Investigate What Sits Behind a Flagged Account

A real-time monitoring alert answers one question: something deserves attention. Whether it deserves your team’s time is a separate call, and a single flagged account rarely settles it.

One post is one data point. What turns it into a lead, or rules it out, is what surrounds it: what the account did before, who else is saying the same thing, and what it connects to.

As an example:

A team is following online discussion around a developing security incident. An X account they have not seen before posts the same narrative as several other accounts. One post uses a hashtag the team has already flagged, and another links to a website presenting itself as an independent news outlet.

None of this shows coordination, and the account may turn out to be irrelevant. Before anyone decides, the team needs answers:

• What was this account doing before today?
• Has it pushed this narrative before?
• Does the same identity appear elsewhere?
• What else is connected to the website it links to?

With those answers, the team can brief with confidence or drop the lead early. Without them, hours go into noise, or a real signal gets judged on a snapshot. Maltego Monitor and Maltego One take you from the alert to those answers in one workflow.

Look back before the alert 🔗︎

Monitoring starts when it is switched on, but the activity behind a signal usually started earlier. That’s something our users flagged in multiple customer feedback calls:

An account that matters today may have been posting on the topic, or showing the same behavior, for weeks. A narrative that looks new in a live feed may have circulated in variations for some time. Without history, the moment of detection becomes the start of the story, and it often is not.

With historical X data in Maltego Monitor, you can look back at a keyword, hashtag, or account and see what led up to the signal, not only what follows it.

In the example above, that shows you:

• whether the same hashtag appeared before the incident
• whether other accounts used similar wording earlier
• whether activity rose around particular events
• whether a term is worth adding to a live monitor or would only add noise

None of this proves that accounts are coordinated or share an operator. It gives you more evidence to test that possibility against.

That matters across counter-terrorism and extremism research, narrative analysis, information operations, protective intelligence, and more scenarios where the question is often how activity developed, not only what is visible now.

Move from the message author to the wider picture in one click 🔗︎

A post tells you what someone said. It does not tell you whether the same person runs other accounts, which domains or email addresses they use, or what else they are tied to. Those answers decide whether an account is worth your team’s time.

Relevant findings can then go into Maltego Graph, where you connect the dots: the relationships and patterns between accounts, domains, and infrastructure that no single result shows, and that help you judge whether the account is part of something larger or a one-off.

The same path works well outside government and intelligence work. A corporate security team that spots a new account posting about an executive can check what that account said before, see where else the identity appears, and decide how seriously to take it, before the first message lands on a leadership desk.

One workflow in the Maltego platform 🔗︎

Monitoring and investigation feed each other: a monitored conversation produces an account worth investigating, an investigation produces an identifier worth monitoring, and history changes how a current signal reads.

The questions rarely arrive in order: you go back to monitoring with a new keyword after a pivot, or back to history after a new lead appears. A workflow that holds all of that in one place keeps you working on the investigation instead of moving between steps.

• If you use Monitor today: Maltego One is the next step when a signal needs more than an alert.
• If you use Maltego One: Monitor lets you start investigations from what is happening now and give it context, not only from what you already know.