
aliases	aliases	string[]	Alternative names used to identify this Malware or Malware family.
first_seen	first_seen	string	The time that the malware instance or family was first seen.
last_seen	last_seen	string	The time that the malware family or malware instance was last seen.
operating system_refs	operating system_refs	string[]	The operating systems that the malware family or malware instance is executable on.
archi tecture_exe cution_envs	archi tecture_exe cution_envs	string[]	The processor ar chitectures (e.g., x86, ARM, etc.) that the malware instance or family is executable on. Open Vocab -proc essor-archi tecture-os.
im plementatio n_languages	im plementatio n_languages	string[]	The programming language(s) used to implement the malware instance or family. Open Vocab -imple mentation-l anguage-ov.
c apabilities	c apabilities	string[]	Specifies any c apabilities identified for the malware instance or family. Open Vocab -ma lware-capab ilities-ov.
sample_refs	sample_refs	string[]	The sample_refs property specifies a list of identifiers of the SCO file or artifact objects associated with this malware instance(s) or family.
ma lware_types	ma lware_types	string[]	The type of malware being described. Open Vocab -malw are-type-ov
name	name	string	The name used to identify the Malware.
description	description	string	Provides more context and details about the Malware object.
kill_c hain_phases	kill_c hain_phases	string[]	The list of kill chain phases for which this Malware instance can be used.
rec overy_prope rty_mapping	rec overy_prope rty_mapping	string	The mapping of Maltego internal property names to STIX property names used for this entity.	{}
is_family	is_family	string	Whether the object represents a malware family (if true) or a malware instance (if false).	True

Entity Description

Malware is a type of TTP that is also known as malicious code and malicious software, refers to a program that is inserted into a system, usually covertly, with the intent of compromising the confidentiality, integrity, or availability of the victim's data, applications, or operating system (OS) or of otherwise annoying or disrupting the victim.

STIX2 Malware Analysis

Entity Meta

Information	Value
Display Name	STIX2 Malware Analysis
Entity Name	maltego.STIX2.malware-analysis
Short Description	Malware Analysis captures the metadata and results of a particular analysis performed (static or dynamic) on the malware instance or family.
Entity Category	STIX 2 domain objects
Base Entities	maltego.STIX2.core

Entity Properties

Display Name	Property Name	Data Type	Short Description	Sample Value
type	type	string	The type of this object, which MUST be the literal `malware- analysis`.	malwa re-analysis
s pec_version	s pec_version	string	The version of the STIX sp ecification used to represent this object.
id	id	string
cre ated_by_ref	cre ated_by_ref	string	The ID of the Source object that describes who created this object.
labels	labels	string[]	The labels property specifies a set of terms used to describe this object.
created	created	string	The created property represents the time at which the first version of this object was created. The timstamp value MUST be precise to the nearest m illisecond.
modified	modified	string	The modified property represents the time that this particular version of the object was modified. The timstamp value MUST be precise to the nearest m illisecond.
revoked	revoked	string	The revoked property indicates whether the object has been revoked.
confidence	confidence	string	Identifies the confidence that the creator has in the correctness of their data.
lang	lang	string	Identifies the language of the text content in this object.
external _references	external _references	string[]	A list of external references which refers to non-STIX i nformation.
object_m arking_refs	object_m arking_refs	string[]	The list of marking -definition objects to be applied to this object.
granul ar_markings	granul ar_markings	string[]	The set of granular markings that apply to this object.
product	product	string	The name of the analysis engine or product that was used for this analysis.
version	version	string	The version of the analysis product that was used to perform this analysis.
configurat ion_version	configurat ion_version	string	The version of the analysis product co nfiguration that was used to perform this analysis.
modules	modules	string[]	The particular analysis product modules that were used to perform the analysis.
a nalysis_eng ine_version	a nalysis_eng ine_version	string	The version of the analysis engine or product that was used to perform this analysis.
analy sis_definit ion_version	analy sis_definit ion_version	string	The version of the analysis definitions used by the analysis tool.
submitted	submitted	string	The date and time that this malware was first submitted for scanning or analysis.
analy sis_started	analy sis_started	string	The date and time that the malware analysis was initiated.
ana lysis_ended	ana lysis_ended	string	The date and time that the malware analysis ended.
result_name	result_name	string	The cla ssification result or name assigned to the malware instance by the scanner tool.
result	result	string	The cla ssification result as determined by the scanner or tool analysis process.
host_vm_ref	host_vm_ref	string	A description of the virtual machine environment used to host the guest operating system (if applicable) that was used for the dynamic analysis of the malware instance or family.
operating _system_ref	operating _system_ref	string	The operating system that was used to perform the dynamic analysis.
i nstalled_so ftware_refs	i nstalled_so ftware_refs	string[]	Any n on-standard software installed on the operating system used for the dynamic analysis of the malware instance or family.
analys is_sco_refs	analys is_sco_refs	string[]	The list of STIX objects that were captured during the analysis process.
sample_ref	sample_ref	string	Refers to the object this analysis was performed against.
rec overy_prope rty_mapping	rec overy_prope rty_mapping	string	The mapping of Maltego internal property names to STIX property names used for this entity.	{}

