OpenUBA vs PyOD

OpenUBA is a free, open-source User and Entity Behavior Analytics framework for security analytics. It analyzes behavior with machine-learning models to identify anomalies, assign risk scores, and produce classifications. The dashboard covers entity monitoring, risk trends, job orchestration, case management, and real-time behavioral baselines for tracking 10,000+ users. Data ingestion supports Spark, Elasticsearch, and CSV, and the project describes the platform as SIEM agnostic. Rule Studio provides a visual flow-graph builder for detection logic, while matching rules can trigger real-time alerts. Cases can be triaged, escalated, and resolved in built-in workflows. Models use a model.yaml configuration and MODEL.py interface with train() and infer() methods; examples use scikit-learn, TensorFlow, PyTorch, Keras, and NetworkX. A Kubernetes-native operator runs jobs in ephemeral containers, with GraphQL logs and monitoring. Deployment is self-hosted on Kind or production Kubernetes clusters.

PyOD is a free Python library for anomaly detection, with documented detectors for tabular, time-series, graph, text, image, and audio data. Its documentation lists 61 detectors available through a common API. Users can work with the classic detector API or ADEngine, which profiles data, selects benchmark-backed detectors, runs multiple detectors in parallel, computes consensus scores, and reports diagnostics. ADEngine also works as a standalone Python API without an LLM. PyOD includes an agentic investigation workflow and activation paths for Claude Code, Codex, and MCP-compatible agents, including an od-expert skill and optional MCP server. Installation is available through pip, conda-forge, or source, and requires Python 3.9 or higher. Optional pip extras enable capabilities including PyTorch, graph detectors, embeddings, audio, and MCP support. The project serves academic research and commercial products. Its model persistence guidance warns that pickle and joblib can execute arbitrary Python code during deserialization, requiring callers to pass trusted=True when loading artifacts. ADEngine describes its quality verdict as a heuristic rather than a guarantee and recommends validation against held-out labels or domain review.