Maltego Data
- Maltego Data Pass and Connectors
  - Data Pass and Connectors for Maltego Community Edition (version 4.8.0)
- Maltego Standard Transforms
- Standard Transforms Add-on (CTAS) Server Transforms
  - Maltego Standard Transforms Add-on (CTAS) Server Transforms
- Data Hub Items

Microsoft Sentinel

Modified on: Thu, 21 Dec, 2023 at 5:03 PM

Overview

Microsoft Sentinel delivers intelligent security analytics and threat intelligence across the enterprise.

The Microsoft Sentinel integration for Maltego allows users to import incidents and make deep dives into them using powerful link analysis capabilities and multiple data sources.

Microsoft Sentinel is a scalable, cloud-native solution that provides:

Security information and event management (SIEM)
Security orchestration, automation, and response (SOAR) It delivers intelligent security analytics and threat intelligence across the enterprise.

The Microsoft Sentinel integration for Maltego allows users to import incidents and make deep dives into them using link powerful analysis capabilities and multiple data sources.

Microsoft Sentinel: Jinxpy Sentinel Transforms

Import Incident By URL [Sentinel]

Description

Search for related phone numbers.

Transform Settings

Setting Name	Display Name	Setting Type	Default Value	Optional	Popup	Authentication
maltego.jinxpy_sentinel.global.global#CLIENT_ID	Azure Enterprise App ID	string	None	True	True	False
maltego.jinxpy_sentinel.global.global#CLIENT_SECRET	Azure Enterprise App Secret	string	None	True	True	False
maltego.jinxpy_sentinel.global.global#RESOURCE_GROUP	Azure Resource Group	string	None	True	True	False
maltego.jinxpy_sentinel.global.global#SUBSCRIPTION_ID	Azure Subscription ID	string	None	True	True	False
maltego.jinxpy_sentinel.global.global#TENANT_ID	Azure Tenant ID	string	None	True	True	False
maltego.jinxpy_sentinel.global.global#WORKSPACE_NAME	Sentinel Workspace Name	string	None	True	True	False

Transform Meta Info

Information	Value
Display Name	Import Incident By URL [Sentinel]
Owner	Maltego Technologies GmbH
Author	Maltego Technologies GmbH
Data Source	Sentinel
Transform Name	maltego.jinxpy_sentinel.url_to_incidents
Short Description	Search for related phone numbers.
Input Entities	maltego.URL
Output Entities	maltego.sentinel.Incident

Extract Labels [Sentinel]

Description

Extract labels from this Incident.

Transform Meta Info

Information	Value
Display Name	Extract Labels [Sentinel]
Owner	Maltego Technologies GmbH
Author	Maltego Technologies GmbH
Data Source	Sentinel
Transform Name	maltego.jinxpy_sentinel.extract_incident_labels
Short Description	Extract labels from this Incident.
Input Entities	maltego.sentinel.Incident
Output Entities	maltego.Tag

Extract Alert Product Names [Sentinel]

Description

Extract Alert Product names from this Incident.

Transform Meta Info

Information	Value
Display Name	Extract Alert Product Names [Sentinel]
Owner	Maltego Technologies GmbH
Author	Maltego Technologies GmbH
Data Source	Sentinel
Transform Name	maltego.jinxpy_sentinel.extract_alert_product_names
Short Description	Extract Alert Product names from this Incident.
Input Entities	maltego.sentinel.Incident
Output Entities	maltego.Phrase

Annotate Incident [Sentinel]

Description

Get details of the Incident.

Transform Settings

Setting Name	Display Name	Setting Type	Default Value	Optional	Popup	Authentication
maltego.jinxpy_sentinel.global.global#CLIENT_ID	Azure Enterprise App ID	string	None	True	True	False
maltego.jinxpy_sentinel.global.global#CLIENT_SECRET	Azure Enterprise App Secret	string	None	True	True	False
maltego.jinxpy_sentinel.global.global#RESOURCE_GROUP	Azure Resource Group	string	None	True	True	False
maltego.jinxpy_sentinel.global.global#SUBSCRIPTION_ID	Azure Subscription ID	string	None	True	True	False
maltego.jinxpy_sentinel.global.global#TENANT_ID	Azure Tenant ID	string	None	True	True	False
maltego.jinxpy_sentinel.global.global#WORKSPACE_NAME	Sentinel Workspace Name	string	None	True	True	False

Transform Meta Info

Information	Value
Display Name	Annotate Incident [Sentinel]
Owner	Maltego Technologies GmbH
Author	Maltego Technologies GmbH
Data Source	Sentinel
Transform Name	maltego.jinxpy_sentinel.annotate_incident
Short Description	Get details of the Incident.
Input Entities	maltego.sentinel.Incident
Output Entities	maltego.sentinel.Incident

To Entities [Sentinel]

Transform Settings

Setting Name	Display Name	Setting Type	Default Value	Optional	Popup	Authentication
maltego.jinxpy_sentinel.global.global#CLIENT_ID	Azure Enterprise App ID	string	None	True	True	False
maltego.jinxpy_sentinel.global.global#CLIENT_SECRET	Azure Enterprise App Secret	string	None	True	True	False
maltego.jinxpy_sentinel.global.global#RESOURCE_GROUP	Azure Resource Group	string	None	True	True	False
maltego.jinxpy_sentinel.global.global#SUBSCRIPTION_ID	Azure Subscription ID	string	None	True	True	False
maltego.jinxpy_sentinel.global.global#TENANT_ID	Azure Tenant ID	string	None	True	True	False
maltego.jinxpy_sentinel.global.global#WORKSPACE_NAME	Sentinel Workspace Name	string	None	True	True	False

Transform Meta Info

Information	Value
Display Name	To Entities [Sentinel]
Owner	Maltego Technologies GmbH
Author	Maltego Technologies GmbH
Data Source	Sentinel
Transform Name	maltego.jinxpy_sentinel.incident_to_entities
Short Description
Input Entities	maltego.sentinel.Incident
Output Entities	maltego.DNSName, maltego.File, maltego.Hash, maltego.IPv4Address, maltego.IPv6Address, maltego.EmailAddress, maltego.Malware, maltego.URL, maltego.sentinel.Object

To Security Alert [Sentinel]

Description

Extract the Security Alert associated with this Incident.

Transform Settings

Setting Name	Display Name	Setting Type	Default Value	Optional	Popup	Authentication
maltego.jinxpy_sentinel.global.global#CLIENT_ID	Azure Enterprise App ID	string	None	True	True	False
maltego.jinxpy_sentinel.global.global#CLIENT_SECRET	Azure Enterprise App Secret	string	None	True	True	False
maltego.jinxpy_sentinel.global.global#RESOURCE_GROUP	Azure Resource Group	string	None	True	True	False
maltego.jinxpy_sentinel.global.global#SUBSCRIPTION_ID	Azure Subscription ID	string	None	True	True	False
maltego.jinxpy_sentinel.global.global#TENANT_ID	Azure Tenant ID	string	None	True	True	False
maltego.jinxpy_sentinel.global.global#WORKSPACE_NAME	Sentinel Workspace Name	string	None	True	True	False

Transform Meta Info

Information	Value
Display Name	To Security Alert [Sentinel]
Owner	Maltego Technologies GmbH
Author	Maltego Technologies GmbH
Data Source	Sentinel
Transform Name	maltego.jinxpy_sentinel.incident_to_security_alert
Short Description	Extract the Security Alert associated with this Incident.
Input Entities	maltego.sentinel.Incident
Output Entities	maltego.sentinel.SecurityAlert

To Malware [Sentinel]

Description

Extract Malware.

Transform Meta Info

Information	Value
Display Name	To Malware [Sentinel]
Owner	Maltego Technologies GmbH
Author	Maltego Technologies GmbH
Data Source	Sentinel
Transform Name	maltego.jinxpy_sentinel.mail_custer_to_malware
Short Description	Extract Malware.
Input Entities	maltego.sentinel.MailCluster
Output Entities	maltego.Malware

Extract Sender [Sentinel]

Description

Extracts the sender’s email.

Transform Meta Info

Information	Value
Display Name	Extract Sender [Sentinel]
Owner	Maltego Technologies GmbH
Author	Maltego Technologies GmbH
Data Source	Sentinel
Short Description	Extracts the sender’s email.
Output Entities	maltego.EmailAddress

Variants

Transform Name	Input Entities
maltego.jinxpy_sentinel.extract_sender_0	maltego.sentinel.MailMessage
maltego.jinxpy_sentinel.extract_sender_1	maltego.sentinel.SubmissionMail

Extract Recipient [Sentinel]

Description

Extracts the recipient’s email.

Transform Meta Info

Information	Value
Display Name	Extract Recipient [Sentinel]
Owner	Maltego Technologies GmbH
Author	Maltego Technologies GmbH
Data Source	Sentinel
Short Description	Extracts the recipient’s email.
Output Entities	maltego.EmailAddress

Variants

Transform Name	Input Entities
maltego.jinxpy_sentinel.extract_recipient_0	maltego.sentinel.MailMessage
maltego.jinxpy_sentinel.extract_recipient_1	maltego.sentinel.SubmissionMail

Extract Attack Tactics [Sentinel]

Description

Extracts the Attack Tactics Associated with the given Incident.

Transform Meta Info

Information	Value
Display Name	Extract Attack Tactics [Sentinel]
Owner	Maltego Technologies GmbH
Author	Maltego Technologies GmbH
Data Source	Sentinel
Short Description	Extracts the Attack Tactics Associated with the given Incident.
Output Entities	maltego.sentinel.AttackTactic

Variants

Transform Name	Input Entities
maltego.jinxpy_sentinel.extract_attack_tactics_0	maltego.sentinel.Incident
maltego.jinxpy_sentinel.extract_attack_tactics_1	maltego.sentinel.SecurityAlert

Import Incidents [Sentinel]

Description

Imports all Sentinel Incidents

Transform Settings

Setting Name	Display Name	Setting Type	Default Value	Optional	Popup	Authentication
maltego.jinxpy_sentinel.global.global#CLIENT_ID	Azure Enterprise App ID	string	None	True	True	False
maltego.jinxpy_sentinel.global.global#CLIENT_SECRET	Azure Enterprise App Secret	string	None	True	True	False
maltego.jinxpy_sentinel.global.global#RESOURCE_GROUP	Azure Resource Group	string	None	True	True	False
maltego.jinxpy_sentinel.global.global#SUBSCRIPTION_ID	Azure Subscription ID	string	None	True	True	False
maltego.jinxpy_sentinel.global.global#TENANT_ID	Azure Tenant ID	string	None	True	True	False
maltego.jinxpy_sentinel.global.global#WORKSPACE_NAME	Sentinel Workspace Name	string	None	True	True	False
maltego.jinxpy_sentinel.import_incidents.INCIDENT_CREATED_BETWEEN	Incident Created Between	daterange	None	True	True	False
maltego.jinxpy_sentinel.import_incidents.INCIDENT_SEVERITY	Incident Severity	string	None	True	True	False
maltego.jinxpy_sentinel.import_incidents.INCIDENT_STATUS	Incident Status	string	None	True	True	False

Transform Meta Info

Information	Value
Display Name	Import Incidents [Sentinel]
Owner	Maltego Technologies GmbH
Author	Maltego Technologies GmbH
Data Source	Sentinel
Transform Name	maltego.jinxpy_sentinel.import_incidents
Short Description	Imports all Sentinel Incidents
Input Entities	maltego.sentinel.Instance
Output Entities	maltego.sentinel.Incident

Overview

Microsoft Sentinel: Jinxpy Sentinel Transforms

Import Incident By URL [Sentinel]

Description

Transform Settings

Transform Meta Info

Extract Labels [Sentinel]

Description

Transform Meta Info

Extract Alert Product Names [Sentinel]

Description

Transform Meta Info

Annotate Incident [Sentinel]

Description

Transform Settings

Transform Meta Info

To Entities [Sentinel]

Transform Settings

Transform Meta Info

To Security Alert [Sentinel]

Description

Transform Settings

Transform Meta Info

To Malware [Sentinel]

Description

Transform Meta Info

Extract Sender [Sentinel]

Description

Transform Meta Info

Variants

Extract Recipient [Sentinel]

Description

Transform Meta Info

Variants

Extract Attack Tactics [Sentinel]

Description

Transform Meta Info

Variants

Import Incidents [Sentinel]

Description

Transform Settings

Transform Meta Info

Search all Maltego Guides: