Maltego XL

Maltego XL is an enhanced version of the classic GUI used to visualize large graphs.

What is Maltego?

Maltego is an interactive data mining tool that renders directed graphs for link analysis. The tool is used in online investigations for finding relationships between pieces of information from various sources located on the Internet.

Maltego uses the idea of transforms to automate the process of querying different data sources. This information is then displayed on a node based graph suited for performing link analysis.

Currently there are three versions of the Maltego client namely Maltego CE, Maltego Classic and Maltego XL. This page will focus on Maltego XL.

All three Maltego clients come with access to a library of standard transforms for the discovery of data from a wide range of public sources that are commonly used in online investigations and digital forensics.

Because Maltego can seamlessly integrate with nearly any data source many data vendors have chosen to use Maltego as a delivery platform for their data. This also means Maltego can be adapted to your own, unique requirements. Our current data partners can be found on the Transform Hub page linked to below.


What is Maltego XL?

Maltego XL (eXtra Large) is the premier edition of the three Maltego clients, it includes all the capabilities and features of Maltego Classic but with enhanced capability of working with extremely large graphs. Just like with Maltego Classic, Maltego XL will allow you to map out a clear threat picture of your entire network making it easy to identify its weak points and abnormalities.


What does Maltego do?

The focus of Maltego is analyzing real-world relationships between information that is publically accessible on the Internet. This includes footprinting Internet infrastructure as well as gathering information about the people and organisation who own it.

Maltego can be used to determine the relationships between the following entities:

  • People.
    • Names.
    • Email addresses.
    • Aliases.
  • Groups of people (social networks).
  • Companies.
  • Organizations.
  • Web sites.
  • Internet infrastructure such as:
    • Domains.
    • DNS names.
    • Netblocks.
    • IP addresses.
  • Affiliations.
  • Documents and files.

Connections between these pieces of information are found using open source intelligence (OSINT) techniques by querying sources such as DNS records, whois records, search engines, social networks, various online APIs and extracting meta data.

Maltego provides results in a wide range of graphical layouts that allow for clustering of information which makes seeing relationships instant and accurate – this makes it possible to see hidden connections even if they are three or four degrees of separation apart.

Maltego XL Features:

  • The ability to perform link analysis on up to 1 000 000 entities on a single graph.
  • The capability to return up to 10 000 entities per transform.
  • Includes collection nodes which automatically group entities together with common features allowing you to see passed the noise and find the key relationships you are looking for.
  • Includes the ability to share graphs in real-time with multiple analysts in a single session.
  • Graph export options include:
    • Images - jpg, bmp, png and gif.
    • Generate PDF reports.
    • Tabular formats - csv, xlx and xlsx.
    • GraphML.
    • Entity lists.
  • Graph import options include:
    • Tabular formats - csv, xlx and xlsx.
    • Copy and paste.

Technical Details:

  • Maltego is easy and quick to install - it uses Java, so it runs on Windows, Mac and Linux.
  • Hardware Requirements:
    • A Maltego client requires at least 2GB of RAM, but the more the merrier as Maltego loves memory.
    • Any modern multi-core processor will have more than enough processing power.
    • 4GB of disk space should be more than enough.
    • Using a mouse makes navigating Maltego graphs much easier and is definitely recommended.

  • Network Requirements:
    • A Maltego client requires Internet Access to operate fully.
    • The client will need to make outgoing connections on the following ports: 80, 443, 8081. Additionally port 5222 is needed to join shared graphs on Paterva's public Comms server.
    • Please note that a Maltego client may need to make connections on additonal ports if the client is using transform from 3rd party transform vendors from the Transform Hub.

What can Maltego XL do for me?

Maltego can be used for the information gathering phase of all security related work. It will save you time and will allow you to work more accurately and smarter.

Maltego provides you with a much more powerful search, giving you smarter results. If access to "hidden" information determines your success, Maltego can help you discover it.

Maltego aids you in your thinking process by visually demonstrating interconnected links between searched items.