next »

[Maltego Forum]

Maltego Forum » Support » Help!
Additional Field Matching Rule

[RobertMcArdle]

Hi There

I'm trying to get my head around how the Matching Rules on Entities work. Take this code for example (its using my own Ruby version of the PHP/Python API - but its essentially the same)

transform = MaltegoTransform.new()
phrase1 = transform.addEntity("Phrase","Phrase1")
phrase1.addAdditionalFields("SampleField", "displayName", "strict", "value1")
phrase2 = transform.addEntity("Phrase","Phrase1")
phrase2.addAdditionalFields("SampleField", "displayName", "strict", "value2")
phrase3 = transform.addEntity("Phrase","Phrase2")
phrase3.addAdditionalFields("SampleField", "displayName", "strict", "value1")
transform.printOutput()

This will result in two outputted Entities - both will have a value of "Phrase1", and obviously different values for the field "FieldName"

However it will not create the third entity "Phrase2", I'm assuming because another phrase entity exists with the SampleField set to value1. But how can the two phrases match if the values are different (even if the SampleField is the same)

Any help would be great!

    * Operating System - Windows
    * Hardware Specs - Pretty Decent
    * Java Version - most recent
    * Maltego Version ( Help -> About Maltego ) - 3.0.847

[AndrewMacPherson]

Hi Robert,

I have just recreated your test with the following code from the PHP library:
<snip>
        $mt = new MaltegoTransform();
   $NewEnt = $mt->addEntity("Phrase","Phrase1");
   $NewEnt->addAdditionalFields("SampleField","displayName","strict","value1");
   $NewEnt = $mt->addEntity("Phrase","Phrase1");
   $NewEnt->addAdditionalFields("SampleField","displayName","strict","value2");
   $NewEnt = $mt->addEntity("Phrase","Phrase2");
   $NewEnt->addAdditionalFields("SampleField","displayName","strict","value1");
   $mt->returnOutput();
</snip>

And it seems to return all 3 entities for me, so i recommend you first update your Maltego since i see the version you are using is relatively old and then try again, otherwise perhaps post your library as well and i will look into it for you.

Cheers,
-AM

[RobertMcArdle]

Thanks Andrew - updating the version of Maltego did the trick

I've also add the Ruby Library - http://www.paterva.com/forum//index.php/topic,210.0.html

Bob McArdle