Maltego-CIF troubleshooting

gistfile1.txt

When I run my test script (https://github.com/technoskald/maltegoxforms/blob/master/cif-maltego.py) against a test IP address, I get the appropriate JSON back from my API call and then use the MaltegoTransform.py library from Andrew MacPherson to create and return the entities. output.xml above shows the XML from the Debug tab in the Output pane, but the Transform Output tab says "Transform CIF lookup returned with 0 entities."

output.xml

<MaltegoMessage>
<MaltegoTransformResponseMessage>
<Entities>
<Entity Type="URL">
<Value>http://www.autoshun.org</Value>
<Weight>100</Weight>
<AdditionalFields>
<Field Name="Description" DisplayName="Description">driveby malware</Field>
<Field Name="Confidence" DisplayName="Confidence">50</Field>
<Field Name="Impact" DisplayName="General impact">scanner infrastructure</Field>
<Field Name="Time" DisplayName="Time of observation">2012-09-04T12:51:19Z</Field>
</AdditionalFields>
</Entity>
<Entity Type="URL">
<Value>alienvault reputation DB https://reputation.alienvault.com/reputation.generic</Value>
<Weight>100</Weight>
<AdditionalFields>
<Field Name="Description" DisplayName="Description">malicious host</Field>
<Field Name="Confidence" DisplayName="Confidence">65</Field>
<Field Name="Impact" DisplayName="General impact">botnet infrastructure</Field>
<Field Name="Time" DisplayName="Time of observation">2012-09-05T00:00:00Z</Field>
</AdditionalFields>
</Entity>
<Entity Type="URL">
<Value>alienvault reputation DB https://reputation.alienvault.com/reputation.generic</Value>
<Weight>100</Weight>
<AdditionalFields>
<Field Name="Description" DisplayName="Description">malicious host</Field>
<Field Name="Confidence" DisplayName="Confidence">65</Field>
<Field Name="Impact" DisplayName="General impact">botnet infrastructure</Field>
<Field Name="Time" DisplayName="Time of observation">2012-09-06T00:00:00Z</Field>
</AdditionalFields>
</Entity>
</Entities>
<UIMessages>
</UIMessages>
</MaltegoTransformResponseMessage>
</MaltegoMessage>