Entity Description

Malware Analysis captures the metadata and results of a particular analysis performed (static or dynamic) on the malware instance or family.

STIX2 Report

Entity Meta

Information	Value
Display Name	STIX2 Report
Entity Name	maltego.STIX2.report
Short Description	Reports are collections of threat intelligence focused on one or more topics, such as a description of a threat actor, malware, or attack technique, including context and related details.
Entity Category	STIX 2 domain objects
Base Entities	maltego.STIX2.core

Entity Properties

Display Name	Property Name	Data Type	Short Description	Sample Value
type	type	string	The type of this object, which MUST be the literal `report`.	report
s pec_version	s pec_version	string	The version of the STIX sp ecification used to represent this object.
id	id	string
cre ated_by_ref	cre ated_by_ref	string	The ID of the Source object that describes who created this object.
labels	labels	string[]	The labels property specifies a set of terms used to describe this object.
created	created	string	The created property represents the time at which the first version of this object was created. The timstamp value MUST be precise to the nearest m illisecond.
modified	modified	string	The modified property represents the time that this particular version of the object was modified. The timstamp value MUST be precise to the nearest m illisecond.
revoked	revoked	string	The revoked property indicates whether the object has been revoked.
confidence	confidence	string	Identifies the confidence that the creator has in the correctness of their data.
lang	lang	string	Identifies the language of the text content in this object.
external _references	external _references	string[]	A list of external references which refers to non-STIX i nformation.
object_m arking_refs	object_m arking_refs	string[]	The list of marking -definition objects to be applied to this object.
granul ar_markings	granul ar_markings	string[]	The set of granular markings that apply to this object.
r eport_types	r eport_types	string[]	This field is an Open Vocabulary that specifies the primary subject of this report. The suggested values for this field are in repo rt-type-ov.
name	name	string	The name used to identify the Report.
description	description	string	A description that provides more details and context about Report.
published	published	string	The date that this report object was officially published by the creator of this report.
object_refs	object_refs	string[]	Specifies the STIX Objects that are referred to by this Report.
rec overy_prope rty_mapping	rec overy_prope rty_mapping	string	The mapping of Maltego internal property names to STIX property names used for this entity.	{}

Entity Description

Reports are collections of threat intelligence focused on one or more topics, such as a description of a threat actor, malware, or attack technique, including context and related details.

STIX2 Attack Pattern

Entity Meta

Information	Value
Display Name	STIX2 Attack Pattern
Entity Name	maltego.STIX2.attack-pattern
Short Description	Attack Patterns are a type of TTP that describe ways that adversaries attempt to compromise targets.
Entity Category	STIX 2 domain objects
Base Entities	maltego.STIX2.core

