Prerequisites
Method: Tracking aircraft with ADS-B and transponder records.
01
Relationships are evidence
In OSINT investigations, the connection between two entities is often more evidentially significant than either entity alone. Network mapping tools let you build, query and visualise those connections at a scale no spreadsheet can match.
Maltego and Gephi occupy different positions in the network analysis workflow. Maltego is an active data-gathering platform: it runs transforms, automated queries against data sources that return linked entities and populates a graph in real time. Gephi is a passive visualisation engine: you import data it has never seen, then apply layout algorithms, centrality measures and filtering to reveal structure. Used together, Maltego builds the graph and Gephi interrogates it.
The investigative value is in the combination. A Maltego graph shows you what connects to what. A Gephi betweenness centrality run tells you which nodes sit on the most shortest paths through the network, which is often where the operationally important actors are. A journalist reconstructing a disinformation campaign, a sanctions investigator tracing a beneficial ownership chain, or an OSINT analyst mapping a harassment network all need both the population step and the structural analysis step. This tutorial covers both.
In the field
Clemson University researchers Darren Linvill and Patrick Warren built the most complete public analysis of the Internet Research Agency's Twitter operation, working from the near-3-million-tweet archive across roughly 3,000 IRA-linked accounts that Twitter released and FiveThirtyEight republished in mid-2018. Their published methodology is a network and behavioural analysis of the account set, not a single graph-theory finding, but it demonstrates the same principle taught in this tutorial: structural analysis of an account network surfaces coordination that reading individual accounts does not.
- Account-level classification. Working from the full account set, the researchers classified handles into five behavioural categories (Right Troll, Left Troll, News Feed, Hashtag Gamer, Fearmonger), each with a distinct interaction pattern.
- Structural, not just content, analysis. The classification depended on interaction and behavioural structure across the account set, not on reading individual tweets in isolation, illustrating why a graph of the network reveals coordination that content review alone would miss.
Linvill & Warren, Clemson University · "Troll Factories" and related IRA account research · 2018–2020
Note: this case illustrates the general value of structural network analysis on the IRA account set. It is not a documented example of Maltego/Gephi betweenness-centrality workflow specifically; treat the workflow steps below as validated by the Gephi and Maltego documentation cited in Advanced resources.
Learning outcomes
By the end of this tutorial you will be able to:
Configure Maltego with community transforms for OSINT investigation without exposing your identity to data sources
Build a populated entity graph by running transforms against a seed entity and resolving linked nodes
Export a Maltego graph to a format Gephi can ingest and apply standard layout algorithms to reveal structure
Run betweenness centrality and degree analysis in Gephi to identify operationally significant nodes
Document a network graph to evidentiary standard with reproducible methodology notes
This tutorial is for Signal subscribers.
Methods goes deep on a single technique each fortnight. The decision framework, the tools, the failure modes, and the evidentiary standard required to use the finding defensibly.
Join SignalA Signal subscription gives you:
- Full OSINT Reference Card library
- Methods, all tradecraft tutorials in full
- Shadow Analysis, all evidence-based reporting
- Forensic Dossiers, full access
- Discord access included
