DTEX Insider Risk Management vs OpenUBA

DTEX Insider Risk Management helps enterprise security teams examine user behavior and activity around data and AI to identify potential insider-driven breaches. It offers preconfigured and customizable behavior indicators, user baselines, anomaly detection, and risk scoring. Investigations can draw on MITRE ATT&CK-aligned profiling and endpoint telemetry such as event logs, registry changes, and credential usage to examine signs including lateral movement and privilege escalation. Preconfigured DLP patterns flag risky behavior, while data lineage tracks file interactions and changes. A threat-hunting engine supports searches across insider data using an open query language and customizable visualizations. The platform covers users, endpoints, servers, applications, data, and AI activity across Linux, macOS, Windows, and web. DTEX describes pseudonymization that masks personal identifiers and can be reversed for escalated investigations. It reports metadata collection of about 5 MB per user per day, with deployment materials giving a 3–5 MB range. Pricing is available on request.

OpenUBA is a free, open-source framework for user and entity behavior analytics in security analytics. Users can install, train, and run models, track versions and artifacts, and use feedback and shadow modes. Listed model frameworks include scikit-learn, PyTorch, TensorFlow, Keras, NetworkX, and Spark MLlib. A visual flow-based rule builder combines model outputs with logical conditions; alerts can link to anomalies and cases. Data loaders cover local CSV, Elasticsearch, Spark, and aggregated multi-source loading. The project describes a Kubernetes-native architecture, with containerized components for development Kind clusters or production Kubernetes clusters. It provides REST endpoints, a GraphQL API, and a Python SDK for model registration, job submission, and visualization. Access controls listed in the README include JWT authentication, four roles, per-page read and write permissions, and audit logging. Model training and inference use isolated Docker containers or ephemeral Kubernetes Jobs with resource limits. The built-in assistant supports local Ollama and cloud APIs from OpenAI, Claude, and Gemini. The project identifies itself as beta, and its listed release is v0.0.2 as a pre-release.