Entity Properties

Display Name	Property Name	Data Type	Short Description	Sample Value
type	type	string	The type of this object, which MUST be the literal `identity`.	identity
s pec_version	s pec_version	string	The version of the STIX sp ecification used to represent this object.
id	id	string
cre ated_by_ref	cre ated_by_ref	string	The ID of the Source object that describes who created this object.
labels	labels	string[]	The labels property specifies a set of terms used to describe this object.
created	created	string	The created property represents the time at which the first version of this object was created. The timstamp value MUST be precise to the nearest m illisecond.
modified	modified	string	The modified property represents the time that this particular version of the object was modified. The timstamp value MUST be precise to the nearest m illisecond.
revoked	revoked	string	The revoked property indicates whether the object has been revoked.
confidence	confidence	string	Identifies the confidence that the creator has in the correctness of their data.
lang	lang	string	Identifies the language of the text content in this object.
external _references	external _references	string[]	A list of external references which refers to non-STIX i nformation.
object_m arking_refs	object_m arking_refs	string[]	The list of marking -definition objects to be applied to this object.
granul ar_markings	granul ar_markings	string[]	The set of granular markings that apply to this object.
roles	roles	string[]	The list of roles that this Identity performs (e.g., CEO, Domain Admi nistrators, Doctors, Hospital, or Retailer). No open vocabulary is yet defined for this property.
name	name	string	The name of this Identity.
description	description	string	A description that provides more details and context about the Identity.
ide ntity_class	ide ntity_class	string	The type of entity that this Identity describes, e.g., an individual or or ganization. Open Vocab -identi ty-class-ov
sectors	sectors	string[]	The list of sectors that this Identity belongs to. Open Vocab -industr y-sector-ov
contact information	contact information	string	The contact information (e-mail, phone number, etc.) for this Identity.
rec overy_prope rty_mapping	rec overy_prope rty_mapping	string	The mapping of Maltego internal property names to STIX property names used for this entity.	{}
x_mitre_id	x_mitre_id	string	ID of the attack pattern in MITRE frameworks
x_mitr e_platforms	x_mitr e_platforms	string[]	OS concerned by this attack pattern in MITRE frameworks
x_mitr e_permissio ns_required	x_mitr e_permissio ns_required	string[]	Permissions required to do this attack pattern in MITRE frameworks
x_mitr e_detection	x_mitr e_detection	string	Detections methods for this attack pattern in MITRE frameworks

Entity Description

Attack Patterns are a type of TTP that describe ways that adversaries attempt to compromise targets.

STIX2 Core

Entity Meta

Information	Value
Display Name	STIX2 Core
Entity Name	maltego.STIX2.core
Short Description	Abstract entity from which all STIX entities inherit common properties
Entity Category	STIX 2 domain objects
Base Entities	(none)

Entity Properties

Display Name	Property Name	Data Type	Short Description
id	id	string
ma rking_color	ma rking_color	string	A color to be used in graphic display to show a marking sign (eg TLP)
m arking_text	m arking_text	string	A text to be used in graphic display to show a marking sign (eg TLP)

Entity Description

Abstract entity from which all STIX entities inherit common properties.

STIX2 Threat Actor

Entity Meta

Information	Value
Display Name	STIX2 Threat Actor
Entity Name	maltego.STIX2.threat-actor
Short Description	Threat Actors are actual individuals, groups, or organizations believed to be operating with malicious intent.
Entity Category	STIX 2 domain objects
Base Entities	maltego.Organization, maltego.STIX2.core

Entity Properties

Display Name	Property Name	Data Type	Short Description	Sample Value
type	type	string	The type of this object, which MUST be the literal `thre at-actor`.	t hreat-actor
s pec_version	s pec_version	string	The version of the STIX sp ecification used to represent this object.
id	id	string
cre ated_by_ref	cre ated_by_ref	string	The ID of the Source object that describes who created this object.
labels	labels	string[]	The labels property specifies a set of terms used to describe this object.
created	created	string	The created property represents the time at which the first version of this object was created. The timstamp value MUST be precise to the nearest m illisecond.
modified	modified	string	The modified property represents the time that this particular version of the object was modified. The timstamp value MUST be precise to the nearest m illisecond.
revoked	revoked	string	The revoked property indicates whether the object has been revoked.
confidence	confidence	string	Identifies the confidence that the creator has in the correctness of their data.
lang	lang	string	Identifies the language of the text content in this object.
external _references	external _references	string[]	A list of external references which refers to non-STIX i nformation.
object_m arking_refs	object_m arking_refs	string[]	The list of marking -definition objects to be applied to this object.
granul ar_markings	granul ar_markings	string[]	The set of granular markings that apply to this object.
title	title	string	A name used to identify this Threat Actor or Threat Actor group.
threat actor_types	threat actor_types	string[]	This field specifies the type of threat actor. Open Vocab -threat-ac tor-type-ov
description	description	string	A description that provides more details and context about the Threat Actor.
aliases	aliases	string[]	A list of other names that this Threat Actor is believed to use.
roles	roles	string[]	This is a list of roles the Threat Actor plays. Open Vocab -threat-ac tor-role-ov
goals	goals	string[]	The high level goals of this Threat Actor, namely, what are they trying to do.
first_seen	first_seen	string	The time that this Threat Actor was first seen.
last_seen	last_seen	string	The time that this Threat Actor was last seen.
sop histication	sop histication	string	The skill, specific knowledge, special training, or expertise a Threat Actor must have to perform the attack. Open Vocab -threat-a ctor-sophis tication-ov
res ource_level	res ource_level	string	This defines the org anizational level at which this Threat Actor typically works. Open Vocab -at tack-resour ce-level-ov
primary _motivation	primary _motivation	string	The primary reason, motivation, or purpose behind this Threat Actor. Open Vocab -attack-mo tivation-ov
secondary motivations	secondary motivations	string[]	The secondary reasons, m otivations, or purposes behind this Threat Actor. Open Vocab -attack-mo tivation-ov
personal motivations	personal motivations	string[]	The personal reasons, m otivations, or purposes of the Threat Actor regardless of org anizational goals. Open Vocab -attack-mo tivation-ov
rec overy_prope rty_mapping	rec overy_prope rty_mapping	string	The mapping of Maltego internal property names to STIX property names used for this entity.	{"title": "name"}

