Cisco Catalyst Center vs OpenUBA
Cisco Catalyst Center
cisco.comOpenUBA
openuba.orgSide by side
| Figure | Cisco Catalyst Center | OpenUBA |
|---|---|---|
| Price from | — | — |
| Free plan | — | — |
| Free trial | — | — |
| Open source | — | — |
| Web | Yes | Yes |
| Windows | Yes | — |
| macOS | Yes | — |
| Linux | Yes | — |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 2 | 0 |
| Spec score · Anomaly Detection Software | 7.7 (#7) | 7.4 (#13) |
| Deployment | Cisco describes hardware and virtual appliance deployments, including current guides for VMware ESXi and Ubuntu KVM. | The README describes the platform as Kubernetes-native and says it can be deployed to a Kind development cluster or a production Kubernetes cluster. |
| Purpose | Cisco Catalyst Center is a centralized network controller and management dashboard for enterprise network operations. | OpenUBA is an open-source User and Entity Behavior Analytics framework for security analytics. |
| Security | Catalyst Center supports FIPS 140-2-compliant cryptography modules, and Cisco recommends deploying it behind a firewall on a private internal network. | The project README says model executions run in isolated Docker containers or Kubernetes jobs, with resource limits to contain misbehaving models. |
Plans
Cisco Catalyst Center
- Cisco DNA AdvantagePriced on request
- Cisco DNA EssentialsPriced on request
In their own words
Cisco Catalyst Center
Cisco Catalyst Center has no write-up on Specifiction yet; its figures are above.
OpenUBA
OpenUBA is a free, open-source User and Entity Behavior Analytics framework for security analytics. It analyzes behavior with machine-learning models to identify anomalies, assign risk scores, and produce classifications. The dashboard covers entity monitoring, risk trends, job orchestration, case management, and real-time behavioral baselines for tracking 10,000+ users. Data ingestion supports Spark, Elasticsearch, and CSV, and the project describes the platform as SIEM agnostic. Rule Studio provides a visual flow-graph builder for detection logic, while matching rules can trigger real-time alerts. Cases can be triaged, escalated, and resolved in built-in workflows. Models use a model.yaml configuration and MODEL.py interface with train() and infer() methods; examples use scikit-learn, TensorFlow, PyTorch, Keras, and NetworkX. A Kubernetes-native operator runs jobs in ephemeral containers, with GraphQL logs and monitoring. Deployment is self-hosted on Kind or production Kubernetes clusters.