Best Anomaly Detection Software in 2026
Updated
In short: ManageEngine NetFlow Analyzer is ranked #1 of 19 as of 4 October 2026, ahead of Metaplane and OpenSearch. The best-ranked option with a free plan is Metaplane. The lowest first paid tier on this page is ManageEngine NetFlow Analyzer at $172/mo.
Anomaly detection software is used to identify unusual patterns in data, systems or networks. Compared on detection method, real-time detection, anomaly explanations and supported data, the entries help you assess what each tool says it can find and describe. Data retention and deployment options add practical considerations, while free-plan and paid-from details let you weigh access and cost. ManageEngine NetFlow Analyzer, Metaplane and OpenSearch are among the options, alongside PyOD and Soda. Start with the data you need to monitor, then compare detection and explanation capabilities with your deployment and retention requirements.
19 anomaly detection software ranked on what their makers publish — plans and prices, free tiers, platforms and the facts on their own pages.
19ranked
9free plans on this page
$172/molowest paid tier
4 Oct 2026last checked
Input list Anomaly Detection Software 19 channels on this page · 61 of 152 spec lines stated by the makers
Ch Tool Free planPaid fromDetection methodReal-time detectionSupported dataDeployment optionsAnomaly explanationsData retention Spec sheet Score
01 ManageEngine NetFlow Analyzer Free planYesPaid fromnot statedDetection methodnot statedReal-time detectionnot statedSupported datanot statedDeployment optionsnot statedAnomaly explanationsnot statedData retentionnot stated 1/8spec lines stated 7.3
02 Metaplane Free planYesPaid fromnot statedDetection methodmachine-learningReal-time detectionYesSupported datarow counts, freshness, schemas, column counts, cardinality, uniqueness, nullness, numeric statistics, custom SQLDeployment optionscloudAnomaly explanationsnot statedData retentionnot stated 5/8spec lines stated 7.3
03 OpenSearch Free plannot statedPaid fromnot statedDetection methodnot statedReal-time detectionnot statedSupported datanot statedDeployment optionsnot statedAnomaly explanationsnot statedData retentionnot stated 0/8spec lines stated 7.3
04 PyOD Free planYesPaid fromnot statedDetection methodhybridReal-time detectionYesSupported datatabular, time series, graph, text, image, audioDeployment optionsself-hostedAnomaly explanationsYesData retentionnot stated 6/8spec lines stated 7.3
05 Anomalib Free plannot statedPaid fromnot statedDetection methodmachine-learningReal-time detectionnot statedSupported dataimages, videosDeployment optionsself-hostedAnomaly explanationsnot statedData retentionnot stated 3/8spec lines stated 7.2
06 PySAD Free planYesPaid fromnot statedDetection methodhybridReal-time detectionYesSupported dataunivariate data; multivariate data; streaming dataDeployment optionsself-hostedAnomaly explanationsnot statedData retentionnot stated 5/8spec lines stated 7.1
07 Soda Free planYesPaid from$750/moDetection methodnot statedReal-time detectionnot statedSupported datanot statedDeployment optionsnot statedAnomaly explanationsnot statedData retentionnot stated 2/8spec lines stated 7.1
08 ObservabilityOS Free planYesPaid from$29/moDetection methodhybridReal-time detectionYesSupported datalogs, metrics, tracesDeployment optionshybridAnomaly explanationsYesData retention30 days 8/8spec lines stated 7.0
09 Axomaly Free plannot statedPaid fromnot statedDetection methodstatisticalReal-time detectionnot statedSupported dataTimestamped time-series values, optional metadata, business metrics, operational metrics, application metricsDeployment optionscloudAnomaly explanationsYesData retentionnot stated 4/8spec lines stated 6.8
10 ExtraHop RevealX Free plannot statedPaid fromnot statedDetection methodhybridReal-time detectionYesSupported datanetwork packets, applications, transactions, devices, users, identities, services, and network metadataDeployment optionshybridAnomaly explanationsnot statedData retentionnot stated 4/8spec lines stated 6.8
11 Corelight Open NDR Free plannot statedPaid fromnot statedDetection methodhybridReal-time detectionYesSupported datanetwork traffic, packet data, flow logs, cloud network traffic, protocol logs, filesDeployment optionshybridAnomaly explanationsYesData retentionnot stated 5/8spec lines stated 6.7
12 Vectra AI Identity Threat Detection and Response Free plannot statedPaid fromnot statedDetection methodnot statedReal-time detectionnot statedSupported datanot statedDeployment optionsnot statedAnomaly explanationsnot statedData retentionnot stated 0/8spec lines stated 6.7
13 Securonix UEBA Free plannot statedPaid fromnot statedDetection methodnot statedReal-time detectionnot statedSupported datanot statedDeployment optionshybridAnomaly explanationsnot statedData retentionnot stated 1/8spec lines stated 6.6
14 Darktrace / EMAIL Free planNoPaid fromnot statedDetection methodnot statedReal-time detectionnot statedSupported datanot statedDeployment optionsnot statedAnomaly explanationsnot statedData retentionnot stated 1/8spec lines stated 6.3
15 Anomalo Free plannot statedPaid fromnot statedDetection methodmachine-learningReal-time detectionnot statedSupported datastructured, semi-structured, unstructured, tables, documentsDeployment optionshybridAnomaly explanationsYesData retentionnot stated 4/8spec lines stated 5.8
16 OpenUBA Free plannot statedPaid fromnot statedDetection methodhybridReal-time detectionYesSupported dataElasticsearch, Apache Spark, CSVDeployment optionsself-hostedAnomaly explanationsnot statedData retentionnot stated 4/8spec lines stated 5.7
17 Anodot Free plannot statedPaid fromnot statedDetection methodnot statedReal-time detectionnot statedSupported datanot statedDeployment optionscloudAnomaly explanationsnot statedData retentionnot stated 1/8spec lines stated 5.6
18 rrcf Free planYesPaid fromnot statedDetection methodmachine-learningReal-time detectionYesSupported datamultidimensional numerical and streaming time-series dataDeployment optionsself-hostedAnomaly explanationsnot statedData retentionnot stated 5/8spec lines stated 5.6
19 Progress Flowmon Free planNoPaid fromnot statedDetection methodnot statedReal-time detectionnot statedSupported datanot statedDeployment optionshybridAnomaly explanationsnot statedData retentionnot stated 2/8spec lines stated 5.5
Compare all 19 in a table
| # | Tool | Score | Free plan | From | Free plan | Paid from | Detection method | Real-time detection |
|---|---|---|---|---|---|---|---|---|
| 1 | ManageEngine NetFlow Analyzer | 7.3 | Free plan | $172/mo | Yes | — | — | — |
| 2 | Metaplane | 7.3 | Free plan | Free | Yes | — | machine-learning | Yes |
| 3 | OpenSearch | 7.3 | Free plan | Free | — | — | — | — |
| 4 | PyOD | 7.3 | Free plan | Free | Yes | — | hybrid | Yes |
| 5 | Anomalib | 7.2 | Free plan | Free | — | — | machine-learning | — |
| 6 | PySAD | 7.1 | Free plan | Free | Yes | — | hybrid | Yes |
| 7 | Soda | 7.1 | Free plan | $750/mo | Yes | 750 /mo | — | — |
| 8 | ObservabilityOS | 7.0 | Free plan | $292,499/mo | Yes | 29 /mo | hybrid | Yes |
| 9 | Axomaly | 6.8 | Free plan | Free | — | — | statistical | — |
| 10 | ExtraHop RevealX | 6.8 | No | — | — | — | hybrid | Yes |
| 11 | Corelight Open NDR | 6.7 | No | — | — | — | hybrid | Yes |
| 12 | Vectra AI Identity Threat Detection and Response | 6.7 | No | — | — | — | — | — |
| 13 | Securonix UEBA | 6.6 | No | — | — | — | — | — |
| 14 | Darktrace / EMAIL | 6.3 | No | — | No | — | — | — |
| 15 | Anomalo | 5.8 | No | — | — | — | machine-learning | — |
| 16 | OpenUBA | 5.7 | No | — | — | — | hybrid | Yes |
| 17 | Anodot | 5.6 | No | — | — | — | — | — |
| 18 | rrcf | 5.6 | No | — | Yes | — | machine-learning | Yes |
| 19 | Progress Flowmon | 5.5 | No | — | No | — | — | — |
Is your tool on this list?
Numbered spots on this list can be sponsored. They are labelled, and the editorial order and scores never change for payment.
Questions about this list
Which anomaly detection software is ranked first on Specifiction?
ManageEngine NetFlow Analyzer is ranked #1 of 19 with a score of 7.3. Metaplane is second and OpenSearch third.
How many of these have a free plan?
9 of the 19 on this page publish a free plan on their own pricing pages.
Which is the cheapest paid option?
On this page, ManageEngine NetFlow Analyzer has the lowest first paid tier we found: $172/mo.
How is this list ranked?
Ranked on what each maker publishes, the fullest spec sheet first: how deeply the product is documented, the platforms it runs on, a free tier or trial to test it, and its standing. Paid placements never change a rank.
More in Analytics & Data
All analytics & data listsWeb analytics tools 141Statistical Analysis Software 106Business Intelligence Tools 92Database Software 74GIS Software 63Heatmap and session replay tools 63Customer Data Platforms 54A/B Testing Tools 50Marketing Analytics Software 49Ecommerce Analytics Software 43Product Analytics Tools 42Interactive Map Software 41