Entity Description

Threat Actors are actual individuals, groups, or organizations believed to be operating with malicious intent.

STIX2 Identity

Entity Meta

Information	Value
Display Name	STIX2 Identity
Entity Name	maltego.STIX2.identity
Short Description	Identities can represent actual individuals, organizations, or groups (e.g., ACME, Inc.) as well as classes of individuals, organizations, or groups.
Entity Category	STIX 2 domain objects
Base Entities	maltego.Company, maltego.STIX2.core

Entity Properties

Display Name	Property Name	Data Type	Short Description	Sample Value
type	type	string	The type of this object, which MUST be the literal `identity`.	identity
s pec_version	s pec_version	string	The version of the STIX sp ecification used to represent this object.
id	id	string
cre ated_by_ref	cre ated_by_ref	string	The ID of the Source object that describes who created this object.
labels	labels	string[]	The labels property specifies a set of terms used to describe this object.
created	created	string	The created property represents the time at which the first version of this object was created. The timstamp value MUST be precise to the nearest m illisecond.
modified	modified	string	The modified property represents the time that this particular version of the object was modified. The timstamp value MUST be precise to the nearest m illisecond.
revoked	revoked	string	The revoked property indicates whether the object has been revoked.
confidence	confidence	string	Identifies the confidence that the creator has in the correctness of their data.
lang	lang	string	Identifies the language of the text content in this object.
external _references	external _references	string[]	A list of external references which refers to non-STIX i nformation.
object_m arking_refs	object_m arking_refs	string[]	The list of marking -definition objects to be applied to this object.
granul ar_markings	granul ar_markings	string[]	The set of granular markings that apply to this object.
title	title	string	The name of this Identity.
roles	roles	string[]	The list of roles that this Identity performs (e.g., CEO, Domain Admi nistrators, Doctors, Hospital, or Retailer). No open vocabulary is yet defined for this property.
description	description	string	A description that provides more details and context about the Identity.
ide ntity_class	ide ntity_class	string	The type of entity that this Identity describes, e.g., an individual or or ganization. Open Vocab -identi ty-class-ov
sectors	sectors	string[]	The list of sectors that this Identity belongs to. Open Vocab -industr y-sector-ov
contact information	contact information	string	The contact information (e-mail, phone number, etc.) for this Identity.
rec overy_prope rty_mapping	rec overy_prope rty_mapping	string	The mapping of Maltego internal property names to STIX property names used for this entity.	{"title": "name"}
x_open cti_aliases	x_open cti_aliases	string[]	Alternative names used to identify this identity.

Entity Description

Identities can represent actual individuals, organizations, or groups (e.g., ACME, Inc.) as well as classes of individuals, organizations, or groups.

STIX2 Intrusion Set

Entity Meta

Information	Value
Display Name	STIX2 Intrusion Set
Entity Name	maltego.STIX2.intrusion-set
Short Description	An Intrusion Set is a grouped set of adversary behavior and resources with common properties that is believed to be orchestrated by a single organization.
Entity Category	STIX 2 domain objects
Base Entities	maltego.STIX2.core

Entity Properties

Display Name	Property Name	Data Type	Short Description	Sample Value
type	type	string	The type of this object, which MUST be the literal `intru sion-set`.	in trusion-set
s pec_version	s pec_version	string	The version of the STIX sp ecification used to represent this object.
id	id	string
cre ated_by_ref	cre ated_by_ref	string	The ID of the Source object that describes who created this object.
labels	labels	string[]	The labels property specifies a set of terms used to describe this object.
created	created	string	The created property represents the time at which the first version of this object was created. The timstamp value MUST be precise to the nearest m illisecond.
modified	modified	string	The modified property represents the time that this particular version of the object was modified. The timstamp value MUST be precise to the nearest m illisecond.
revoked	revoked	string	The revoked property indicates whether the object has been revoked.
confidence	confidence	string	Identifies the confidence that the creator has in the correctness of their data.
lang	lang	string	Identifies the language of the text content in this object.
external _references	external _references	string[]	A list of external references which refers to non-STIX i nformation.
object_m arking_refs	object_m arking_refs	string[]	The list of marking -definition objects to be applied to this object.
granul ar_markings	granul ar_markings	string[]	The set of granular markings that apply to this object.
name	name	string	The name used to identify the Intrusion Set.
description	description	string	Provides more context and details about the Intrusion Set object.
aliases	aliases	string[]	Alternative names used to identify this Intrusion Set.
first_seen	first_seen	string	The time that this Intrusion Set was first seen.
last_seen	last_seen	string	The time that this Intrusion Set was last seen.
goals	goals	string[]	The high level goals of this Intrusion Set, namely, what are they trying to do.
res ource_level	res ource_level	string	This defines the org anizational level at which this Intrusion Set typically works. Open Vocab -at tack-resour ce-level-ov
primary _motivation	primary _motivation	string	The primary reason, motivation, or purpose behind this Intrusion Set. Open Vocab -attack-mo tivation-ov
secondary motivations	secondary motivations	string[]	The secondary reasons, m otivations, or purposes behind this Intrusion Set. Open Vocab -attack-mo tivation-ov
rec overy_prope rty_mapping	rec overy_prope rty_mapping	string	The mapping of Maltego internal property names to STIX property names used for this entity.	{}

Entity Description

An Intrusion Set is a grouped set of adversary behavior and resources with common properties that is believed to be orchestrated by a single organization.

STIX2 Indicator

Entity Meta

Information	Value
Display Name	STIX2 Indicator
Entity Name	maltego.STIX2.indicator
Short Description	Indicators contain a pattern that can be used to detect suspicious or malicious cyber activity.
Entity Category	STIX 2 domain objects
Base Entities	maltego.STIX2.core

Entity Properties

Display Name	Property Name	Data Type	Short Description	Sample Value
type	type	string	The type of this object, which MUST be the literal `i ndicator`.	indicator
s pec_version	s pec_version	string	The version of the STIX sp ecification used to represent this object.
id	id	string
cre ated_by_ref	cre ated_by_ref	string	The ID of the Source object that describes who created this object.
labels	labels	string[]	The labels property specifies a set of terms used to describe this object.
created	created	string	The created property represents the time at which the first version of this object was created. The timstamp value MUST be precise to the nearest m illisecond.
modified	modified	string	The modified property represents the time that this particular version of the object was modified. The timstamp value MUST be precise to the nearest m illisecond.
revoked	revoked	string	The revoked property indicates whether the object has been revoked.
confidence	confidence	string	Identifies the confidence that the creator has in the correctness of their data.
lang	lang	string	Identifies the language of the text content in this object.
external _references	external _references	string[]	A list of external references which refers to non-STIX i nformation.
object_m arking_refs	object_m arking_refs	string[]	The list of marking -definition objects to be applied to this object.
granul ar_markings	granul ar_markings	string[]	The set of granular markings that apply to this object.
indi cator_types	indi cator_types	string[]	This field is an Open Vocabulary that specifies the type of indicator. Open vocab -indica tor-type-ov
name	name	string	The name used to identify the Indicator.
description	description	string	A description that provides the recipient with context about this Indicator potentially including its purpose and its key chara cteristics.
pattern	pattern	string	The detection pattern for this indicator.
p attern_type	p attern_type	string	The type of pattern used in this indicator.
patt ern_version	patt ern_version	string	The version of the pattern that is used.
valid_from	valid_from	string	The time from which this indicator should be considered valuable in telligence.
valid_until	valid_until	string	The time at which this indicator should no longer be considered valuable in telligence.
kill_c hain_phases	kill_c hain_phases	string[]	The phases of the kill chain that this indicator detects.
rec overy_prope rty_mapping	rec overy_prope rty_mapping	string	The mapping of Maltego internal property names to STIX property names used for this entity.	{}

Entity Description

Indicators contain a pattern that can be used to detect suspicious or malicious cyber activity.

STIX2 Infrastructure

Entity Meta

Information	Value
Display Name	STIX2 Infrastructure
Entity Name	maltego.STIX2.infrastructure
Short Description	Infrastructure objects describe systems, software services, and associated physical or virtual resources.
Entity Category	STIX 2 domain objects
Base Entities	maltego.STIX2.core

Entity Properties

Display Name	Property Name	Data Type	Short Description	Sample Value
type	type	string	The type of this object, which MUST be the literal `infras tructure`.	inf rastructure
s pec_version	s pec_version	string	The version of the STIX sp ecification used to represent this object.
id	id	string
cre ated_by_ref	cre ated_by_ref	string	The ID of the Source object that describes who created this object.
labels	labels	string[]	The labels property specifies a set of terms used to describe this object.
created	created	string	The created property represents the time at which the first version of this object was created. The timstamp value MUST be precise to the nearest m illisecond.
modified	modified	string	The modified property represents the time that this particular version of the object was modified. The timstamp value MUST be precise to the nearest m illisecond.
revoked	revoked	string	The revoked property indicates whether the object has been revoked.
confidence	confidence	string	Identifies the confidence that the creator has in the correctness of their data.
lang	lang	string	Identifies the language of the text content in this object.
external _references	external _references	string[]	A list of external references which refers to non-STIX i nformation.
object_m arking_refs	object_m arking_refs	string[]	The list of marking -definition objects to be applied to this object.
granul ar_markings	granul ar_markings	string[]	The set of granular markings that apply to this object.
name	name	string	The name used to identify the Infr astructure.
description	description	string	A description that provides more details and context about this Inf rastructure potentially including its purpose and its key chara cteristics.
infrastru cture_types	infrastru cture_types	string[]	This field is an Open Vocabulary that specifies the type of infr astructure. Open vocab -infrastruct ure-type-ov
aliases	aliases	string[]	Alternative names used to identify this Infr astructure.
kill_c hain_phases	kill_c hain_phases	string[]	The list of kill chain phases for which this inf rastructure is used.
first_seen	first_seen	string	The time that this inf rastructure was first seen performing malicious activities.
last_seen	last_seen	string	The time that this inf rastructure was last seen performing malicious activities.
rec overy_prope rty_mapping	rec overy_prope rty_mapping	string	The mapping of Maltego internal property names to STIX property names used for this entity.	{}

Entity Description

Infrastructure objects describe systems, software services, and associated physical or virtual resources.

STIX2 Course Of Action

Entity Meta

Information	Value
Display Name	STIX2 Course Of Action
Entity Name	maltego.STIX2.course-of-action
Short Description	A Course of Action is an action taken either to prevent an attack or to respond to an attack that is in progress.
Entity Category	STIX 2 domain objects
Base Entities	maltego.STIX2.core

Entity Properties

Display Name	Property Name	Data Type	Short Description	Sample Value
type	type	string	The type of this object, which MUST be the literal `course-o f-action`.	cours e-of-action
s pec_version	s pec_version	string	The version of the STIX sp ecification used to represent this object.
id	id	string
cre ated_by_ref	cre ated_by_ref	string	The ID of the Source object that describes who created this object.
labels	labels	string[]	The labels property specifies a set of terms used to describe this object.
created	created	string	The created property represents the time at which the first version of this object was created. The timstamp value MUST be precise to the nearest m illisecond.
modified	modified	string	The modified property represents the time that this particular version of the object was modified. The timstamp value MUST be precise to the nearest m illisecond.
revoked	revoked	string	The revoked property indicates whether the object has been revoked.
confidence	confidence	string	Identifies the confidence that the creator has in the correctness of their data.
lang	lang	string	Identifies the language of the text content in this object.
external _references	external _references	string[]	A list of external references which refers to non-STIX i nformation.
object_m arking_refs	object_m arking_refs	string[]	The list of marking -definition objects to be applied to this object.
granul ar_markings	granul ar_markings	string[]	The set of granular markings that apply to this object.
name	name	string	The name used to identify the Course of Action.
description	description	string	A description that provides more details and context about this object, potentially including its purpose and its key chara cteristics.
rec overy_prope rty_mapping	rec overy_prope rty_mapping	string	The mapping of Maltego internal property names to STIX property names used for this entity.	{}

Entity Description

A Course of Action is an action taken either to prevent an attack or to respond to an attack that is in progress.

