- Home
- Anomaly Detection Software
- OpenUBA
OpenUBA
What it is
OpenUBA is a free, open-source User and Entity Behavior Analytics framework for security analytics. It analyzes user and entity behavior with machine-learning models to identify anomalies and assign risk scores and classifications. The web dashboard supports entity monitoring, risk trends, job orchestration, and case management, including real-time scoring and behavioral baselines for tracking 10,000+ users. Data ingestion covers Spark, Elasticsearch, and CSV, and the project is described as SIEM agnostic. Rule Studio lets analysts assemble detection logic in a visual flow graph, while matching rules can generate real-time alerts. Case workflows support triage, escalation, and resolution. Models use a model.yaml configuration and MODEL.py with train() and infer() methods, with examples based on scikit-learn, TensorFlow, PyTorch, Keras, and NetworkX. Kubernetes-native orchestration runs training and inference in ephemeral containers. GraphQL subscriptions expose live logs and monitoring, and an LLM assistant supports investigation workflows.
For and against
For
- Free and fully open source
- Ingests Spark, Elasticsearch, and CSV
- Visual rule builder with real-time alerts
- Kubernetes-native model job orchestration
- Role-based access and case workflows
Against
- Requires self-hosted deployment
- Kubernetes operations are part of the setup
The verdict
OpenUBA combines behavioral analytics, model-driven scoring, visual detection rules, and case handling in one open-source platform. Its self-hosted, Kubernetes-native design is best suited to teams prepared to operate the environment themselves.
Who it suits
OpenUBA suits security analysts who want an open-source, self-hosted framework and visibility into how models work. It also fits teams needing SIEM-agnostic analytics, rule alerts, and case workflows.
On the record
- Access control
- The site describes fine-grained role-based access control and permission-based navigation.openuba.org · read 5 Oct 2026
- AI assistant
- The built-in LLM assistant is described as helping users get insights and automate investigation workflows.openuba.org · read 5 Oct 2026
- Alerts and cases
- The site describes real-time rule alerts and built-in workflows to triage, escalate, and resolve anomaly cases.openuba.org · read 5 Oct 2026
- Dashboard
- The dashboard includes entity monitoring, risk trending, job orchestration, and case management.openuba.org · read 5 Oct 2026
- Data ingestion
- The dashboard supports ingestion from Spark, Elasticsearch, and CSV data sources.openuba.org · read 5 Oct 2026
- Data sources
- The site lists Spark, Elasticsearch, and CSV as data sources.openuba.org · read 5 Oct 2026
- Deployment
- The README describes the platform as Kubernetes-native and says it can be deployed to a Kind development cluster or a production Kubernetes cluster.github.com · read 5 Oct 2026
- Detection
- It analyzes behavior with machine-learning models to identify anomalies and produce risk scores and classifications.openuba.org · read 5 Oct 2026
- Intended users
- The project README describes OpenUBA as designed for security analysts curious about how models work under the hood.github.com · read 5 Oct 2026
- Job monitoring
- Training and inference jobs expose real-time logs and monitoring through GraphQL subscriptions.openuba.org · read 5 Oct 2026
- Model format
- The Open Model Standard uses a model.yaml configuration and a MODEL.py with train() and infer() methods.openuba.org · read 5 Oct 2026
- Model library
- Its model library lists implementations based on scikit-learn, TensorFlow, PyTorch, Keras, and NetworkX.openuba.org · read 5 Oct 2026
- Model options
- The model hub lists examples using scikit-learn, TensorFlow, PyTorch, Keras, and NetworkX.openuba.org · read 5 Oct 2026
- Model orchestration
- OpenUBA describes a Kubernetes-native operator using custom CRDs and ephemeral containers for training and inference jobs.openuba.org · read 5 Oct 2026
- Model standard
- Models use a standard manifest and Python interface with train() and infer() methods.openuba.org · read 5 Oct 2026
- Monitoring
- The dashboard describes real-time risk scoring and behavioral baselines for tracking 10,000+ users.openuba.org · read 5 Oct 2026
- Orchestration
- OpenUBA uses a Kubernetes-native operator and ephemeral containers for model training and inference jobs.openuba.org · read 5 Oct 2026
- Pricing
- The site calls OpenUBA fully open source and presents no paid plans or prices.openuba.org · read 5 Oct 2026
