Exabeam New-Scale Analytics vs OpenUBA

Exabeam New-Scale Analytics adds behavioral analytics to an existing SIEM or data lake for security operations teams. It learns behavior baselines and applies dynamic risk scores to identify anomalies by rarity and business context. Coverage includes users, endpoints, servers, applications, and agents, with hybrid anomaly methods and assisted response automation. Agent Behavior Analytics monitors AI agents and automated identities, linking activity with users and devices. Exabeam Nova can gather context, run secondary searches, and assist triage from a sidebar workspace. Attack Surface Insights combines identity and device information into profiles showing attributes, relationships, and risk. Prebuilt integrations cover hundreds of tools, while the Open API Standard connects to thousands more. Supported SIEMs named include Splunk, Microsoft Sentinel, IBM QRadar, OpenText ArcSight, McAfee Nitro, and Sumo Logic. Deployment options listed are API, self-hosted, and web; pricing is available on request.

OpenUBA is a free, open-source framework for user and entity behavior analytics in security analytics. Users can install, train, and run models, track versions and artifacts, and use feedback and shadow modes. Listed model frameworks include scikit-learn, PyTorch, TensorFlow, Keras, NetworkX, and Spark MLlib. A visual flow-based rule builder combines model outputs with logical conditions; alerts can link to anomalies and cases. Data loaders cover local CSV, Elasticsearch, Spark, and aggregated multi-source loading. The project describes a Kubernetes-native architecture, with containerized components for development Kind clusters or production Kubernetes clusters. It provides REST endpoints, a GraphQL API, and a Python SDK for model registration, job submission, and visualization. Access controls listed in the README include JWT authentication, four roles, per-page read and write permissions, and audit logging. Model training and inference use isolated Docker containers or ephemeral Kubernetes Jobs with resource limits. The built-in assistant supports local Ollama and cloud APIs from OpenAI, Claude, and Gemini. The project identifies itself as beta, and its listed release is v0.0.2 as a pre-release.