Maltego Guide
Master the reference tool for OSINT data visualization and analysis. Map complex relationships and uncover hidden connections.
What is Maltego?
Maltego is a visual intelligence platform originally created by Paterva and now published by Maltego Technologies that maps and analyzes relationships between digital entities. Used by OSINT analysts, security researchers and investigators, Maltego turns raw data into interactive graphs that reveal hidden connections.
Key features
Advanced capabilities for investigation and data analysis
Graph visualization
Interactive mapping of entity relationships with zoom, filters and automatic layouts
Transformations
More than 1,000 transforms to enrich your data from multiple sources
Collective intelligence
Integration with Shodan, VirusTotal, Censys, PassiveTotal and 50+ OSINT sources
Link analysis
Automatic discovery of hidden connections and patterns between entities
Collaboration
Graph sharing, real-time collaboration and team project management
Machine learning
Predictive analysis, anomaly detection and automatic entity classification
Entity types
Entities you can work with and their related transforms
Personnes
Profiles, digital identities and personal information
Organisations
Companies, institutions and organizational structures
Infrastructure
Network elements, servers and technical infrastructure
Documents
Files, metadata and digital content
Geolocation
Coordinates, addresses and geographic data
Appareils
Connected equipment, IoT and devices
Available transforms
Transform categories to enrich your investigations
DNS & domains
WHOIS & Registrar
Threat Intelligence
Social Media
Practical use cases
Real-world investigation scenarios with Maltego
Cybersecurity investigation
Analyzing malicious infrastructure after an intrusion
Detailed workflow
Domain analysis
Add the malicious domain as the pivot entity
DNS infrastructure
Run DNS transforms (IP, NS, MX, subdomains)
WHOIS enrichment
Enrich with WHOIS data and history
IP relationships
Find related IPs and their geolocation
Threat intel
Cross-check with VirusTotal, Shodan, PassiveTotal
Attribution
Analyze patterns and identify the attacker
Corporate due diligence
A full investigation into an organization and its executives
Detailed workflow
Organization entity
Create an entity with the company's name and domain
Dirigeants
Extract executives' names through LinkedIn and WHOIS
Filiales
Find related companies and international subsidiaries
Infrastructure
Map domains, IPs and exposed services
Social networks
Analyze social presence and employees
Rapport
Produce a visual report with the graph and metrics
Social network analysis
Mapping an influence network on social media
Detailed workflow
Target profile
Add the main social profile (Twitter, LinkedIn)
Connexions
Extract followers, followings and interactions
Influence
Compute influence and centrality metrics
Communities
Detect clusters and topical communities
Patterns
Identify suspicious accounts and bots
Timeline
Analyze how the network evolves over time
Best practices
Essential recommendations for effective investigations
Do
- Set clear objectivesDefine the scope before starting the investigation
- Use reliable entitiesStart from verified data
- Organize the graphUse layouts, colors and groups for readability
- Configure the APIsShodan, VirusTotal, PassiveTotal for maximum enrichment
- Save regularlyExport your graphs and document your findings
- Validate the resultsCross-check information with several sources
Avoid
- Overloading the graphToo many entities hurt readability and analysis
- Ignoring API limitsRespect quotas to avoid being blocked
- Neglecting OPSECUse a VPN and protect your identity while researching
- Relying on transforms aloneManually verify critical data
- Skipping documentationDocument sources, dates and methods for traceability
- Breaking the lawStay within OSINT's legal and ethical boundaries
Getting started
Maltego installation and setup guide
Installation
Download Maltego Community Edition (free) or a commercial edition
https://www.maltego.com/downloads/Configuring transforms
Install Transform Hubs to enrich your data
- • Shodan Transform Hub (infrastructure reconnaissance)
- • VirusTotal Transform Hub (threat intelligence)
- • PassiveTotal Transform Hub (passive DNS)
- • Social Links Transform Hub (social networks)
Configuring API keys
Add your API keys in Settings → Transform Hub Manager
Your first graph
Create a new graph and add your first entity (domain, IP, email...)
Legal and ethical considerations
Using Maltego must comply with local and international data protection and privacy laws. Make sure you have the necessary authorization before investigating people or organizations.
- Only use public, lawful sources
- Comply with GDPR and local regulations
- Document your sources and methodologies
- Obtain the authorizations your investigations require
Resources and documentation
Useful links to go further
Official Maltego website
Official downloads, documentation and training
Official documentation
Complete guides, tutorials and API references
Transform Hub
Catalog of available transforms and integrations
Blog & case studies
Articles, case studies and new features
Ready to map your investigations?
Explore other OSINT tools and practice with our guided investigations
Ready to put it into practice?
CyberXTEL is our free platform to train hands-on: certifications, CTFs and a dedicated cyber awareness space.