ObservabilityOS vs OpenUBA

ObservabilityOS collects structured logs and supports observability workflows across logs, metrics, and traces. It uses rolling statistical Z-score baselines to flag changes in error rates, latency, and CPU usage, then can use GPT-4 or Claude for incident analysis that describes what happened, why, and a suggested hotfix. Log collection options include a JavaScript/TypeScript SDK and a Docker sidecar for local logs or container output. The ingestion API supports native OTLP HTTP/JSON for existing collectors. Listed integrations include OpenTelemetry, GitHub, Slack, Discord, Microsoft Teams, Docker, Kubernetes, PostgreSQL, and Redis. Incident tools include threaded comments, runbooks, health dashboards, SLOs, and live SSE monitoring. The maker says telemetry is scrubbed before storage and sensitive client data is not sent to external LLMs. Plans include a free developer option, a free source-available self-hosted option, and Pro Cloud at $29/mo. The developer plan allows one service, 500MB of logs monthly, and seven-day retention; Pro Cloud lists 10 services, 10GB monthly, and 30-day retention.

OpenUBA is a free, open-source User and Entity Behavior Analytics framework for security analytics. It analyzes behavior with machine-learning models to identify anomalies, assign risk scores, and produce classifications. The dashboard covers entity monitoring, risk trends, job orchestration, case management, and real-time behavioral baselines for tracking 10,000+ users. Data ingestion supports Spark, Elasticsearch, and CSV, and the project describes the platform as SIEM agnostic. Rule Studio provides a visual flow-graph builder for detection logic, while matching rules can trigger real-time alerts. Cases can be triaged, escalated, and resolved in built-in workflows. Models use a model.yaml configuration and MODEL.py interface with train() and infer() methods; examples use scikit-learn, TensorFlow, PyTorch, Keras, and NetworkX. A Kubernetes-native operator runs jobs in ephemeral containers, with GraphQL logs and monitoring. Deployment is self-hosted on Kind or production Kubernetes clusters.