-
Notifications
You must be signed in to change notification settings - Fork 27
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Inheriting base entities from maltego.entities #3
Comments
Hi Matt, Built-in entities are automatically excluded when running
Also you can always inherit and extend already built-in entities by just sub-classing them, like so: from canari.maltego.entities import IPv4Address
@EntityField(name='blah.prop', propname='prop')
class MyEntity(IPv4Address):
namespace='blah' But what I would do if I were in your shoes is create a Dynamic property in the transform like this: from canari.maltego.entities import IPv4Address
def dotransform(request, response):
e = IPv4Address('1.1.1.1')
e += Field('name', 'value', displayname='My Name')
response += e
return response |
Hi Nadeem This is awesome, thanks a lot for clarifying. I thought it best to put these questions into github so I/we can keep track of things and also anybody else can come across the answers. If you want me to document any of these advanced features (like the link labels etc) I can start writing things up and send you it? Matt |
Just a slight change to your above suggestion - need to import Field from canari.maltego.message: from canari.maltego.entities import IPv4Address
from canari.maltego.message import Field
def dotransform(request, response):
e = IPv4Address('1.1.1.1')
e += Field('name', 'value', displayname='My Name')
response += e
return response |
Also, I couldn't get the inheritance to work. It just behaved as if I hadn't put (IPv4Address) after my entity type... |
Could you post a code sample? |
OK, so this is my transform to query my netflow data which creates the entity NetFlowDST: def dotransform(request, response):
"""
TODO: write your data mining logic below.
"""
#Gonna run the netflowquery function in mongodbquery with a query of srcaddr(our input ip from maltego)
values = mongodbquery.netflowquery('srcaddr','%s' % request.value)
processed = []
for i in values:
if i['_id'] not in processed:
response += NetFlowDST(
i['dstaddr'],
weight = i['#:doctets'],
dstport = i['dstport']
)
processed.append(i['_id'])
return response This works fine, and returns the following (sample): `- Entity: {'Type': 'ctxfx.NetFlowDST'}
`- Value: 173.194.78.94
`- Weight: 161
`- AdditionalFields:
`- Field: 443 {'DisplayName': 'Destination Port', 'Name': 'ctxfx.dstport', 'MatchingRule': 'strict'} Here is my entity type: @EntityLinkField(name='maltego.link.label', propname='linklabel', matchingrule=MatchingRule.Loose)
@EntityField(name='ctxfx.dstport', propname='dstport', displayname='Destination Port')
class NetFlowDST(IPv4Address):
namespace='ctxfx'
pass |
Hi @mattnewham, Just a point of clarification here: You do not need to define the Question: What isn't working? :) |
Yeah I figured that our then forgot it was in the code I posted. Link I managed to get dynamic fields onto existing entities working well now. Only other thing I was trying was making my own entity and inheriting the
|
What change were you expecting? |
Expecting it to be an ipv4address entity in maltego . When I create my own
|
Ah, No, then what you want is not to inherit an def dotransform(request, response):
"""
TODO: write your data mining logic below.
"""
#Gonna run the netflowquery function in mongodbquery with a query of srcaddr(our input ip from maltego)
values = mongodbquery.netflowquery('srcaddr','%s' % request.value)
processed = []
for i in values:
if i['_id'] not in processed:
e = IPv4Address(
i['dstaddr'],
weight = i['#:doctets']
)
e += Field('dstport', i['dstport'])
response += e
processed.append(i['_id'])
return response |
That's what I think I have done now. Seems to work well. What exactly is The more I use canari the better it gets. Its so flexible! I per ordered my leap motion now after you showed me it!
|
From what I can tell, inheritance in Maltego is used to simplify transform association to entity types. For instance, look at all the DNS related entities. They are all subclasses of DNSName. If you right click on any of them, you will see the same types of transforms apply on the child and parent entities. That being said, you could always use inheritance if you want to specify a custom IPv4Address entity type but inherit all of the IPv4Address type's transforms. It will be called something else though :) |
That's really what I was trying to get my entity to do, I wanted my results I still don't get how to inherit entities in canari though, I'm doing Its no really an issue ATM but something we've been toying with at work is
|
So one thing to note is that entity inheritance in Canari is different than entity inheritance in maltego. Make sure you apply inheritance when you design the entity in Maltego. |
Hi @mattnewham, Can I close this thread? |
It appears that Canari is unable to create the option when converting an exported entity, or when creating a new one.
For example, my transform returns an IP address, which I could create as a maltego.IPv4Address type, however then that limits me if I want to add multiple custom fields etc. What would be more preferable would be to create my own entity type, with my own custom field options, but inherit the base entity IPv4Address.
This should solve the issue of having to change entity types on returned entities.
If this is already possible, point me in the right direction and I will document it ;)
The text was updated successfully, but these errors were encountered: