Malfors v1.9
Up to 1,000 enrichments at once, faster case transactions, new enrichment sources, and improved mobile responsiveness.
Performance
Malfors is already fast, but we keep looking for ways to make it faster and support larger cases and more complex investigations. This release improves both enrichment scheduling and case transaction performance.
Enrichment Scheduling
We rebuilt the enrichment scheduler to handle timeouts, cancellations, queued work, and vendor rate limits more efficiently and reliably.
You can now start up to 1,000 enrichments at once. A new progress bar shows how much of the batch has completed.
Watch the enrichment progress demo from Malfors on X.
Transactions
Malfors uses optimistic updates: each change is applied instantly, then sent to the backend as one transaction. If it's accepted, nothing else happens. If it fails or times out, Malfors rolls it back.
Previously, large transactions involving thousands of entities updates could take several seconds to process on the backend, or tens of seconds in extreme cases.
In v1.9, we made it between 2.5x and 27x faster.
| Operation | Before | After | Change |
|---|---|---|---|
| Insert 1,000 entities | 128.06 ms | 50.88 ms | 2.5× faster |
| Update all fields on 1,000 entities | 239.19 ms | 37.06 ms | 6.5× faster |
| Delete 1,000 entities | 717.96 ms | 25.78 ms | 27.8× faster |
| Insert 1,000 links | 119.47 ms | 45.09 ms | 2.6× faster |
| Update all fields on 1,000 links | 219.65 ms | 32.29 ms | 6.8× faster |
| Delete 1,000 links | 130.38 ms | 5.55 ms | 23.5× faster |
Other Performance Improvements
- Enrichment and custom entity updates trigger fewer unnecessary recalculations in the frontend. This can help on slower devices, though the difference is not noticeable in everyday use.
- A runtime update reduced memory usage while Malfors is idle.
- Removing Elasticsearch and sharp dependencies cut several megabytes from the Malfors Enterprise bundle.
Enrichments
Malfors v1.9 adds four enrichment integrations and expands VirusTotal support.
Validin
Validin enriches domains, IP addresses, hashes, and DNS values with current and historical infrastructure data, including DNS records, TLS certificates, host responses, subdomains, and OSINT observations. This helps reconstruct infrastructure history and find related hosts, domains, and certificates.
OpenCorporates
OpenCorporates lets you search by company name, person name, or registered address and retrieve company profiles, filings, statements, and officer details. These records help connect people and addresses to legal entities, with links back to official registry sources.
LeakRadar
LeakRadar searches stealer logs, leaks, and breach records by password, username, or email. It also provides domain exposure statistics, helping you connect exposed credentials to related accounts and affected domains.
WhiteIntel
WhiteIntel searches stealer logs and leaks by email, username, computer name, or IP address. Matching exposure records add context to the graph and provide pivots to related accounts, hosts, and network infrastructure.
VirusTotal
We reworked the VirusTotal integration to cover more than 20 endpoints, including relationships for domains, IP addresses, file hashes, and URLs.
Mobile Responsiveness
Malfors now works more comfortably on mobile devices, with layout and responsiveness improvements across the app. There is still more to improve, but working with cases on a smaller screen is now easier.
Other Changes
- Improved graceful shutdown handling in Kubernetes environments.
- Exported Malfors cases can now be imported back into Malfors.