maltego_investigate
Run a complete investigation on domains, emails, IPs, or URLs. Returns a summarized briefing with discoveries, scores, and recommended next actions.
Instructions
PRIMARY entry point — run a COMPLETE investigation in one call.
Use when the user wants to investigate anything (domain, email, IPv4/IPv6, or URL, or a bare value). This is the default for "investigate X". It auto-detects the type, builds/expands the graph via the right machine (recording Investigation Memory), lays it out, summarizes, scores/ranks entities, computes next-best-actions, and includes an inline report — and returns ONE finished briefing. Present it directly; do not call summarize/ list/suggest afterwards. Next: offer to maltego_save_graph or maltego_export_report (do not write files unless asked).
Args: params (InvestigateQueryInput): - query (str): What to investigate (type auto-detected). - allow_network (bool): Run network transforms (default True). - depth (str): 'quick' | 'standard' (default) | 'deep'. 'deep' runs ALL applicable available transforms over more rounds (thorough, slower); use it when the user asks to "go deep"/"dig further". - max_rounds (Optional[int]): Explicit rounds override (else set by depth). - layout (str): 'hierarchical' | 'radial' | 'force'. - include_report (bool): Append the full inline report (default True). - include_next_actions (bool): Include NBA recommendations (default True).
Returns: str: One complete briefing — detection + run stats, important discoveries, recommended next actions, and (by default) a full inline report. No files are written.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| params | Yes |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |