graph-the-network

Start with two CSVs, nodes and edges, assigning one node per real-world entity and a closed set of typed edges. Every edge must carry a source, retrieval timestamp, confidence grade, and validity dates so the graph stays auditable as it grows.

Use Neo4j when you need path and pattern queries like shortest connections between entities, Gephi for layout, centrality metrics, and community detection, and Maltego for automated pivoting via transforms. For under roughly 200 nodes, CSVs plus Graphviz are usually sufficient.

Only add an edge if it discriminates: if many unrelated entities would share it, model it as a node attribute instead. Shared CDN IPs, webmail domains, registrars, and formation-agent addresses are the classic low-value nodes that create hairballs.

No, model them as separate nodes connected by an operates edge, because the operator can change and the account can be shared. Collapsing them makes both facts unrepresentable and corrupts centrality metrics.

Centrality measures your collection as much as reality: whatever you enumerated most thoroughly becomes the graph's center. Note collection coverage next to any metric, and compare degree against betweenness since the controlling party often sits at moderate degree and high betweenness.

Transforms are server-side lookups, so they are attributable collection actions that reveal your interest to third-party services. Free tiers truncate results without displaying it, and transform output inherits the accuracy of its underlying data source, so export and grade results independently.