← ClaudeAtlas

graph-the-networklisted

Build an entity-relationship link-analysis graph of an investigation — nodes, typed edges carrying source and confidence, aliases, and temporal validity — to expose shared infrastructure, bridging nodes and the real principal behind a frontman. Covers Maltego, Neo4j and Cypher, Gephi, centrality and community detection, and entity resolution. Use when an investigation has outgrown a list and needs a graph, or when asked how a set of people, companies and domains connect. Applies to fraud-ring and shell-network detection, AML and sanctions-evasion analysis, and complex corporate-structure work. Reference at useosint.com/skills/graph-the-network.
useosint/osint-skills · ★ 16 · Code & Development · score 78
Install: claude install-skill useosint/osint-skills
# Graph the network A list of thirty selectors and a graph of thirty selectors contain identical information, and only one of them lets you see that two clusters share a node. That is the entire justification: humans do not detect shared elements across rows, and detect them instantly in a layout. The beginner mistake is treating the graph as an output — a picture drawn at the end for the report. It is the case's working memory, built from the first pivot, and the report is generated from it. ## Decide the schema before the second node Everything useful downstream — deduplication, centrality, querying, the report table — depends on decisions made in the first ten minutes. Two rules: **One node per real-world thing.** An alias is an attribute, not a node. If "J. Okonkwo", "jokonkwo", and "Joseph Okonkwo" are three nodes, every metric you compute is wrong: degree is split three ways, so the most important person in the case looks peripheral, and the shared connection between two clusters never appears because it is distributed across duplicates. Merge on evidence and record the merge (which selectors, what confidence) — an unrecorded merge is an unauditable assertion that two things are one thing. The exception that trips people: a person and their account are different things. Model `Person —operates→ Account`, because the operator can change and the account can be shared. Collapsing them makes both facts unrepresentable. **A closed set of edge types.** Free-text edge la