Skip to content
HackIndex logo

HackIndex

Building a Subject Link Graph

3 min read Apr 11, 2026

Overview

A link graph structures collected connections into a visual and navigable map of relationships between entities. Without a graph, complex investigations with many subjects and connections quickly become unmanageable in flat notes or spreadsheets. A graph makes clusters, central nodes, and indirect connections visible at a glance and supports both analysis and reporting.

What to Model

A link graph for an identity investigation typically contains the following node types:

  • People — subjects, associates, family members, co-directors

  • Organisations — companies, groups, institutions

  • Accounts — social media profiles, email addresses, usernames

  • Locations — addresses, properties, countries

  • Identifiers — phone numbers, IP addresses, device identifiers

Edges between nodes represent relationships: employed by, director of, registered at, connected to, co-authored with, shares address with. Label edges with the source of the relationship claim and a date where available.

Maltego

Maltego is the standard tool for OSINT link graph analysis. It combines a visual graph interface with transforms that query data sources directly and add results as nodes and edges automatically. Purpose-built transforms exist for Companies House, Shodan, VirusTotal, social platforms, and many other sources.

Run a basic person entity transform from a name:

┌──(kali㉿kali)-[~]
└─$ maltego

Start with a Person entity, add the subject's name, and run the available transforms for email, social media, and company connections. Each result adds new nodes. Run transforms on those nodes to expand the graph. Stop expanding branches that do not connect back to the investigation focus.

Maltego Community Edition is free but limits transform results and graph size. Professional investigations typically require a paid licence for full result sets.

SpiderFoot

SpiderFoot automates OSINT data collection across hundreds of sources and outputs results as a link graph. It is particularly useful for infrastructure and identity investigations run from a single seed identifier.

┌──(kali㉿kali)-[~]
└─$ spiderfoot -s $TARGET_EMAIL -m sfp_hunter,sfp_haveibeenpwned,sfp_linkedin,sfp_twitter -o graph.json

SpiderFoot HX provides a hosted version with a web interface. The open source version runs locally and is more suitable for sensitive investigations where data should not leave controlled infrastructure.

Gephi for Custom Graphs

When building a graph from manually collected data rather than automated tool output, Gephi is a free open source graph visualisation tool that accepts CSV edge lists and node attribute files.

Prepare an edge list from collected data:

Source,Target,Relationship,Source_Type,Date
John Smith,Example Company Ltd,director_of,Person,2018-03-15
John Smith,j.smith@@example.com,owns,Person,2020-01-01
Sarah Jones,Example Company Ltd,director_of,Person,2018-03-15
John Smith,123 High Street London,registered_at,Person,2019-06-14
┌──(kali㉿kali)-[~]
└─$ # Import edges.csv into Gephi via File > Import Spreadsheet
# Set layout to ForceAtlas2 for network clustering
# Run modularity analysis to identify relationship clusters

Python NetworkX for Programmatic Analysis

For investigations where graph analysis needs to be scripted or integrated into a larger workflow, NetworkX provides graph construction and analysis in Python:

import networkx as nx
import matplotlib.pyplot as plt

G = nx.DiGraph()

# Add nodes with attributes
G.add_node("John Smith", type="person")
G.add_node("Example Company Ltd", type="organisation")
G.add_node("Sarah Jones", type="person")

# Add edges with relationship type
G.add_edge("John Smith", "Example Company Ltd", relationship="director_of")
G.add_edge("Sarah Jones", "Example Company Ltd", relationship="director_of")

# Find all nodes connected to a subject
print(list(G.neighbors("John Smith")))

# Find shared connections between two subjects
print(list(nx.common_neighbors(G.to_undirected(), "John Smith", "Sarah Jones")))

# Visualise
nx.draw(G, with_labels=True, node_color='lightblue', arrows=True)
plt.savefig('network.png')

Maintaining the Graph During an Investigation

Add nodes and edges as new information is confirmed, not as it is suspected. An unverified connection in the graph can mislead analysis and produce incorrect conclusions. Mark nodes with confidence levels and source references so that any edge in the graph can be traced back to the evidence that supports it.

When the graph becomes large, apply community detection algorithms to identify clusters of densely connected nodes. Clusters frequently correspond to meaningful real-world groups: a business network, a family unit, or a shared infrastructure set. Nodes that bridge multiple clusters are often the most significant for the investigation.

References