OpenUBA
What it is
OpenUBA is a free, open-source framework for user and entity behavior analytics in security analytics. It lets users install, train and run models, track versions and artifacts, and use feedback and shadow modes. Listed frameworks include scikit-learn, PyTorch, TensorFlow, Keras, NetworkX and Spark MLlib. A visual flow-based rule builder combines model outputs with logical conditions; resulting alerts can connect to anomalies and cases. Data loading supports local CSV, Elasticsearch, Spark and aggregated sources. The project describes a Kubernetes-native architecture with containerized components for a development Kind cluster or production Kubernetes cluster. Its interfaces include REST endpoints, GraphQL and a Python SDK. The README lists JWT authentication, four roles, per-page read/write permissions and audit logging. Training and inference use isolated Docker containers or temporary Kubernetes Jobs with resource limits. The built-in assistant supports local Ollama and cloud APIs from OpenAI, Claude and Gemini. OpenUBA's README labels the project beta, and its v0.0.2 release is listed as a pre-release.
For and against
For
- Open-source models are inspectable and auditable.
- Supports several machine-learning frameworks.
- Visual rules combine model outputs and logic.
- REST, GraphQL and Python SDK interfaces are listed.
- Training and inference run in isolated containers or jobs.
Against
- The project is labeled beta.
- The v0.0.2 release is a pre-release.
- HuggingFace integration is listed as planned.
The verdict
OpenUBA offers an inspectable model workflow, configurable detection rules and Kubernetes-oriented deployment options. Its beta status and pre-release version are important considerations for teams evaluating operational use.
Who it suits
OpenUBA is aimed at security analysts who want to inspect how behavior-analytics models work. It may also suit teams prepared to deploy and operate a beta framework in Kubernetes or a development Kind cluster.
On the record
- Access control
- The README lists JWT authentication, four roles, configurable per-page read/write permissions, and audit logging.github.com · read 4 Oct 2026
- API and SDK
- The project documents a REST API, GraphQL API, and Python SDK installable with pip for model registration, job submission, and visualization.github.com · read 8 Oct 2026
- Approach
- It uses inspectable, auditable models and says model transparency supports compliance, investigations, and decision making.github.com · read 4 Oct 2026
- Current maturity
- The repository README labels the project beta and identifies the release as v0.0.2.github.com · read 4 Oct 2026
- Data integrations
- Built-in data loaders support local CSV files, Elasticsearch, Spark, and aggregated source groups.github.com · read 8 Oct 2026
- Data sources
- Listed data loaders include local CSV, Elasticsearch, Spark, and aggregated multi-source loading.github.com · read 4 Oct 2026
- Deployment
- OpenUBA is Kubernetes-native, with Docker containers and ephemeral Kubernetes jobs for model training and inference.github.com · read 8 Oct 2026
- Deployment security guidance
- The security policy recommends TLS behind a reverse proxy, Kubernetes RBAC, Kubernetes Secrets for database credentials, network policies, and regular container image updates.github.com · read 8 Oct 2026
- Detection and response
- A visual flow-based rule builder combines model outputs and logical conditions to generate alerts that can be linked to anomalies and cases.github.com · read 8 Oct 2026
- Detection rules
- A visual flow-based rule builder composes model outputs and logical conditions, with triggered alerts linked to anomalies and cases.github.com · read 4 Oct 2026
- Execution isolation
- Model training and inference run in isolated Docker containers or ephemeral Kubernetes Jobs, with resource limits described as a way to contain misbehaving models.github.com · read 4 Oct 2026
- Intended users
- OpenUBA is designed for security analysts interested in understanding how detection models work under the hood.github.com · read 8 Oct 2026
- LLM integrations
- The built-in assistant supports Ollama locally and cloud API providers OpenAI, Claude, and Gemini.github.com · read 8 Oct 2026
- LLM providers
- The built-in assistant supports local Ollama and cloud APIs from OpenAI, Claude, and Gemini.github.com · read 4 Oct 2026
- Model frameworks
- Documented model frameworks include scikit-learn, PyTorch, TensorFlow, Keras, NetworkX, and Spark MLlib.github.com · read 8 Oct 2026
- Model lifecycle
- The platform supports installing, training, and running inference with models, and tracks model versions and artifacts.github.com · read 8 Oct 2026
- Model registries
- The README lists GitHub, OpenUBA Hub, HuggingFace, Kubeflow, and local filesystem as model registry options, while noting HuggingFace integration as planned in its adapter table.github.com · read 8 Oct 2026
- Model transparency
- The project describes its models as inspectable and auditable, with model source code available for inspection.github.com · read 8 Oct 2026
