| SERIES | Methods |
| BLOCK | 04 · SOCMINT and Network Intelligence |
| TOPIC | Network Mapping |
| TOOLS | Maltego · Gephi · Transforms |
| LEVEL | Intermediate |
| BEFORE THIS | Tracking aircraft with ADS-B and transponder records |
| SEE ALSO | Company registry research, financial record tracing and WHOIS investigation for domain-specific applications of this network-mapping workflow. |
THE CASE
Relationships are evidence
In OSINT investigations, the connection between two entities is often more significant than either entity alone. Network mapping tools let you build, query and visualise those connections at a scale no spreadsheet matches.
Maltego and Gephi occupy different positions in the network analysis workflow. Maltego is an active data-gathering platform: it runs transforms, automated queries that return linked entities, populating a graph in real time. Gephi is a passive visualisation engine: you import data it has never seen, then apply layout algorithms and centrality measures to reveal structure. Maltego builds the graph; Gephi interrogates it.
The investigative value is in the combination. A Maltego graph shows what connects to what. A Gephi betweenness centrality run shows which nodes sit on the most shortest paths, often where the operationally important actors are. A journalist reconstructing a disinformation campaign or a sanctions investigator tracing an ownership chain needs both the population step and the structural analysis step. This tutorial covers both.
IN THE FIELD
Clemson University researchers Darren Linvill and Patrick Warren built the most complete public analysis of the Internet Research Agency's Twitter operation, working from the near-3-million-tweet archive of roughly 3,000 IRA-linked accounts that Twitter released and FiveThirtyEight republished in 2018. Their methodology demonstrates the principle taught here: structural analysis of an account network surfaces coordination that reading individual accounts does not.
| • | Account-level classification: The researchers classified handles into five behavioural categories (Right Troll, Left Troll, News Feed, Hashtag Gamer, Fearmonger), each with a distinct interaction pattern. |
| • | Structural, not just content, analysis: The classification depended on interaction structure across the account set, not on reading individual tweets, illustrating why a graph reveals coordination that content review alone would miss. |
Linvill & Warren, Clemson University · IRA account research · 2018-2020
Learning outcomes
By the end of this tutorial you will be able to:
| • | Configure Maltego with community transforms without exposing your identity to data sources |
| • | Build a populated entity graph by running transforms against a seed entity |
| • | Export a Maltego graph to a Gephi-readable format and apply layout algorithms to reveal structure |
| • | Run betweenness centrality and degree analysis in Gephi to identify operationally significant nodes |
| • | Document a network graph to evidentiary standard |
The rest of this tutorial is for Signal subscribers.
What remains: the decision framework, the tool configuration, the failure modes, and the evidentiary standard required to use the finding defensibly.
Join SignalA Signal subscription gives you:
- Full OSINT Reference Card library, 21 domains
- Methods, every tradecraft tutorial in full
- AI in OSINT, every tutorial and field report
- OSINT Hub community access