IntermediateOSINT

Entity Relationship Mapping for Cyber Investigations

Master entity relationship mapping for cyber investigations. Learn entity types, relationship types, graph databases, Maltego's approach, and practical mapping techniques.

#entity-relationship-mapping#graph-analysis#investigation#maltego#link-analysis#cyber-investigations

# Entity Relationship Mapping for Cyber Investigations

Entity relationship mapping is the systematic process of identifying, documenting, and visualizing connections between different entities in an investigation. The sections below present the principles, techniques, and tools for effective entity relationship mapping, with focus on [Maltego](/tools/maltego) as the primary mapping tool.

Entity Intelligence Mapping

Entity relationship mapping is a methodology for extracting intelligence from the connections between investigation targets. Every relationship — between people, domains, IPs, organizations — is a data point that reveals structure and intent. By systematically identifying entities, documenting how they connect, and visualizing the resulting network, investigators transform scattered data into actionable intelligence.

Entity Types

Person Entities

| Entity | Properties | Investigation Use |

|--------|------------|-------------------|

| Person | Name, DOB, aliases | Identity verification |

| Email | Address, domain | Communication mapping |

| Phone | Number, carrier | Identity linkage |

| Username | Platform, handle | Cross-platform mapping |

| Social Profile | Platform, URL | Social network mapping |

| Address | Location, type | Physical location |

Organization Entities

| Entity | Properties | Investigation Use |

|--------|------------|-------------------|

| Company | Name, jurisdiction | Corporate structure |

| Domain | Name, registrar | Digital presence |

| ASN | Number, organization | Network ownership |

| Certificate Authority | Name, trust level | Identity verification |

Infrastructure Entities

| Entity | Properties | Investigation Use |

|--------|------------|-------------------|

| Domain | Name, registrar | Digital presence |

| IP Address | Address, geolocation | Infrastructure mapping |

| Netblock | CIDR, ASN | Network ownership |

| Service | Port, protocol, banner | Capability assessment |

| Certificate | Issuer, SAN | Identity and hosting |

| Website | URL, technology | Web presence |

Content Entities

| Entity | Properties | Investigation Use |

|--------|------------|-------------------|

| Website | URL, technology | Web presence mapping |

| Document | Title, content | Information discovery |

| Image | Source, metadata | Attribution analysis |

| File | Name, hash, type | Malware analysis |

Event Entities

| Entity | Properties | Investigation Use |

|--------|------------|-------------------|

| Event | Date, location, type | Timeline construction |

| Transaction | Amount, date, parties | Financial analysis |

| Communication | Date, parties, medium | Communication mapping |

Relationship Types

Ownership Relationships

| Relationship | Example | Investigation Value |

|-------------|---------|---------------------|

| Owns | Person > owns > Domain | Attribution |

| Operates | Company > operates > Service | Infrastructure mapping |

| Controls | Person > controls > Company | Corporate control |

| Manages | Person > manages > Domain | Administrative control |

Technical Relationships

| Relationship | Example | Investigation Value |

|-------------|---------|---------------------|

| Resolves To | Domain > resolves to > IP | Technical mapping |

| Hosted On | Domain > hosted on > IP | Infrastructure |

| Connects To | IP > connects to > IP | Network topology |

| Uses | Service > uses > Technology | Technology stack |

Social Relationships

| Relationship | Example | Investigation Value |

|-------------|---------|---------------------|

| Works For | Person > works for > Company | Professional mapping |

| Emails | Person > emails > Person | Communication |

| Friends With | Person > friends with > Person | Social network |

| Member Of | Person > member of > Group | Association |

Financial Relationships

| Relationship | Example | Investigation Value |

|-------------|---------|---------------------|

| Pays | Company > pays > Person | Financial flow |

| Receives From | Person > receives from > Company | Income mapping |

| Transacts With | Person > transacts with > Person | Financial network |

Graph Databases

What Are Graph Databases?

Graph databases are specialized databases for storing and querying relationship data.

