Axomaly vs OpenUBA

Axomaly is a cloud service that learns patterns in SaaS product and business metrics and flags meaningful changes without fixed thresholds. It accepts timestamped time-series values, with optional metadata, for business, operational, and application metrics. Before creation, Smart Metric Creation prepares a detection configuration and baseline requirements for review. Values are submitted through a REST API, one timestamped value per POST request. Detection begins once the required history is available; the amount depends on metric cadence and detector configuration. Results include an anomaly decision, confidence, expected range, direction of change, and detector evidence, which can feed existing workflows alongside logs, traces, dashboards, and alerting. The alpha starts with one metric and includes guided onboarding and direct support. It is free during alpha with no credit card required. During that period, data and results are hosted in the EU, isolated by organisation, encrypted in transit using HTTPS/TLS, and kept for up to 12 months before rolling deletion.

OpenUBA is a free, open-source User and Entity Behavior Analytics framework for security analytics. It analyzes behavior with machine-learning models to identify anomalies, assign risk scores, and produce classifications. The dashboard covers entity monitoring, risk trends, job orchestration, case management, and real-time behavioral baselines for tracking 10,000+ users. Data ingestion supports Spark, Elasticsearch, and CSV, and the project describes the platform as SIEM agnostic. Rule Studio provides a visual flow-graph builder for detection logic, while matching rules can trigger real-time alerts. Cases can be triaged, escalated, and resolved in built-in workflows. Models use a model.yaml configuration and MODEL.py interface with train() and infer() methods; examples use scikit-learn, TensorFlow, PyTorch, Keras, and NetworkX. A Kubernetes-native operator runs jobs in ephemeral containers, with GraphQL logs and monitoring. Deployment is self-hosted on Kind or production Kubernetes clusters.