Maltego Graphs (.mtgx)

Basic Investigative Graphing

Start every investigation by modeling the question, not by looking for a pre-existing Maltego entity type. The absence of a built-in type is never a reason to leave a material concept out of the graph.

1. State the investigative question and identify the things, events, and relationships needed to answer it. For example: people, organizations, locations, accounts, assets, transactions, communications, and control/ownership/use relationships.
2. Use the closest existing general type when it preserves the distinction needed for the investigation. A single luxury yacht can be a general Asset with properties such as asset.kind = yacht, name, IMO/MMSI, owner, and source. Do not create a Yacht type merely for a better icon or label.
3. Add a custom entity type when a category is repeated or analytically material and a generic type would make the graph harder to query, interpret, transform, or present. Examples include a ScamCenter when several locations must be distinguished from ordinary offices/hotels, RecruitmentCompound when it has recurring evidence fields and relationships, or CryptoWallet when it needs chain-specific identifiers and transaction links.
4. Give each custom type a clear singular name, one primary value, only the properties that recur or affect analysis, and an appropriate icon. Add relationship labels that state what the evidence supports, such as operates from, recruits for, controls, owns, or transferred funds to.
5. Keep one-off facts as properties, notes, or generic entities. Promote them to a custom type only when the distinction has a real analytical payoff. Avoid both extremes: forcing everything into Phrase/Asset, and creating a bespoke type for every individual object.
6. Add evidence and uncertainty at the same time as the node or link: source URL, retrieval date, relevant quote/identifier, and confidence. A graph is an evidence model, not an assertion engine.

Create custom Maltego types in the target Maltego configuration or a separately maintained type library. Reference those types from MTGX/JSON input, but do not pack Entities/ or icon files into a minimal MTGX archive.

Capability Boundary

This skill and its CLI build, inspect, query, merge, and validate MTGX files. They do not control the interactive Maltego application and cannot run Maltego Transforms, select graph entities, use graph views/layouts, create types through the GUI, or retrieve Transform results.