STIX2 Observed Data

Entity Meta

Information	Value
Display Name	STIX2 Observed Data
Entity Name	maltego.STIX2.observed-data
Short Description	Observed data conveys information that was observed on systems and networks, such as log data or network traffic, using the Cyber Observable specification.
Entity Category	STIX 2 domain objects
Base Entities	maltego.STIX2.core

Entity Properties

Display Name	Property Name	Data Type	Short Description	Sample Value
type	type	string	The type of this object, which MUST be the literal `obser ved-data`.	ob served-data
s pec_version	s pec_version	string	The version of the STIX sp ecification used to represent this object.
id	id	string
cre ated_by_ref	cre ated_by_ref	string	The ID of the Source object that describes who created this object.
labels	labels	string[]	The labels property specifies a set of terms used to describe this object.
created	created	string	The created property represents the time at which the first version of this object was created. The timstamp value MUST be precise to the nearest m illisecond.
modified	modified	string	The modified property represents the time that this particular version of the object was modified. The timstamp value MUST be precise to the nearest m illisecond.
revoked	revoked	string	The revoked property indicates whether the object has been revoked.
confidence	confidence	string	Identifies the confidence that the creator has in the correctness of their data.
lang	lang	string	Identifies the language of the text content in this object.
external _references	external _references	string[]	A list of external references which refers to non-STIX i nformation.
object_m arking_refs	object_m arking_refs	string[]	The list of marking -definition objects to be applied to this object.
granul ar_markings	granul ar_markings	string[]	The set of granular markings that apply to this object.
fir st_observed	fir st_observed	string	The beginning of the time window that the data was observed during.
la st_observed	la st_observed	string	The end of the time window that the data was observed during.
numb er_observed	numb er_observed	string	The number of times the data represented in the objects property was observed. This MUST be an integer between 1 and 999,999,999 inclusive.
objects	objects	string	A dictionary of Cyber Observable Objects that describes the single 'fact' that was observed.
object_refs	object_refs	string[]	A list of SCOs and SROs r epresenting the o bservation.
rec overy_prope rty_mapping	rec overy_prope rty_mapping	string	The mapping of Maltego internal property names to STIX property names used for this entity.	{}

Entity Description

Observed data conveys information that was observed on systems and networks, such as log data or network traffic, using the Cyber Observable specification.

STIX2 Tool

Entity Meta

Information	Value
Display Name	STIX2 Tool
Entity Name	maltego.STIX2.tool
Short Description	Tools are legitimate software that can be used by threat actors to perform attacks.
Entity Category	STIX 2 domain objects
Base Entities	maltego.STIX2.core

Entity Properties

Display Name	Property Name	Data Type	Short Description	Sample Value
type	type	string	The type of this object, which MUST be the literal `tool`.	tool
s pec_version	s pec_version	string	The version of the STIX sp ecification used to represent this object.
id	id	string
cre ated_by_ref	cre ated_by_ref	string	The ID of the Source object that describes who created this object.
labels	labels	string[]	The labels property specifies a set of terms used to describe this object.
created	created	string	The created property represents the time at which the first version of this object was created. The timstamp value MUST be precise to the nearest m illisecond.
modified	modified	string	The modified property represents the time that this particular version of the object was modified. The timstamp value MUST be precise to the nearest m illisecond.
revoked	revoked	string	The revoked property indicates whether the object has been revoked.
confidence	confidence	string	Identifies the confidence that the creator has in the correctness of their data.
lang	lang	string	Identifies the language of the text content in this object.
external _references	external _references	string[]	A list of external references which refers to non-STIX i nformation.
object_m arking_refs	object_m arking_refs	string[]	The list of marking -definition objects to be applied to this object.
granul ar_markings	granul ar_markings	string[]	The set of granular markings that apply to this object.
aliases	aliases	string[]	Alternative names used to identify this Tool.
tool_types	tool_types	string[]	The kind(s) of tool(s) being described. Open Vocab -t ool-type-ov
name	name	string	The name used to identify the Tool.
description	description	string	Provides more context and details about the Tool object.
t ool_version	t ool_version	string	The version identifier associated with the tool.
kill_c hain_phases	kill_c hain_phases	string[]	The list of kill chain phases for which this Tool instance can be used.
rec overy_prope rty_mapping	rec overy_prope rty_mapping	string	The mapping of Maltego internal property names to STIX property names used for this entity.	{}

Entity Description

Tools are legitimate software that can be used by threat actors to perform attacks.