Key Concepts:

**Nodes**: Represent entities

**Edges**: Represent relationships

**Properties**: Key-value pairs on nodes and edges

**Indexes**: Accelerate queries on specific properties

Graph Database Comparison

|----------|------|----------|------|

Using Graph Databases for Investigations

**Data Modeling**:

- Design entity types and relationships

- Define properties and constraints

- Create indexes for common queries

**Data Import**:

- Import from CSV files

- Import from Maltego exports

- Import from other databases

**Querying**:

- Find shortest paths between entities

- Identify clusters and communities

- Calculate centrality measures

- Analyze network properties

Maltego's Approach

Entity System

[Maltego](/tools/maltego) provides a comprehensive entity system:

**Built-in Entities**: Predefined entity types for common objects

**Custom Entities**: User-defined entity types

**Entity Properties**: Key-value pairs for additional information

**Entity Styling**: Visual customization for analysis

Relationship Discovery

Maltego discovers relationships through transforms:

**Automated Discovery**: Transforms query data sources

**Manual Creation**: Users create relationships manually

**Import Relationships**: Import from external sources

**Visual Connections**: Relationships displayed as edges

Graph Analysis

Maltego provides graph analysis capabilities:

**Layout Algorithms**: Multiple layout options for visualization

**Pattern Recognition**: Visual identification of patterns

**Filtering**: Focus on specific entities or relationships

**Export**: Export for external analysis

Practical Mapping Techniques

Investigation Setup

**Define Scope**:

- What entities are in-scope?

- What relationships are relevant?

- What is the investigation objective?

