Course 12 - Maltego Advanced Course | Episode 4: Custom Entity Design and Implementation in Maltego | CyberCode Academy

In this lesson, you’ll learn about:

How to create custom entities in Maltego
How to name entities and assign unique type IDs
How entity properties, main properties, and data types work
How inheritance allows new entities to reuse transforms
How to use advanced features like calculated properties and visual overlays
How to build dynamic, visually adaptive entities for specialized investigations

Summary of the Episode: This episode walks through the full process of designing and implementing custom entities in Maltego, beginning with basic creation and advancing toward powerful features like inheritance, calculated properties, regex parsing, and dynamic icon overlays. It demonstrates how users can tailor Maltego to fit specialized investigation workflows by defining their own data structures and visual representations. 1. Naming and Identifying Custom Entities Creating a custom entity starts with two essential identifiers: Display Name

A human-readable name, such as Worker, that appears in the graph.

Type ID (Unique Identifier)

Must be globally unique to avoid conflicts
Typically structured with a namespace, e.g.:
- investitech.worker (organization format)
- my.worker (personal or training use)

2. Creating a Basic Custom Entity To create a minimal entity, define:

Display name: e.g., worker
Short description: Explains its purpose
Unique type ID: e.g., my.worker
Category: e.g., personal

Main Property Every entity requires at least one property.
Example:

Property name: worker name
Type: string
Sample value: John Doe

The main property appears in bold in the property list and typically identifies the entity on the graph. 3. Using Entity Inheritance Inheritance allows a new entity to reuse all transforms and properties of an existing one. Examples:

Website inherits from DNS name to gain transforms like “To IP address”.
A custom worker entity inherits from maltego.person to reuse:
- First/last name properties
- Person-related transforms

This makes the new entity more functional without additional configuration. 4. Additional Properties Custom entities can include any number of extra properties. Property types include:

Strings
Numbers
Dates
Booleans
Images
Locations

Default vs Sample Values

Sample value: Appears when dragging the entity from the palette
Default value: Used if the property is left empty

5. Calculated Properties Calculated properties automatically combine or transform other property values. Common annotations:

$property(name): Reference another property
$trim(): Remove surrounding whitespace

Example:
A full name property combining first and last names. Calculated properties can be:

Visible
Hidden
Read-only (evidence-safe)

6. Display Settings & Overlays Maltego entities can display visual cues based on their property values. Large Image (Icon)

Can be chosen dynamically using a calculated property

Overlays (5 Positions)

North
Northwest
West
Southwest
South

Overlays can show:

Images
Colors
Text (e.g., job titles, statuses, labels)

This gives investigators a quick visual read of key details without inspecting the property panel. 7. Regular Expressions for Parsing Regular expressions help:

Automatically match input values to the correct entity type
Extract structured data from plain text

Example:

Splitting "40.7128 -74.0060" into latitude/longitude values.

8. Advanced Example: The Custom Worker Entity The episode demonstrates a feature-rich worker entity: Inheritance

Inherits from maltego.person

Additional Properties

gender
skin tone
job

Calculated Property

A hidden, read-only property called combined:
gender_skintone_job

Used to determine the icon dynamically. Dynamic Appearance

Large icon changes based on the combined property value
Job title appears as a north overlay

This showcases how custom entities can visually adapt according to their data—ideal for specialized investigative environments. Conclusion By mastering custom entity design, inheritance, calculated properties, regex parsing, and graphical overlays, investigators can transform Maltego into a fully customized platform that models the exact data structures relevant to their cases.

You can listen and download our episodes for free on more than 10 different platforms:
https://linktr.ee/cybercode_academy

Course 12 - Maltego Advanced Course | Episode 4: Custom Entity Design and Implementation in Maltego

About this episode

Get every episode summarized

More from CyberCode Academy

Course 42 - Mobile Malware Analysis Fundamentals | Episode 13: Designing and Arc...

Course 42 - Mobile Malware Analysis Fundamentals | Episode 12: Dynamic Analysis...

Course 42 - Mobile Malware Analysis Fundamentals | Episode 11: Dynamic Analysis...

Course 42 - Mobile Malware Analysis Fundamentals | Episode 10: The Essentials of...