STIX2 Campaign

Entity Meta

Information	Value
Display Name	STIX2 Campaign
Entity Name	maltego.STIX2.campaign
Short Description	A Campaign is a grouping of adversary behavior that describes a set of malicious activities or attacks that occur over a period of time against a specific set of targets.
Entity Category	STIX 2 domain objects
Base Entities	maltego.STIX2.core

Entity Properties

Display Name	Property Name	Data Type	Short Description	Sample Value
type	type	string	The type of this object, which MUST be the literal `campaign`.	campaign
s pec_version	s pec_version	string	The version of the STIX sp ecification used to represent this object.
id	id	string
cre ated_by_ref	cre ated_by_ref	string	The ID of the Source object that describes who created this object.
labels	labels	string[]	The labels property specifies a set of terms used to describe this object.
created	created	string	The created property represents the time at which the first version of this object was created. The timstamp value MUST be precise to the nearest m illisecond.
modified	modified	string	The modified property represents the time that this particular version of the object was modified. The timstamp value MUST be precise to the nearest m illisecond.
revoked	revoked	string	The revoked property indicates whether the object has been revoked.
confidence	confidence	string	Identifies the confidence that the creator has in the correctness of their data.
lang	lang	string	Identifies the language of the text content in this object.
external _references	external _references	string[]	A list of external references which refers to non-STIX i nformation.
object_m arking_refs	object_m arking_refs	string[]	The list of marking -definition objects to be applied to this object.
granul ar_markings	granul ar_markings	string[]	The set of granular markings that apply to this object.
name	name	string	The name used to identify the Campaign.
description	description	string	A description that provides more details and context about the Campaign, potentially including its purpose and its key chara cteristics.
aliases	aliases	string[]	Alternative names used to identify this campaign.
first_seen	first_seen	string	The time that this Campaign was first seen.
last_seen	last_seen	string	The time that this Campaign was last seen.
objective	objective	string	This field defines the Campaign’s primary goal, objective, desired outcome, or intended effect.
rec overy_prope rty_mapping	rec overy_prope rty_mapping	string	The mapping of Maltego internal property names to STIX property names used for this entity.	{}

Entity Description

A Campaign is a grouping of adversary behavior that describes a set of malicious activities or attacks that occur over a period of time against a specific set of targets.

STIX2 Grouping

Entity Meta

Entity Properties

Entity Description

STIX2 Note

Entity Meta

Entity Properties

Entity Description

Entity Meta

Entity Properties

Entity Description

STIX2 Location

Entity Meta

Entity Properties

Entity Description

STIX2 Opinion

Entity Meta

Entity Properties

Entity Description

STIX2 Vulnerability

Entity Meta

Entity Properties

Entity Description

STIX2 Malware

Entity Meta

Entity Properties

Entity Description

STIX2 Malware Analysis

Entity Meta

Entity Properties

Entity Description

STIX2 Report

Entity Meta

Entity Properties

Entity Description

STIX2 Attack Pattern

Entity Meta

Entity Properties

Entity Description

STIX2 Core

Entity Meta

Entity Properties

Entity Description

STIX2 Threat Actor

Entity Meta

Entity Properties

Entity Description

STIX2 Identity

Entity Meta

Entity Properties

Entity Description

STIX2 Intrusion Set

Entity Meta

Entity Properties

Entity Description

STIX2 Indicator

Entity Meta

Entity Properties

Entity Description

STIX2 Infrastructure

Entity Meta

Entity Properties

Entity Description

STIX2 Course Of Action

Entity Meta

Entity Properties

Entity Description

STIX2 Observed Data

Entity Meta

Entity Properties

Entity Description

STIX2 Tool

Entity Meta

Entity Properties

Entity Description

STIX2 Campaign

Entity Meta

Entity Properties

Entity Description

Search all Maltego Guides: