There is a graph with multiple node labels (ip, device, url, etc) and a "main" node (main_id) which will always have a connection to the previous mentioned nodes (they are all directed from the main_id to the other nodes).
(:ip)<-[:HAS_IP]-(:main_id)...