Specifiction
For vendors
AdvertiseTop spots, featured rows, home sponsor Get listedAdd a product we don't cover yet Claim a listingFree: verify the domain, then correct your page Vendor dashboardNumbers, orders and placements
List your tool
Vendor dashboard
Tech riderRev. 22 Sept 2026

OpenUBA

Ch 165.7of 19 Anomaly Detection Software
  1. 1Runs onAPI, self-hosted, Web
  2. 2CostsNot stated by the maker
  3. 3Detection methodhybrid
  4. 4Real-time detectionYes
  5. 5Supported dataElasticsearch, Apache Spark, CSV
  6. 6Deployment optionsself-hosted
5 lines stated Written from the maker's own pages: openuba.org
Visit site Alternatives
The OpenUBA homepage

Overview

OpenUBA is ranked #16 of 19 in anomaly detection software on Specifiction. It runs on API, Self-hosted, Web.

Compared on anomaly detection software

Detection method
hybridopenuba.org
Real-time detection
Yesopenuba.org
Supported data
Elasticsearch, Apache Spark, CSVopenuba.org
Deployment options
self-hostedopenuba.org

Facts

Purpose
OpenUBA is an open-source User and Entity Behavior Analytics framework for security analytics.openuba.org · 5 Oct 2026
Detection
It analyzes behavior with machine-learning models to identify anomalies and produce risk scores and classifications.openuba.org · 5 Oct 2026
Dashboard
The dashboard includes entity monitoring, risk trending, job orchestration, and case management.openuba.org · 5 Oct 2026
Data sources
The site lists Spark, Elasticsearch, and CSV as data sources.openuba.org · 5 Oct 2026
Model standard
Models use a standard manifest and Python interface with train() and infer() methods.openuba.org · 5 Oct 2026
Model options
The model hub lists examples using scikit-learn, TensorFlow, PyTorch, Keras, and NetworkX.openuba.org · 5 Oct 2026
Rules and alerts
A visual flow-graph rule builder creates detection logic, and matching rules can trigger real-time alerts.openuba.org · 5 Oct 2026
Access control
The site describes fine-grained role-based access control and permission-based navigation.openuba.org · 5 Oct 2026
Orchestration
OpenUBA uses a Kubernetes-native operator and ephemeral containers for model training and inference jobs.openuba.org · 5 Oct 2026
Job monitoring
Training and inference jobs expose real-time logs and monitoring through GraphQL subscriptions.openuba.org · 5 Oct 2026
AI assistant
The built-in LLM assistant is described as helping users get insights and automate investigation workflows.openuba.org · 5 Oct 2026
Security
The project README says model executions run in isolated Docker containers or Kubernetes jobs, with resource limits to contain misbehaving models.github.com · 5 Oct 2026
Deployment
The README describes the platform as Kubernetes-native and says it can be deployed to a Kind development cluster or a production Kubernetes cluster.github.com · 5 Oct 2026
Support and community
The site links to GitHub and Discord and invites users to contribute models and integrations.openuba.org · 5 Oct 2026
Intended users
The project README describes OpenUBA as designed for security analysts curious about how models work under the hood.github.com · 5 Oct 2026
Data ingestion
The dashboard supports ingestion from Spark, Elasticsearch, and CSV data sources.openuba.org · 5 Oct 2026
Monitoring
The dashboard describes real-time risk scoring and behavioral baselines for tracking 10,000+ users.openuba.org · 5 Oct 2026
Model library
Its model library lists implementations based on scikit-learn, TensorFlow, PyTorch, Keras, and NetworkX.openuba.org · 5 Oct 2026
Model format
The Open Model Standard uses a model.yaml configuration and a MODEL.py with train() and infer() methods.openuba.org · 5 Oct 2026
Alerts and cases
The site describes real-time rule alerts and built-in workflows to triage, escalate, and resolve anomaly cases.openuba.org · 5 Oct 2026
Rule building
Rule Studio provides a visual flow-graph builder with drag-and-drop nodes for detection logic.openuba.org · 5 Oct 2026
Model orchestration
OpenUBA describes a Kubernetes-native operator using custom CRDs and ephemeral containers for training and inference jobs.openuba.org · 5 Oct 2026
SIEM compatibility
The site describes OpenUBA as SIEM agnostic.openuba.org · 5 Oct 2026
Publisher
The site footer credits Georgia Cyber Warfare Range, Inc.openuba.org · 5 Oct 2026
Pricing
The site calls OpenUBA fully open source and presents no paid plans or prices.openuba.org · 5 Oct 2026

Best OpenUBA alternatives

See all 18
All accessCh 01 ManageEngine NetFlow Analyzer Free planAndroidiOS from $172/mo7.3 All accessCh 02 Metaplane Free planFree trialAPI Free to start7.3 All accessCh 03 OpenSearch Free planAPILinux Free to start7.3 All accessCh 04 PyOD Free planAPILinux Free to start7.3 All accessCh 05 Anomalib Free planLinuxself-hosted Free to start7.2 All accessCh 06 PySAD Free planLinuxMac Free to start7.1

Where it ranks on Specifiction

Is OpenUBA yours?

Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.

Claim it free Promote OpenUBA

Sources