Investigation Graph
OSINT UI's correlation engine: how it works, depth levels, expanding nodes and exporting.
Investigation Graph is OSINT UI's flagship tool — the one that turns 19 separate tools into one correlation platform. Requires PRO.
What makes it different
When you enter a target (email, domain, phone, username...), Investigation Graph automatically fires the relevant probes from the other tools and builds an entity and relationship graph:
- Identity = type + normalized value. The same email seen by the domain analyzer, a data breach and a GitHub commit is one node with three sources — not three separate findings you'd have to merge by hand.
- Confidence is computed, not declared. Each source reports what it saw and how reliable it is; the graph combines that evidence with a formula (noisy-OR) so certainty only rises when there's real cross-corroboration — a single weak signal never becomes "confirmed" just by repeating.
- A pivot is not proof. A facial match (
resembles) between two profiles is a strong hint they're the same person, but it's never treated as proof that person controls both accounts. Identity resolution between two similar nodes is always proposed, never auto-merged.
Depth levels
| Level | Recommended use | Approx. time |
|---|---|---|
| Quick | First glance, lightweight HTTP sources only | Seconds |
| Standard | Regular investigation, coverage/time balance | 1-2 minutes |
| Deep | Full case, includes slow sources (BBOT, maigret...) | Several minutes |
The level decides how many expansion "waves" run and with what request budget — a large domain doesn't burn the whole budget on the first branch it finds, it spreads breadth-first before going deep.
Expanding a node
From the workbench, any node can be expanded: it re-runs just that entity type's probes and merges the result into the graph already on screen, without losing the rest of the investigation. If nothing new turns up, it says so explicitly instead of leaving you wondering whether the button did anything.
What else it includes
- Timeline — when each piece of evidence was observed.
- Shortest path between any two nodes in the graph.
- Export to GraphML and Maltego CSV, plus PDF/HTML via Saved investigations.
- Time decay — a 2016 breach counts for less than a profile seen yesterday when confidence is computed.
- Flagged conflicts — if two sources give a different country or employer for the same node, the conflict is marked instead of the first source silently winning.
How many API keys it needs
None are required: Investigation Graph reuses whatever keys you've already configured for the other tools. The more you have connected, the more sources the graph can cross-reference. See API keys (BYOK).