scaffold_transform
Generate a Maltego transform module from a cURL command or OpenAPI spec, mapping API response fields to entities and properties for data enrichment.
Instructions
Scaffold a new Maltego transform module from a cURL command or OpenAPI specification.
The output lists each transform by the id the server registers it under, its sample input, a ready-made run command, and a field inventory: every leaf path seen in the sample response or schema, its sample value, and what happened to it (mapped to an entity, attached as a property, or dropped and why). Read the inventory and the notes: data an investigator needs is often nested deeper than the scaffolder follows by default. Preview with dry_run=True, adjust records/mappings/primary until the inventory maps what matters, then call again without dry_run. Restart the server, then call run_transform with the transform id exactly as listed (it includes the namespace).
Args: service: Optional service name slug (e.g. 'greynoise', 'threatfox'). curl: A full cURL command string demonstrating an API request. openapi: An OpenAPI/Swagger spec in JSON or YAML: a URL, a file path, or the document itself (as text or as an object). Use list_operations first to pick operation_ids. sample_response: A real JSON response (as text or as the parsed value), to map outputs from. Works with curl, and with openapi when exactly one operation is scaffolded (name it in operation_ids); without it a spec with no response schema maps nothing. operation_ids: OpenAPI operation ids to scaffold. Without it every GET operation is scaffolded; POST operations are only scaffolded when named here. force: Replace an existing service: its whole directory and its project.py imports. name: Transform name for a curl scaffold (default '_lookup'), so one service can grow endpoint by endpoint. records: Dotted path to the list of records in the response, e.g. 'data' or 'containers.cna.references'. Each element becomes one record to map. mappings: Per-field overrides as 'dotted.path[].field=EntityType', e.g. 'containers.cna.affected[].vendor=Company'. EntityType 'Property' attaches the field to the record's entity as a property; 'Drop' ignores it. dry_run: Parse and report the plan (transforms, field inventory, notes, auth, and the files that would be written) without writing anything. sample_input: An input value the API answers for, e.g. the hash or id the sample_response came from. The generated transform skips the input when the response echoes it back (so the other fields enrich the input instead of a copy of it), and samples.json records it so the smoke test sends a value the endpoint accepts. A curl scaffold defaults to the value in the request; give it for an openapi scaffold, which otherwise only has the spec's example, if any. primary: Path of the field to use as each record's primary entity, the one every other field attaches to as a property, written like a mappings path (e.g. 'SHA-1' or 'hits.hits[]._id'). It must map to an entity type; the error names the valid candidates.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| curl | No | ||
| name | No | ||
| force | No | ||
| dry_run | No | ||
| openapi | No | ||
| primary | No | ||
| records | No | ||
| service | No | ||
| mappings | No | ||
| sample_input | No | ||
| operation_ids | No | ||
| sample_response | No |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |