Skip to content
SPECIFICTION
Get listed

OpenUBA

openuba.org

WebAPISelf-hosted
Visit openuba.org
Spec score 7.4 #13 of 22 in Anomaly Detection Software

What it is

OpenUBA is a free, open-source User and Entity Behavior Analytics framework for security analytics. It analyzes behavior with machine-learning models to identify anomalies, assign risk scores, and produce classifications. The dashboard covers entity monitoring, risk trends, job orchestration, case management, and real-time behavioral baselines for tracking 10,000+ users. Data ingestion supports Spark, Elasticsearch, and CSV, and the project describes the platform as SIEM agnostic. Rule Studio provides a visual flow-graph builder for detection logic, while matching rules can trigger real-time alerts. Cases can be triaged, escalated, and resolved in built-in workflows. Models use a model.yaml configuration and MODEL.py interface with train() and infer() methods; examples use scikit-learn, TensorFlow, PyTorch, Keras, and NetworkX. A Kubernetes-native operator runs jobs in ephemeral containers, with GraphQL logs and monitoring. Deployment is self-hosted on Kind or production Kubernetes clusters.

Spec sheet

Purpose
OpenUBA is an open-source User and Entity Behavior Analytics framework for security analytics.Read 5 Oct 2026 · openuba.org
Intended users
The project README describes OpenUBA as designed for security analysts curious about how models work under the hood.Read 5 Oct 2026 · github.com
Deployment
The README describes the platform as Kubernetes-native and says it can be deployed to a Kind development cluster or a production Kubernetes cluster.Read 5 Oct 2026 · github.com
Security
The project README says model executions run in isolated Docker containers or Kubernetes jobs, with resource limits to contain misbehaving models.Read 5 Oct 2026 · github.com
Access control
The site describes fine-grained role-based access control and permission-based navigation.Read 5 Oct 2026 · openuba.org
AI assistant
The built-in LLM assistant is described as helping users get insights and automate investigation workflows.Read 5 Oct 2026 · openuba.org
Alerts and cases
The site describes real-time rule alerts and built-in workflows to triage, escalate, and resolve anomaly cases.Read 5 Oct 2026 · openuba.org
Dashboard
The dashboard includes entity monitoring, risk trending, job orchestration, and case management.Read 5 Oct 2026 · openuba.org
Data ingestion
The dashboard supports ingestion from Spark, Elasticsearch, and CSV data sources.Read 5 Oct 2026 · openuba.org
Data sources
The site lists Spark, Elasticsearch, and CSV as data sources.Read 5 Oct 2026 · openuba.org
Detection
It analyzes behavior with machine-learning models to identify anomalies and produce risk scores and classifications.Read 5 Oct 2026 · openuba.org
Job monitoring
Training and inference jobs expose real-time logs and monitoring through GraphQL subscriptions.Read 5 Oct 2026 · openuba.org
Model format
The Open Model Standard uses a model.yaml configuration and a MODEL.py with train() and infer() methods.Read 5 Oct 2026 · openuba.org
Model library
Its model library lists implementations based on scikit-learn, TensorFlow, PyTorch, Keras, and NetworkX.Read 5 Oct 2026 · openuba.org
Model options
The model hub lists examples using scikit-learn, TensorFlow, PyTorch, Keras, and NetworkX.Read 5 Oct 2026 · openuba.org
Model orchestration
OpenUBA describes a Kubernetes-native operator using custom CRDs and ephemeral containers for training and inference jobs.Read 5 Oct 2026 · openuba.org
Model standard
Models use a standard manifest and Python interface with train() and infer() methods.Read 5 Oct 2026 · openuba.org
Monitoring
The dashboard describes real-time risk scoring and behavioral baselines for tracking 10,000+ users.Read 5 Oct 2026 · openuba.org
Orchestration
OpenUBA uses a Kubernetes-native operator and ephemeral containers for model training and inference jobs.Read 5 Oct 2026 · openuba.org
Pricing
The site calls OpenUBA fully open source and presents no paid plans or prices.Read 5 Oct 2026 · openuba.org
Publisher
The site footer credits Georgia Cyber Warfare Range, Inc.Read 5 Oct 2026 · openuba.org
Rule building
Rule Studio provides a visual flow-graph builder with drag-and-drop nodes for detection logic.Read 5 Oct 2026 · openuba.org
Rules and alerts
A visual flow-graph rule builder creates detection logic, and matching rules can trigger real-time alerts.Read 5 Oct 2026 · openuba.org
SIEM compatibility
The site describes OpenUBA as SIEM agnostic.Read 5 Oct 2026 · openuba.org
Support and community
The site links to GitHub and Discord and invites users to contribute models and integrations.Read 5 Oct 2026 · openuba.org

Strong points and limits

Strong points

  • Free and fully open source
  • Real-time anomaly alerts and risk scoring
  • Visual rule builder and case workflows
  • Multiple data-source and model options
  • Kubernetes-native job isolation

Limits

  • Self-hosted deployment is required
  • Kubernetes operation adds infrastructure responsibility
  • Model executions need container resources

Who it suits

OpenUBA is aimed at security analysts who want to examine how models work under the hood. It suits teams able to deploy and operate a Kubernetes-native, self-hosted system.

Verdict

OpenUBA offers a broad, self-hosted analytics workspace combining models, rules, alerts, and cases. Its strongest fit is a security team comfortable managing Kubernetes and contributing models or integrations.

Where Specifiction places it

Alternatives to OpenUBAAll alternatives →