There are a few important concepts in Maltego that need to be understood before using the tool.
Collaboration
Collaborate with your team on the same graph and share access to different datasets live.
Data Subscription
Maltego data subscriptions are a subscription-based model to allow investigators to purchase usage-based access to third-party data directly in the Maltego web-shop.
Maltego Graph / Desktop Client / Client
References to the Maltego Graph (desktop) software used on the desktop is referred to as the Desktop Client, the Client or the Maltego Graph (desktop) Client.
Entity / Entities
What are Maltego Entities? An Entity is a piece of information shown as a node on the graph. Different Entity types are used to differentiate between the different pieces of information that can be represented in Maltego.
Entities can be anything from a DNS name, Person name, Phone number, etc. The Maltego Graph (desktop) Client comes pre-loaded with numerous Entities targeted for use in online investigations, however, you can also create your own custom Entities.
You can read more about Maltego Entities here.
Maltego Data Hub / Hub / Hub Item/s
Through the Maltego Data Hub, Maltego users are able to access paid and free data from a variety of public sources (OSINT) as well as over 100 third-party Data Sources.
Transforms and the Entity types that they query need to be stored on a server that can be accessed by the Maltego Client.
Hub items allow Maltego users to install combinations of Transforms, Entities and Machines from a server. By default, Maltego installs the Hub item called Standard Transforms which contains the Transforms, Entities and Machines that are developed and maintained by the developers at Maltego.
Additional Hub items in the form of Connectors (third-party Integrations through Maltego's Data Partners) can also be installed from the Data Hub in your Maltego Client.
Machine/s
Machines are the Maltego equivalent of macros. Machines allow you to chain together multiple Transforms, filters and actions in order to automate common and tedious tasks. Use Machines to automatically execute pre-defined sequences of Transforms or define your Transform sequences to run queries automatically and speed up your investigation process.
Matches
A match can be defined as a unit of measurement for the Transform quota purchased by a customer as part of a data subscription. Matches are specific to the Pipl data integration and cannot be transferred to other data integrations.
Servers
Run Transforms over Maltego’s public server or purchase a private server to host your own infrastructure.
Maltego Standard Transforms
Work with Maltego Standard Transforms to enrich your investigations with OSINT data. Read more here.
Transform/s
What is a Maltego Transform? A Transform is a piece of code that searches for information related to an Entity on the graph. Transforms allow you to query an API or database to show related info on the graph.
Transforms are pieces of code that take a bit of information (in the form of an Entity) as input, and then return related information in the form of more Entities as an output.
The idea is that we are "transforming" one type of information into another type. For example we could have the website "www.maltego.com" and transform it into the IP address "104.248.60.43".
By default Maltego has Transforms that can query information from data sources like DNS servers, search engines, social networks, WHOIS information, etc.
Transforms can also be written by Maltego users, providing the flexibility to connect to their own data.
Read more about writing your own Transforms here.
Transform Run
A Transform runs on a Transform server which is hosted by either Maltego (for Maltego Standard Transforms) or by one of our Data Partners. Transforms are the mechanism that enable exploratory link analysis from within the Maltego Graph (desktop) application.
Whenever a user runs a Transform on an input Entity, it is counted as a "Transform run". A Transform run is counted irrespective of the number of results it yields.