Maltego Investigation Importer Operation
The web format of this guide reflects the most current release. Guides for older iterations are available in PDF format.
Integration Details
ThreatQuotient provides the following details for this integration:
| Current Integration Version | 1.0.0 |
| Compatible with ThreatQ Versions | >= 5.6.0 |
| Support Tier | ThreatQ Supported |
Introduction
The Maltego Investigation Importer operation enables you to import an XML export from Maltego as a ThreatQ Investigation.
The operation provides the following action:
- Import File - imports a Maltego XML Export into ThreatQ as an investigation.
The operation is compatible with the Files system object.
Installation
This integration can be installed in the My Integration section of your ThreatQ instance. See the Adding an Integration topic for more details.
Configuration
ThreatQuotient does not issue API keys for third-party vendors. Contact the specific vendor to obtain API keys and other integration-related credentials.
To configure the integration:
- Navigate to your integrations management page in ThreatQ.
- Select the Operation option from the Type dropdown (optional).
- Click on the integration entry to open its details page.
- Review any additional settings, make any changes if needed, and click on Save.
- Click on the toggle switch, located above the Additional Information section, to enable it.
Actions
The operation provides the following action:
| Action | Description | Object Type | Object Subtype |
|---|---|---|---|
| Import File | Imports a Maltego XML Export into ThreatQ as an investigation. | Files | N/A |
Import File
This action will take a given Maltego XML Export, and import it into ThreatQ as an investigation. Executing this action will upload all the Maltego entities as ThreatQ objects, create the links between the objects, and add the objects to a new investigation. Entity positions will be maintained throughout the import process.
Configuration Options
The Import File action will provide you with the following configuration options:
| Parameter | Description |
|---|---|
| Owner Username / Email | The username or email to be set as the owner of the newly created investigation. |
| Import Properties as Attributes | Imports all properties as attributes for a given object. |
| Create Investigation | Disabling this will not create an investigation, and only upload the objects/entities. |
Change Log
- Version 1.0.0
- Initial release
PDF Guides
| Document | ThreatQ Version |
|---|---|
| Maltego Investigation Importer Operation Guide v1.0.0 | 5.6.0 or Greater |