graph-the-network

This skill is a methodology guide for building entity-relationship link-analysis graphs during an OSINT investigation. It solves the problem that a flat list of selectors hides shared connections a human can see instantly in a graph layout, and it teaches how to model an investigation as nodes and typed edges that carry source, confidence, aliases, and temporal validity, so the graph becomes the case's working memory rather than a final picture.

It sets out concrete practices: one node per real-world thing (treating aliases as attributes and recording evidence-based merges) with a closed, direction-consistent vocabulary of edge types; putting source, retrieval timestamp, source grade, and confidence on every edge and rendering confidence visually (solid/dashed/dotted) with a confirmed-only view; and adding valid_from/valid_to so an untimed graph does not falsely assert that everything coexisted. It explains what the graph reveals, shared infrastructure, bridging nodes, the difference between degree and betweenness centrality, community detection, and collection gaps, while warning that centrality measures your collection as much as reality. A tool comparison covers plain node/edge CSVs with Graphviz or Gephi, Neo4j with Cypher for path queries, Gephi for layout and metrics, and Maltego for automated transform-based pivoting.

It targets OSINT analysts, investigative journalists, and fraud, AML, and sanctions-evasion practitioners doing shell-network and corporate-structure work. It is analytical and read-only guidance rather than an exploit tool, but it is dual-use reconnaissance methodology aimed at deanonymizing the real principal behind a frontman, so it warrants a light security note.