Skip to content
SPECIFICTION
Get listed

OpenUBA

github.com

WebLinuxAPISelf-hosted
Visit github.com
Spec score 7.4 #10 of 21 in User and Entity Behavior Analytics Software

What it is

OpenUBA is a free, open-source framework for user and entity behavior analytics in security analytics. Users can install, train, and run models, track versions and artifacts, and use feedback and shadow modes. Listed model frameworks include scikit-learn, PyTorch, TensorFlow, Keras, NetworkX, and Spark MLlib. A visual flow-based rule builder combines model outputs with logical conditions; alerts can link to anomalies and cases. Data loaders cover local CSV, Elasticsearch, Spark, and aggregated multi-source loading. The project describes a Kubernetes-native architecture, with containerized components for development Kind clusters or production Kubernetes clusters. It provides REST endpoints, a GraphQL API, and a Python SDK for model registration, job submission, and visualization. Access controls listed in the README include JWT authentication, four roles, per-page read and write permissions, and audit logging. Model training and inference use isolated Docker containers or ephemeral Kubernetes Jobs with resource limits. The built-in assistant supports local Ollama and cloud APIs from OpenAI, Claude, and Gemini. The project identifies itself as beta, and its listed release is v0.0.2 as a pre-release.

Spec sheet

Product
OpenUBA is an open-source User and Entity Behavior Analytics framework for security analytics.Read 8 Oct 2026 · github.com
Intended users
OpenUBA is designed for security analysts interested in understanding how detection models work under the hood.Read 8 Oct 2026 · github.com
Deployment
OpenUBA is Kubernetes-native, with Docker containers and ephemeral Kubernetes jobs for model training and inference.Read 8 Oct 2026 · github.com
Support
The security policy asks vulnerability reporters to email [email protected] and states an acknowledgment target of 48 hours and an initial assessment target of 7 days.Read 8 Oct 2026 · github.com
Access control
The README lists JWT authentication, four roles, configurable per-page read/write permissions, and audit logging.Read 4 Oct 2026 · github.com
API and SDK
The project documents a REST API, GraphQL API, and Python SDK installable with pip for model registration, job submission, and visualization.Read 8 Oct 2026 · github.com
Approach
It uses inspectable, auditable models and says model transparency supports compliance, investigations, and decision making.Read 4 Oct 2026 · github.com
Current maturity
The repository README labels the project beta and identifies the release as v0.0.2.Read 4 Oct 2026 · github.com
Data integrations
Built-in data loaders support local CSV files, Elasticsearch, Spark, and aggregated source groups.Read 8 Oct 2026 · github.com
Data sources
Listed data loaders include local CSV, Elasticsearch, Spark, and aggregated multi-source loading.Read 4 Oct 2026 · github.com
Deployment security guidance
The security policy recommends TLS behind a reverse proxy, Kubernetes RBAC, Kubernetes Secrets for database credentials, network policies, and regular container image updates.Read 8 Oct 2026 · github.com
Detection and response
A visual flow-based rule builder combines model outputs and logical conditions to generate alerts that can be linked to anomalies and cases.Read 8 Oct 2026 · github.com
Detection rules
A visual flow-based rule builder composes model outputs and logical conditions, with triggered alerts linked to anomalies and cases.Read 4 Oct 2026 · github.com
Execution isolation
Model training and inference run in isolated Docker containers or ephemeral Kubernetes Jobs, with resource limits described as a way to contain misbehaving models.Read 4 Oct 2026 · github.com
LLM integrations
The built-in assistant supports Ollama locally and cloud API providers OpenAI, Claude, and Gemini.Read 8 Oct 2026 · github.com
LLM providers
The built-in assistant supports local Ollama and cloud APIs from OpenAI, Claude, and Gemini.Read 4 Oct 2026 · github.com
Model frameworks
Documented model frameworks include scikit-learn, PyTorch, TensorFlow, Keras, NetworkX, and Spark MLlib.Read 8 Oct 2026 · github.com
Model lifecycle
The platform supports installing, training, and running inference with models, and tracks model versions and artifacts.Read 8 Oct 2026 · github.com
Model registries
The README lists GitHub, OpenUBA Hub, HuggingFace, Kubeflow, and local filesystem as model registry options, while noting HuggingFace integration as planned in its adapter table.Read 8 Oct 2026 · github.com
Model transparency
The project describes its models as inspectable and auditable, with model source code available for inspection.Read 8 Oct 2026 · github.com
Release status
The GitHub releases page lists OpenUBA v0.0.2 as a pre-release.Read 8 Oct 2026 · github.com
Security controls
The README describes JWT authentication, role-based access control, per-page permissions, audit logging, and cryptographic model hash verification.Read 8 Oct 2026 · github.com

Strong points and limits

Strong points

  • Inspectable and auditable model approach
  • Supports several model frameworks
  • Visual rule builder links alerts to anomalies and cases
  • Offers REST, GraphQL, and Python SDK access
  • Model execution uses isolated containers or Kubernetes Jobs

Limits

  • Project is labeled beta
  • Listed v0.0.2 release is a pre-release
  • HuggingFace integration is listed as planned in the adapter table

Who it suits

OpenUBA suits security analysts interested in inspectable models and user and entity behavior analytics. Its Kubernetes deployment options and model workflow may also suit teams that can operate a self-hosted security analytics framework.

Verdict

OpenUBA combines model lifecycle tools, rule-based detection, and APIs with controls for access and execution isolation. Its beta status and pre-release indicate that readers should account for its current maturity.

Where Specifiction places it

Alternatives to OpenUBAAll alternatives →