Recorded Future Maltego Integration — Now With Moar
Predict 21: The Intelligence Summit Register Today

Recorded Future Maltego Integration — Now With Moar

August 17, 2015 • Matt Kodama

Webinar: Learn how to use Maltego for better insight into cyber threats. Watch now.

At Black Hat 2015 this year, we were busy previewing the new version of our Maltego integration! If you didn’t see us out in the desert this year, here are highlights of upcoming improvements from Recorded Future and our partner Malformity Labs.

More Intel

First off, we are packing a lot more intel information into the Entities returned by our Maltego transforms. An intelligence summary is returned for IP addresses, domains, and hashes and appears in the Detail View. The summary lists related infrastructure, malware, or CVE vulnerabilities. For example, here’s the summary for an IP address recently linked to the IpTabLex botnet:

IP Address Details

We’re packing more intel into document entities too. For example, here’s the summary for a recent blog post about CVE-2015-3113:

Document Details

Of course, you’ll want to read the original yourself, using the source link. This improved summary gives you a clear “information scent” for what’s available in that document.

More Efficiency

Building on these same intel summaries, we’ve added new transforms for IP addresses, domains, and hashes that retrieve those top related entities directly – without drilling down into detailed document-level intel. This make it faster to pull related entities into your investigation, vet them for hits in your other technical intel sources, and focus your investigation in on those interesting multi-source hits.

Below is a graph snippet with the top 12 hits for a specific domain – one that is not malicious per se, but is reportedly exploited as secondary infrastructure. After checking off these IPs against other internal logs and other intel sources, you can zero in on the interesting ones.

Maltego Domain to IP Address

More Drilldown

For some entities, these summaries cover a lot of information – more than can readily be pushed back into Maltego. The full summary is available through a drilldown link back to Recorded Future. Here’s the beginning of the summary for that same domain:

Maltego Recorded Future Intelligence Summary

We’ve also added deep links into Recorded Future for documents – so you can slice and dice all of the events reported in the document, and access any cached content.

Early Access is Available

Are you already using our integration and want to be an early adopter of these improvements? If you’re not afraid of a few bugs and want to jump to the front of the feedback line, please email us at support [at] recordedfuture [dot] com.

Learn More

If early access is not for you, or if you’re not already using our Maltego integration, you can learn more by watching our recent webinar.

New call-to-action

Related Posts

Using Intelligence to Prioritize AWS Guard Duty Alerts

Using Intelligence to Prioritize AWS Guard Duty Alerts

March 10, 2021 • Meghan McGowan

Security operations teams are inundated with alerts and threats making it difficult for them to...

Announcing Security Intelligence for Splunk — For Free

Announcing Security Intelligence for Splunk — For Free

February 23, 2021 • Ellen Wilson

Today, we’re thrilled to announce the launch of a free 30-day trial of our integration for Splunk...

Special Delivery: Recorded Future Hunting Packages

Special Delivery: Recorded Future Hunting Packages

September 25, 2019 • The Recorded Future Team

Quickly detecting and preventing malicious activity is imperative to effectively protecting your...