How to Map a Network with Maltego and Gephi (OSINT)

Block

04 · SOCMINT and Network Intelligence

Topic

Network Mapping

Tools

Maltego · Gephi · Transforms

Difficulty

Intermediate

Prerequisites

Tracking aircraft with ADS-B and transponder records.

See also: Company registry research, financial record tracing and WHOIS investigation for domain-specific applications of this network-mapping workflow.

01	Relationships are evidence In OSINT investigations, the connection between two entities is often more significant than either entity alone. Network mapping tools let you build, query and visualise those connections at a scale no spreadsheet matches.

Maltego and Gephi occupy different positions in the network analysis workflow. Maltego is an active data-gathering platform: it runs transforms, automated queries that return linked entities, populating a graph in real time. Gephi is a passive visualisation engine: you import data it has never seen, then apply layout algorithms and centrality measures to reveal structure. Maltego builds the graph; Gephi interrogates it.

The investigative value is in the combination. A Maltego graph shows what connects to what. A Gephi betweenness centrality run shows which nodes sit on the most shortest paths, often where the operationally important actors are. A journalist reconstructing a disinformation campaign or a sanctions investigator tracing an ownership chain needs both the population step and the structural analysis step. This tutorial covers both.

In the field

Clemson University researchers Darren Linvill and Patrick Warren built the most complete public analysis of the Internet Research Agency's Twitter operation, working from the near-3-million-tweet archive of roughly 3,000 IRA-linked accounts that Twitter released and FiveThirtyEight republished in 2018. Their methodology demonstrates the principle taught here: structural analysis of an account network surfaces coordination that reading individual accounts does not.

Account-level classification. The researchers classified handles into five behavioural categories (Right Troll, Left Troll, News Feed, Hashtag Gamer, Fearmonger), each with a distinct interaction pattern.
Structural, not just content, analysis. The classification depended on interaction structure across the account set, not on reading individual tweets, illustrating why a graph reveals coordination that content review alone would miss.

Linvill & Warren, Clemson University · IRA account research · 2018-2020

Learning outcomes

By the end of this tutorial you will be able to:

Configure Maltego with community transforms without exposing your identity to data sources
Build a populated entity graph by running transforms against a seed entity
Export a Maltego graph to a Gephi-readable format and apply layout algorithms to reveal structure
Run betweenness centrality and degree analysis in Gephi to identify operationally significant nodes
Document a network graph to evidentiary standard

The rest of this tutorial is for Signal subscribers.

What remains: the decision framework, the tool configuration, the failure modes, and the evidentiary standard required to use the finding defensibly. Signal is €90 a year, or €9 a month. Students, €49 a year.

Join Signal

A Signal subscription gives you:

Full OSINT Reference Card library, 21 domains
Methods, every tradecraft tutorial in full
AI in OSINT, every prompt and field report
Shadow Analysis, every forensic dossier

Network mapping with Maltego and Gephi for investigators

Relationships are evidence

Learning outcomes

The rest of this tutorial is for Signal subscribers.

A Signal subscription gives you:

Keep Reading