The way I've seen Maltego-like tools being used is in one of two modes: Documentation-mode and exploratory mode.
Documentation mode is "just" recording relationships between assets so they are readily understood and visually obvious. This can be used to break new analysts into cases and to publish reports. These also serve as good starting points to pick an investigation back up. This is arguably the "easier" mode to implement since it just requires a visual graph with different entity types.
Exploratory mode means populating the graph through "transforms" (in Maltego-lingo). Going from one node to more nodes and relationships by attempting to "pivot" from a node using a certain datasource. As an example from infrastructure analysis you'd say "here's an IP, now do a transform which creates vertices for all hostnames that point to that IP". This mode is harder to get right since there's always explosion of edges and also since it's just mind-numbing work to implement transforms for all the data-sources.
Documentation mode is "just" recording relationships between assets so they are readily understood and visually obvious. This can be used to break new analysts into cases and to publish reports. These also serve as good starting points to pick an investigation back up. This is arguably the "easier" mode to implement since it just requires a visual graph with different entity types.
Exploratory mode means populating the graph through "transforms" (in Maltego-lingo). Going from one node to more nodes and relationships by attempting to "pivot" from a node using a certain datasource. As an example from infrastructure analysis you'd say "here's an IP, now do a transform which creates vertices for all hostnames that point to that IP". This mode is harder to get right since there's always explosion of edges and also since it's just mind-numbing work to implement transforms for all the data-sources.