Overview
The PolySwarm integration for Maltego allows users to pivot and right-click on any file hash, domain, or IP address to gain insights into the malware behind it. Users may pivot on enrichments to discover related intelligence for a given malware campaign. Users may also subscribe to a feed of the freshest malware seen by PolySwarm for detection/blocking. PolySwarm provides users with the option to upload, scan and sandbox any malware sample on demand.
- Simple right-click insights into any malware file hash or malware infrastructure
- Feeds of brand-new and first-seen malware variants for automated detection and blocking
- High-speed analysis of new suspicious file samples through sandboxing and specialized niche analysis engines
- Create a centralized knowledge repository to maintain investigative intelligence.
The Polyswarm Hub item includes the following types of Transforms:
- Scam Transforms
- Hash Transforms
- Metadata Transforms (Available with data subscriptions)
To learn more about these Transform types, check out our FAQ.
You can also read more about PolySwarm Transforms for Maltego here.
Pricing & Access
Community Hub
Maltego Community Edition users have the following purchase options:
Simply install and start using the Hub item with a data allowance of 50 Transform runs per month.
Commercial Hub
Maltego One license users have the following purchase options:
Simply install and start using the Hub item with the following data allowances:
- Maltego Pro: 250 Transform runs per month.
- Maltego Enterprise: 500 Transform runs per day.
Purchase a flexible and affordable data subscription on our web-shop, starting from €900 for 100 metadata Transform runs per month per user.
Plug in your own API key and start using the Hub item on Maltego.
| maltego.jinxpy_polyswarm.global.global#polyswarm_api_key | PolySwarm API Key | string | None | True | True | False |
| maltego.jinxpy_polyswarm.global.global#polyswarm_scan_timeout | Scan Timeout (Max/Default: 100 sec) | int | 100 | True | True | False |
| Display Name | Perform Scan [Polyswarm] |
| Owner | |
| Author | Maltego Technologies |
| Data Source | Polyswarm |
| Output Entities | maltego.polyswarm.PolyswarmScan |
Variants
| maltego.jinxpy_polyswarm.perform_scan_for_domain | Performs a scan for the given domain and returns the result from PolySwarm. | maltego.Domain |
| maltego.jinxpy_polyswarm.perform_scan_for_url | Performs a scan for the given URL and returns the result from PolySwarm. | maltego.URL |
| maltego.jinxpy_polyswarm.perform_scan_for_ipv4 | Performs a scan for the given IPv4 Address and returns the result from PolySwarm. | maltego.IPv4Address |
| maltego.jinxpy_polyswarm.perform_scan_for_ipv6 | Performs a scan for the given IPv6 Address and returns the result from PolySwarm.. | maltego.IPv6Address |
Lookup by Hash [Polyswarm]
Description
Seeks the scan for the given Hash and returns the result from PolySwarm.
| maltego.jinxpy_polyswarm.global.global#polyswarm_api_key | PolySwarm API Key | string | None | True | True | False |
| Display Name | Lookup by Hash [Polyswarm] |
| Owner | |
| Author | Maltego Technologies |
| Data Source | Polyswarm |
| Transform Name | maltego.jinxpy_polyswarm.lookup_scan_by_hash |
| Short Description | Seeks the scan for the given Hash and returns the result from PolySwarm. |
| Input Entities | maltego.Hash |
| Output Entities | maltego.polyswarm.PolyswarmScan |
To Dropped Scan [Polyswarm]
Description
Returns dropped scan result for given scan from PolySwarm.
| maltego.jinxpy_polyswarm.global.global#polyswarm_api_key | PolySwarm API Key | string | None | True | True | False |
| Display Name | To Dropped Scan [Polyswarm] |
| Owner | |
| Author | Maltego Technologies |
| Data Source | Polyswarm |
| Transform Name | maltego.jinxpy_polyswarm.scan_to_dropped_scan |
| Short Description | Returns dropped scan result for given scan from PolySwarm. |
| Input Entities | maltego.polyswarm.PolyswarmScan |
| Output Entities | maltego.polyswarm.PolyswarmScan |
Annotate Polyswarm Scan [Polyswarm]
Description
Retrieves properties of a given scan from Polyswarm.
| maltego.jinxpy_polyswarm.global.global#polyswarm_api_key | PolySwarm API Key | string | None | True | True | False |
| Display Name | Annotate Polyswarm Scan [Polyswarm] |
| Owner | |
| Author | Maltego Technologies |
| Data Source | Polyswarm |
| Transform Name | maltego.jinxpy_polyswarm.scan_to_annotate |
| Short Description | Retrieves properties of a given scan from Polyswarm. |
| Input Entities | maltego.polyswarm.PolyswarmScan |
| Output Entities | maltego.polyswarm.PolyswarmScan |
Find Contacted Domains [Polyswarm]
Description
Returns contacted domains from PolySwarm.
| maltego.jinxpy_polyswarm.global.global#polyswarm_api_key | PolySwarm API Key | string | None | True | True | False |
| Display Name | Find Contacted Domains [Polyswarm] |
| Owner | |
| Author | Maltego Technologies |
| Data Source | Polyswarm |
| Transform Name | maltego.jinxpy_polyswarm.scan_to_contacted_domains |
| Short Description | Returns contacted domains from PolySwarm. |
| Input Entities | maltego.polyswarm.PolyswarmScan |
| Output Entities | maltego.Domain |
Description
Returns contacted IP Addresses from PolySwarm.
| maltego.jinxpy_polyswarm.global.global#polyswarm_api_key | PolySwarm API Key | string | None | True | True | False |
| Display Name | Find Contacted IP Addresses [Polyswarm] |
| Owner | |
| Author | Maltego Technologies |
| Data Source | Polyswarm |
| Transform Name | maltego.jinxpy_polyswarm.scan_to_contacted_ip |
| Short Description | Returns contacted IP Addresses from PolySwarm. |
| Input Entities | maltego.polyswarm.PolyswarmScan |
| Output Entities | maltego.IPv4Address, maltego.IPv6Address |
Description
Returns contacted URLs from PolySwarm.
| maltego.jinxpy_polyswarm.global.global#polyswarm_api_key | PolySwarm API Key | string | None | True | True | False |
| Display Name | Find Contacted URLs [Polyswarm] |
| Owner | |
| Author | Maltego Technologies |
| Data Source | Polyswarm |
| Transform Name | maltego.jinxpy_polyswarm.scan_to_contacted_url |
| Short Description | Returns contacted URLs from PolySwarm. |
| Input Entities | maltego.polyswarm.PolyswarmScan |
| Output Entities | maltego.URL |
Find IOC URLs [Polyswarm]
Description
Returns IOC URLs from PolySwarm.
| maltego.jinxpy_polyswarm.global.global#polyswarm_api_key | PolySwarm API Key | string | None | True | True | False |
| Display Name | Find IOC URLs [Polyswarm] |
| Owner | |
| Author | Maltego Technologies |
| Data Source | Polyswarm |
| Transform Name | maltego.jinxpy_polyswarm.scan_to_ioc_url |
| Short Description | Returns IOC URLs from PolySwarm. |
| Input Entities | maltego.polyswarm.PolyswarmScan |
| Output Entities | maltego.URL |
Find IOC IP Addresses [Polyswarm]
Description
Returns IOC IP Addresses from PolySwarm.
| maltego.jinxpy_polyswarm.global.global#polyswarm_api_key | PolySwarm API Key | string | None | True | True | False |
| Display Name | Find IOC IP Addresses [Polyswarm] |
| Owner | |
| Author | Maltego Technologies |
| Data Source | Polyswarm |
| Transform Name | maltego.jinxpy_polyswarm.scan_to_ioc_ip |
| Short Description | Returns IOC IP Addresses from PolySwarm. |
| Input Entities | maltego.polyswarm.PolyswarmScan |
| Output Entities | maltego.IPv4Address |
Find IOC TTPs [Polyswarm]
Description
Returns IOC TTPs from PolySwarm.
| maltego.jinxpy_polyswarm.global.global#polyswarm_api_key | PolySwarm API Key | string | None | True | True | False |
| Display Name | Find IOC TTPs [Polyswarm] |
| Owner | |
| Author | Maltego Technologies |
| Data Source | Polyswarm |
| Transform Name | maltego.jinxpy_polyswarm.scan_to_ioc_ttp |
| Short Description | Returns IOC TTPs from PolySwarm. |
| Input Entities | maltego.polyswarm.PolyswarmScan |
| Output Entities | maltego.AttackTechniqueID |
To Hashes [Polyswarm]
Description
Returns the associated file hashes from PolySwarm.
| maltego.jinxpy_polyswarm.global.global#polyswarm_api_key | PolySwarm API Key | string | None | True | True | False |
| Display Name | To Hashes [Polyswarm] |
| Owner | |
| Author | Maltego Technologies |
| Data Source | Polyswarm |
| Transform Name | maltego.jinxpy_polyswarm.scan_to_hashes |
| Short Description | Returns the associated file hashes from PolySwarm. |
| Input Entities | maltego.polyswarm.PolyswarmScan |
| Output Entities | maltego.Hash |
To Names [Polyswarm]
Description
Returns the associated artifact name from PolySwarm.
| maltego.jinxpy_polyswarm.global.global#polyswarm_api_key | PolySwarm API Key | string | None | True | True | False |
| Display Name | To Names [Polyswarm] |
| Owner | |
| Author | Maltego Technologies |
| Data Source | Polyswarm |
| Transform Name | maltego.jinxpy_polyswarm.scan_to_names |
| Short Description | Returns the associated artifact name from PolySwarm. |
| Input Entities | maltego.polyswarm.PolyswarmScan |
| Output Entities | maltego.Phrase, maltego.polyswarm.PolyswarmScan |
To Signatures [Polyswarm]
Description
Returns the signatures associated with the given PolySwarm scan.
| maltego.jinxpy_polyswarm.global.global#polyswarm_api_key | PolySwarm API Key | string | None | True | True | False |
| Display Name | To Signatures [Polyswarm] |
| Owner | |
| Author | Maltego Technologies |
| Data Source | Polyswarm |
| Transform Name | maltego.jinxpy_polyswarm.scan_to_signatures |
| Short Description | Returns the signatures associated with the given PolySwarm scan. |
| Input Entities | maltego.polyswarm.PolyswarmScan |
| Output Entities | maltego.polyswarm.ThreatSignature |
Description
Returns the tags associated with the given PolySwarm scan.
| maltego.jinxpy_polyswarm.global.global#polyswarm_api_key | PolySwarm API Key | string | None | True | True | False |
| Display Name | To Tags [Polyswarm] |
| Owner | |
| Author | Maltego Technologies |
| Data Source | Polyswarm |
| Transform Name | maltego.jinxpy_polyswarm.scan_to_tags |
| Short Description | Returns the tags associated with the given PolySwarm scan. |
| Input Entities | maltego.polyswarm.PolyswarmScan |
| Output Entities | maltego.polyswarm.Tag, maltego.polyswarm.PolyswarmScan |
To TTPs [Polyswarm]
Description
Returns the associated TTPs of the given Polyswarm scan.
| maltego.jinxpy_polyswarm.global.global#polyswarm_api_key | PolySwarm API Key | string | None | True | True | False |
| Display Name | To TTPs [Polyswarm] |
| Owner | |
| Author | Maltego Technologies |
| Data Source | Polyswarm |
| Transform Name | maltego.jinxpy_polyswarm.scan_to_ttps |
| Short Description | Returns the associated TTPs of the given Polyswarm scan. |
| Input Entities | maltego.polyswarm.PolyswarmScan |
| Output Entities | maltego.AttackTechniqueID |
To Crypto Addresses [Polyswarm]
Description
Returns the associated crypto addresses of the given PolySwarm scan.
| maltego.jinxpy_polyswarm.global.global#polyswarm_api_key | PolySwarm API Key | string | None | True | True | False |
| Display Name | To Crypto Addresses [Polyswarm] |
| Owner | |
| Author | Maltego Technologies |
| Data Source | Polyswarm |
| Transform Name | maltego.jinxpy_polyswarm.scan_to_crypto |
| Short Description | Returns the associated crypto addresses of the given PolySwarm scan. |
| Input Entities | maltego.polyswarm.PolyswarmScan |
| Output Entities | maltego.CryptocurrencyAddress |
Description
Returns PolySwarm scan results associated with the given metadata.
| maltego.jinxpy_polyswarm.global.global#polyswarm_api_key | PolySwarm API Key | string | None | True | True | False |
| maltego.jinxpy_polyswarm.global.global#polyswarm_search_query | Metadata Query (ex: strings.urls) | string | None | True | True | False |
| Display Name | Search in Previous Scan’s Metadata [Polyswarm] |
| Owner | |
| Author | Maltego Technologies |
| Data Source | Polyswarm |
| Short Description | Returns PolySwarm scan results associated with the given metadata. |
| Output Entities | maltego.polyswarm.PolyswarmScan |
Variants
| maltego.jinxpy_polyswarm.ipv4_to_scan | maltego.IPv4Address |
| maltego.jinxpy_polyswarm.ipv6_to_scan | maltego.IPv6Address |
| maltego.jinxpy_polyswarm.domain_to_scan | maltego.Domain |
| maltego.jinxpy_polyswarm.url_to_scan | maltego.URL |
| maltego.jinxpy_polyswarm.tag_to_scan | maltego.polyswarm.Tag |
| maltego.jinxpy_polyswarm.crypto_to_scan | maltego.CryptocurrencyAddress |
| maltego.jinxpy_polyswarm.jarm_to_scan | maltego.polyswarm.JARMFingerprint |
Description
Returns PolySwarm scan results associated with the given IOC.
| maltego.jinxpy_polyswarm.global.global#polyswarm_api_key | PolySwarm API Key | string | None | True | True | False |
| Display Name | Search by IOC in Previous Scan’s Metadata [Polyswarm] |
| Owner | |
| Author | Maltego Technologies |
| Data Source | Polyswarm |
| Short Description | Returns PolySwarm scan results associated with the given IOC. |
| Output Entities | maltego.polyswarm.PolyswarmScan |
Variants
| maltego.jinxpy_polyswarm.ioc_ipv4_to_scan | maltego.IPv4Address |
| maltego.jinxpy_polyswarm.ioc_ttp_to_scan | maltego.AttackTechniqueID |
| maltego.jinxpy_polyswarm.ioc_domain_to_scan | maltego.Domain |