CyberCode Academy

Course 12 - Maltego Advanced Course | Episode 4: Custom Entity Design and Implementation in Maltego

Listen Later
In this lesson, you’ll learn about:
  • How to create custom entities in Maltego
  • How to name entities and assign unique type IDs
  • How entity properties, main properties, and data types work
  • How inheritance allows new entities to reuse transforms
  • How to use advanced features like calculated properties and visual overlays
  • How to build dynamic, visually adaptive entities for specialized investigations
Summary of the Episode: This episode walks through the full process of designing and implementing custom entities in Maltego, beginning with basic creation and advancing toward powerful features like inheritance, calculated properties, regex parsing, and dynamic icon overlays. It demonstrates how users can tailor Maltego to fit specialized investigation workflows by defining their own data structures and visual representations. 1. Naming and Identifying Custom Entities Creating a custom entity starts with two essential identifiers: Display Name
  • A human-readable name, such as Worker, that appears in the graph.
Type ID (Unique Identifier)
  • Must be globally unique to avoid conflicts
  • Typically structured with a namespace, e.g.:
    • investitech.worker (organization format)
    • my.worker (personal or training use)
2. Creating a Basic Custom Entity To create a minimal entity, define:
  • Display name: e.g., worker
  • Short description: Explains its purpose
  • Unique type ID: e.g., my.worker
  • Category: e.g., personal
Main Property Every entity requires at least one property.
Example:
  • Property name: worker name
  • Type: string
  • Sample value: John Doe
The main property appears in bold in the property list and typically identifies the entity on the graph. 3. Using Entity Inheritance Inheritance allows a new entity to reuse all transforms and properties of an existing one. Examples:
  • Website inherits from DNS name to gain transforms like “To IP address”.
  • A custom worker entity inherits from maltego.person to reuse:
    • First/last name properties
    • Person-related transforms
This makes the new entity more functional without additional configuration. 4. Additional Properties Custom entities can include any number of extra properties. Property types include:
  • Strings
  • Numbers
  • Dates
  • Booleans
  • Images
  • Locations
Default vs Sample Values
  • Sample value: Appears when dragging the entity from the palette
  • Default value: Used if the property is left empty
5. Calculated Properties Calculated properties automatically combine or transform other property values. Common annotations:
  • $property(name): Reference another property
  • $trim(): Remove surrounding whitespace
Example:
A full name property combining first and last names. Calculated properties can be:
  • Visible
  • Hidden
  • Read-only (evidence-safe)
6. Display Settings & Overlays Maltego entities can display visual cues based on their property values. Large Image (Icon)
  • Can be chosen dynamically using a calculated property
Overlays (5 Positions)
  • North
  • Northwest
  • West
  • Southwest
  • South
Overlays can show:
  • Images
  • Colors
  • Text (e.g., job titles, statuses, labels)
This gives investigators a quick visual read of key details without inspecting the property panel. 7. Regular Expressions for Parsing Regular expressions help:
  • Automatically match input values to the correct entity type
  • Extract structured data from plain text
Example:
  • Splitting "40.7128 -74.0060" into latitude/longitude values.
8. Advanced Example: The Custom Worker Entity The episode demonstrates a feature-rich worker entity: Inheritance
  • Inherits from maltego.person
Additional Properties
  • gender
  • skin tone
  • job
Calculated Property
  • A hidden, read-only property called combined:
    gender_skintone_job
Used to determine the icon dynamically. Dynamic Appearance
  • Large icon changes based on the combined property value
  • Job title appears as a north overlay
This showcases how custom entities can visually adapt according to their data—ideal for specialized investigative environments. Conclusion By mastering custom entity design, inheritance, calculated properties, regex parsing, and graphical overlays, investigators can transform Maltego into a fully customized platform that models the exact data structures relevant to their cases.

You can listen and download our episodes for free on more than 10 different platforms:
https://linktr.ee/cybercode_academy
...more
View all episodesView all episodes
Download on the App Store
CyberCode AcademyBy CyberCode Academy