Tools

Maltego

The Tomba transforms add ten Tomba lookups to Maltego graphs. They run as local transforms on your machine, using the Tomba Python SDK. Tomba builds and maintains them; the source is at github.com/tomba-io/tomba-maltego.

Prerequisites

Maltego.
Python 3.10 or later: the current maltego-trx release requires it.
A Tomba API key and secret. See Get your key and secret.

Install and connect

Clone the repository and install the dependencies:

Code
git clone https://github.com/tomba-io/tomba-maltego.git
cd tomba-maltego
pip install -r requirements.txt

Create settings.py from the template:

Code
cp settings.py.template settings.py

In settings.py, set TOMBA_API_KEY to your key and TOMBA_SECRET_KEY to your secret. The transforms read credentials only from this file.
In Maltego, use Import Config to import tomba_transforms.mtz from the repository.
In Maltego's transform settings, set each Tomba transform's working directory to the folder you cloned: the imported configuration points to another path. The transforms run python3 project.py local <transform>, so if you installed the dependencies in a virtual environment, also set the command to that environment's Python.

Transforms

Each transform sends one request, so it's charged and throttled like a direct API call: see Credit costs and Rate limits.

Transform	Input entity	Output entities	Endpoint
Tomba - Domain Search	Website	Email Address, Person, Company	`GET /domain-search`
Tomba - Email Verifier	Email Address	Email Address	`GET /email-verifier`
Tomba - Email Enrichment	Email Address	Email Address, Person	`GET /enrich`
Tomba - Author Finder	URL	Email Address, Person	`GET /author-finder`
Tomba - LinkedIn Finder	URL	Email Address, Person	`GET /linkedin`
Tomba - Phone Finder	Email Address	Email Address carrying the phone details	`GET /phone-finder`
Tomba - Phone Validator	Phone Number	Phone Number	`GET /phone-validator`
Tomba - Similar Websites	Website	Website	`GET /similar`
Tomba - Technology	Domain	One Domain entity per technology	`GET /technology`
Tomba - Account Info	Phrase	Phrase	`GET /me`

The import also adds Tomba - Base Transform, which does nothing; don't run it.

Tomba - Domain Search requests 50 addresses and is charged for that limit. To request fewer, add a tomba.limit property with the value 10 or 20 to the Website entity before you run the transform; on the Free plan, a limit above 10 fails (see Free plan limits). The transform also reads an optional tomba.department property.

Example

Map the people at a company:

Add a Website entity with the value stripe.com.
Run Tomba - Domain Search. Maltego adds an Email Address entity for each address found, a Person entity for each named person, and a Company entity.
Select the Email Address entities and run Tomba - Email Verifier to check them.

Troubleshooting

Symptom	Cause	Fix
"Please configure Tomba.io API credentials"	`settings.py` is missing or doesn't contain your key and secret.	Create it from the template and set both values.
The transform fails to start	The working directory or Python command in the transform settings is wrong, or the dependencies aren't installed for that Python.	Point the settings at your clone and the Python that has `maltego-trx` and `tomba-io` installed.
A transform reports a Tomba error	The request failed: invalid credentials, too few credits, a rate limit, or a withheld record.	Look up the error in Errors.

Last modified on September 30, 2026

Steampipe ClawHub

Install and connect

Clone the repository and install the dependencies:

Code
git clone https://github.com/tomba-io/tomba-maltego.git
cd tomba-maltego
pip install -r requirements.txt

Create settings.py from the template:

Code
cp settings.py.template settings.py

In settings.py, set TOMBA_API_KEY to your key and TOMBA_SECRET_KEY to your secret. The transforms read credentials only from this file.

In Maltego, use Import Config to import tomba_transforms.mtz from the repository.

In Maltego's transform settings, set each Tomba transform's working directory to the folder you cloned: the imported configuration points to another path. The transforms run python3 project.py local <transform>, so if you installed the dependencies in a virtual environment, also set the command to that environment's Python.