1. Run a transform
A transform takes one entity (here a domain) and expands it into related entities.
# entity: domain -> run transformsTyporithm · medium
Link Analysis (Maltego)
maltego-transformsosintmaltegotransformsgraph
Saved on this device
Full lesson · 8 learning steps Open any exercise for focused practice
10%
Step 1 of 8 · intro card
Learn Link Analysis (Maltego)
Frameworks & Automation
Maltego runs transforms that expand one entity — a domain, email, or organization — into related entities such as DNS records, IPs, accounts, and breaches, drawing a relationship graph. This link analysis surfaces non-obvious connections an analyst would miss doing lookups by hand. Pivot only on data you are authorized to investigate.
Maltego centers on entities and transforms. An entity is a fact — a domain, an email, an organization — and a transform is a query that expands that entity into related ones.
Transforms chain: a domain transforms into DNS records, those into IPs, and an IP into its owning netblock. An email entity can expand into breach appearances and the accounts tied to it.
The result is a relationship graph that reveals hidden connections — links between people, infrastructure, and accounts that an analyst would never spot doing each lookup by hand. Pivot only on data you are authorized to investigate.
01
A transform expands one entity into related entities.
02
Transforms chain: domain -> DNS -> IP -> netblock.
03
The graph surfaces relationships manual lookups miss.
# entity: domain -> run transforms
# domain -> DNS -> IP -> netblock
# entity: email -> breaches + accounts
# graph reveals hidden relationshipsRead the implementation
Connect each part of the code to the concept before you type.
2. Transform chain
Chaining transforms walks from a domain to its DNS records, then IPs, then the owning netblock.
# domain -> DNS -> IP -> netblock3. Pivot on email
An email entity can expand into breach appearances and linked accounts.
# entity: email -> breaches + accounts4. Surface links
The relationship graph exposes connections an analyst would miss doing lookups by hand.
# graph reveals hidden relationshipsA complete learning loop
01
Understand
Read the concept map and follow the code breakdown.
02
Reconstruct
Type the implementation, repair mistakes and work through every recall exercise.
03
Verify
Use the final check without hints; revisit weak concepts in short practice sessions.