**Create Workspace**:

- Set up Maltego workspace

- Configure transform sets

- Establish naming conventions

**Seed Collection**:

- Identify starting entities

- Validate entity information

- Create seed entities in Maltego

Entity Discovery

**Automated Discovery**:

- Run Maltego transforms

- Use command-line tools

- Query data sources

**Manual Discovery**:

- Research manually

- Create entities manually

- Document findings

**Import Discovery**:

- Import from other tools

- Import from databases

- Import from files

Relationship Documentation

**Direct Relationships**:

- Document direct connections

- Note relationship type

- Record confidence level

**Indirect Relationships**:

- Map through intermediaries

- Document connection chains

- Note indirect influences

**Temporal Relationships**:

- Track relationship changes

- Document timeline

- Note relationship duration

Pattern Analysis

**Structural Patterns**:

- Identify hubs and bridges

- Detect clusters

- Find chains and loops

**Behavioral Patterns**:

- Track activity patterns

- Identify communication patterns

- Note growth patterns

**Anomaly Detection**:

- Identify unusual connections

- Detect outliers

- Flag suspicious patterns

Visualization

**Layout Selection**:

- Choose appropriate layout

- Adjust for clarity

- Optimize for analysis

**Color Coding**:

- Define color scheme

- Apply consistently

- Use for categorization

**Annotation**:

- Add notes to entities

- Document findings

- Record analysis

Mapping Workflow

Phase 1: Preparation

**Objective Definition**: What are we trying to map?

**Scope Definition**: What entities are in-scope?

**Tool Selection**: What tools will we use?

**Methodology**: How will we conduct the investigation?

Phase 2: Entity Collection

**Seed Identification**: What starting entities do we have?

**Automated Discovery**: What can we find automatically?

**Manual Research**: What requires manual investigation?

**Validation**: How do we verify findings?

Phase 3: Relationship Documentation

**Direct Relationships**: What direct connections exist?

**Indirect Relationships**: What indirect connections exist?

**Temporal Changes**: How have relationships changed?

**Confidence Assessment**: How reliable are findings?

Phase 4: Analysis

**Pattern Identification**: What patterns emerge?

**Key Node Identification**: What entities are most important?

**Anomaly Detection**: What stands out?

**Interpretation**: What does the data mean?

Phase 5: Reporting

**Executive Summary**: Key findings overview

**Detailed Analysis**: Complete relationship mapping

**Visualizations**: Graph exports and diagrams

**Recommendations**: Actions based on findings

Advanced Techniques

Network Analysis

**Centrality Analysis**: Identify important nodes

**Community Detection**: Find groups of related entities

**Path Analysis**: Find connections between entities

**Flow Analysis**: Track information flow

Temporal Analysis

**Timeline Construction**: Build investigation timeline

**Change Detection**: Identify relationship changes

**Pattern Recognition**: Find temporal patterns

**Forecasting**: Predict future changes

Geospatial Analysis

**Location Mapping**: Map entity locations

**Geographic Patterns**: Identify geographic patterns

**Distance Analysis**: Analyze entity proximity

**Regional Clustering**: Find regional groups

Common Mapping Mistakes

**Insufficient Scope**: Not including all relevant entities

**Poor Documentation**: Not recording methodology

**Incomplete Relationships**: Missing important connections

**No Validation**: Not verifying findings

**Poor Visualization**: Unclear or confusing graphs

**No Analysis**: Collecting data without interpreting

**Incomplete Reporting**: Not documenting all findings

Conclusion

Entity relationship mapping is a fundamental skill for cyber investigations. By systematically identifying entities, documenting relationships, and analyzing patterns, investigators can build comprehensive intelligence pictures.

[Maltego](/tools/maltego) provides powerful capabilities for entity relationship mapping, combining automated discovery with visual analysis. Combine Maltego's capabilities with graph databases and analytical techniques for comprehensive mapping.

For related topics, explore [Link Analysis Fundamentals](/learn/link-analysis-fundamentals) for theoretical foundations and [Maltego Graph Analysis](/learn/maltego-graph-analysis) for Maltego-specific techniques.

Frequently Asked Questions

What is entity relationship mapping?

Entity relationship mapping is the systematic process of identifying, documenting, and visualizing connections between different entities in an investigation. It transforms scattered data into structured intelligence by mapping how people, organizations, domains, and other objects relate.

What are the main entity types in cyber investigations?

Main entity types include Person (name, email, phone), Organization (company, domain), Technical (IP, ASN, certificate), Communication (email, phone), Financial (accounts, transactions), and Physical (addresses, locations) entities.

How does Maltego approach entity relationship mapping?

Maltego provides specialized entity types with predefined properties and transforms. It visualizes relationships as graph connections, automates relationship discovery through transforms, and maintains structured data for each entity type.

What is the difference between entities and relationships?

Entities are discrete objects being analyzed (people, domains, IPs). Relationships are the connections between entities (works for, resolves to, communicates with). Mapping both creates a complete picture of the investigation landscape.

How do you identify hidden relationships?

Use cross-referencing across multiple data sources, analyze shared attributes (common IP ranges, similar email patterns), examine temporal patterns (timing of domain registrations), and leverage link analysis to reveal non-obvious connections.

What is graph database analysis?

Graph databases (Neo4j, ArangoDB) store entities as nodes and relationships as edges, enabling efficient traversal and pattern matching. They excel at finding shortest paths, detecting communities, and analyzing complex relationship networks.

How do you handle large-scale entity mapping?

Use automated tools (Maltego, SpiderFoot) for initial discovery, organize entities by type and source, create separate graphs for different investigation phases, and leverage graph databases for complex relationship queries across large datasets.

What are the key properties of investigation entities?

Entity properties include type classification, primary identifying value, additional attributes (dates, locations), source attribution, confidence levels, and temporal data. Documenting these properties enables pattern analysis and cross-referencing.

How does entity mapping support decision making?

Entity mapping reveals attack paths, identifies high-value targets, documents evidence chains, supports risk assessment, and provides visual intelligence for stakeholders. It transforms raw data into actionable insights for investigation decisions.

What tools complement Maltego for entity mapping?

Neo4j provides graph database analysis, Analyst's Notebook is used in law enforcement, Gephi offers advanced network visualization, i2 provides intelligence-focused mapping, and custom Python scripts with NetworkX enable specialized analysis.