Pivoting & Link Analysis

Learning Objectives

• Define a selector and list the common selector types used in OSINT
• Explain what each selector type can typically pivot to
• Build and document a pivot chain, including confidence at each step
• Use link analysis (graphs) to spot relationships that lists hide
• Decide when to stop pivoting, for scope, ethical, and practical reasons

What Pivoting Is

Pivoting means using one piece of information to discover the next. You start with something you know (a company domain, a username, a photo) and ask: what else is connected to this? Each answer gives you a new starting point.

The thing you search on is called a selector: a piece of data that identifies or links to a person, organization, account, or piece of infrastructure. Investigations are really chains of selectors.

companyx.com ──► contact page ──► jane.doe@companyx.com ──► "janedoe_it" (username)
                                                               │
                                                               ▼
                                            conference talk slides ──► internal tool names

Pivoting is why OSINT is so powerful: small, harmless-looking details combine into a detailed picture. It’s also why OSINT can become harmful (the mosaic effect from Module 2). Every pivot should pass a scope check.

Common Selectors and Where They Lead

The table below is a map of what each selector can typically connect to. How to perform each lookup is covered in Module 4 Collection Techniques, and the specific sources are in Module 5 OSINT Sources.

Strong vs. weak selectors

Some selectors are unique (an email address, a PGP key fingerprint, a crypto wallet). Others are shared (a common name, a popular username, a shared-hosting IP). A pivot through a weak selector needs extra corroboration before you trust it.

A useful rule of thumb: one strong link, or several independent weak links, before you connect two things. “Same username” alone is weak. “Same username, same profile photo, same city, and both link to the same personal website” is strong.

Pivot Chains in Practice

Example 1: Organization recon (fictional)

[Company X]
    │ business filing / website
    ▼
[companyx.com] ──────────────► [MX record] ──► cloud email provider (R3 answered)
    │                    └────► [CT logs] ──► vpn.companyx.com, sso.companyx.com
    │ contact page
    ▼
[press@companyx.com] ──► format guess: first.last@
    │ PDF metadata (Author: "Jane Doe", user: "jdoe")
    ▼
[Jane Doe, IT Manager] ──► professional profile ──► skills list: firewall vendor, SIEM product
                                                    │
                                                    ▼
                                    job posting confirms same firewall vendor

Notice how one path answered two requirements (email format and technology stack), and each claim is confirmed by more than one source.

Example 2: Branching and dead ends

Real pivot chains branch, and most branches die. That’s normal.

[username: "cx_admin"]
    ├── Platform A: account exists, created last year, links to companyx.com ✔ (keep)
    ├── Platform B: account exists, posts about gardening in another country ✘ (different person, drop)
    └── Platform C: no account                                              — (record "not found")

Record the dead ends too. A note that says “Platform B is a different person, because of X and Y” saves a teammate from making the wrong connection later.

Tracking Your Pivots

If you don’t track pivots, you can’t explain how you reached a conclusion, and you can’t tell where a mistake crept in. Use a pivot log: a simple table, filled in as you go.

A few habits make the log more useful:
- Number every pivot so reports can reference them (“see pivot 7”).
- Record the method, not just the source (the exact search query, the tool and version).
- Carry confidence forward. A conclusion can’t be more certain than the weakest link in its chain.
- Log the scope decision for anything borderline.

A blank template is in 3.4-planning-an-investigation.md.

Link Analysis

Once you have more than a dozen selectors, lists stop working. Link analysis represents your findings as a graph:
- Nodes (entities): people, organizations, domains, IPs, emails, accounts, documents
- Edges (links): relationships such as “registered”, “resolves to”, “works at”, “posted”, “same photo as”

Graphs reveal things lists hide:
- Hubs: one entity connected to many others (e.g., one IP hosting many suspicious domains)
- Clusters: groups that connect to each other more than to anything else
- Bridges: a single link that connects two otherwise separate clusters, often the most interesting finding
- Gaps: entities you expected to be connected that aren’t

Labeling edges

Put the evidence and confidence on the edge, not just the line. “Jane Doe —works at→ Company X (confirmed, pivot 3)” is far more useful than an unlabeled line. Graphs make weak connections look as solid as strong ones, which is a common way analysts fool themselves.

Link analysis tools

Tool details and hands-on setup belong to Module 4 Collection Techniques. For this module, the important point is the method: every node and edge should trace back to your pivot log.

Automated pivoting: a warning

Automated tools can pivot hundreds of times in seconds. That’s useful, but:
- They don’t understand scope. They will happily pivot into personal accounts and unrelated organizations.
- They pivot through weak selectors (shared IPs, common names) and present the results as if they were solid.
- Their data sources can be outdated.

Treat automated results as leads to verify, not findings.

Knowing When to Stop

Stopping is a skill. Stop pivoting when any of these are true:

1. The requirement is answered to the confidence level you need.
2. The time box is used up. Reassess before spending more.
3. You’ve left scope. Common signs: you’re looking at family members, home addresses, personal accounts unrelated to the organization, or a different organization entirely.
4. The chain is too weak. Three “possible” links in a row don’t add up to a “likely.”
5. Diminishing returns. The last several pivots produced nothing new.
6. Ethical or legal lines. The next step would require logging in, using leaked data, contacting someone, or anything not authorized (see Module 2).
7. OPSEC risk. The next step would expose you to the target (see Module 8).

A simple habit: before each pivot, say out loud (or write) “This pivot helps answer requirement R_ because ___.” If you can’t finish the sentence, stop or park it.

Key Terms

• Selector: a piece of identifying data (email, username, domain, IP, etc.) used as a search starting point
• Pivot: using one selector to discover another related one
• Pivot chain: a sequence of pivots from a starting point to a finding
• Pivot log: a record of each pivot, its method, confidence, and scope decision
• Strong / weak selector: unique identifiers vs. identifiers that many people or systems share
• Link analysis: representing entities and their relationships as a graph to find patterns
• Node / edge: an entity in a graph / a relationship between two entities
• Transform: in Maltego, an automated lookup that turns one entity into related entities
• Mosaic effect: harmless details that become sensitive when combined

Key Takeaways

• Pivoting = using what you know to find what’s connected
• Selectors vary in strength: emails and keys are strong, names and shared IPs are weak
• Require one strong link, or several independent weak links, before connecting two things
• A conclusion is only as confident as the weakest link in its chain
• Keep a pivot log: numbered, with method, confidence, scope decision, and evidence
• Link analysis graphs reveal hubs, clusters, and bridges that lists hide
• Automated tools pivot fast but ignore scope; treat their output as leads
• Know when to stop: answered, out of time, out of scope, or too weak

References

• What is Maltego Graph Community Edition (CE)? — Maltego Docs
• Maltego FAQ
• Use Maltego for free with Maltego ID
• Intel 471 Acquires SpiderFoot — Intel 471
• SpiderFoot open-source repository — GitHub
• Gephi — The Open Graph Viz Platform
• Gephi — Bellingcat’s Online Investigation Toolkit
• How to Use Maltego and Gephi for Investigative Journalism — EBU Spotlight