OpenUBA
OpenUBA is an open-source framework for security analytics focused on user and entity behavior.
What OpenUBA is
OpenUBA is an open-source framework for security analytics focused on user and entity behavior. It applies machine-learning models to detect anomalies and generate risk scores and classifications. Its dashboard covers entity monitoring, risk trends, job orchestration, and case management, with data ingestion from Spark, Elasticsearch, and CSV. Rule Studio provides a visual flow-graph builder for detection logic, and matching rules can trigger real-time alerts. Case workflows support triage, escalation, and resolution. Models use a shared format with model.yaml configuration and a Python file implementing train() and infer(); examples draw on scikit-learn, TensorFlow, PyTorch, Keras, and NetworkX. A Kubernetes-native operator runs training and inference jobs in ephemeral containers, while GraphQL subscriptions expose logs and monitoring. The project describes isolated model execution with resource limits, and offers a built-in LLM assistant for insights and investigation workflows. It is designed for self-hosted Kubernetes deployments, including Kind development and production clusters. OpenUBA is free and open source, with community links to GitHub and Discord.
Good
- Open-source with no paid plans listed.
- Supports Elasticsearch, Spark, and CSV data.
- Visual rule building can trigger real-time alerts.
- Includes case workflows for triage and escalation.
- Model jobs expose logs and monitoring.
Watch out
- Deployment is self-hosted and Kubernetes-native.
- Listed data sources are limited to three.
- Model execution requires Docker containers or Kubernetes jobs.
Who it suits
It is aimed at security analysts interested in how models work under the hood. It may suit teams seeking self-hosted behavioral analytics with configurable models and rule-based alerts.
Verdict
OpenUBA brings behavioral analytics, rule alerts, and case handling into a self-hosted framework. Its Kubernetes-native deployment and model format are important considerations for prospective users.
The facts
Each one read from OpenUBA's own pages, with the date it was checked.
What it does
- Access control
- The site describes fine-grained role-based access control and permission-based navigation.checked 5 Oct 2026
- AI assistant
- The built-in LLM assistant is described as helping users get insights and automate investigation workflows.checked 5 Oct 2026
- Alerts and cases
- The site describes real-time rule alerts and built-in workflows to triage, escalate, and resolve anomaly cases.checked 5 Oct 2026
- Dashboard
- The dashboard includes entity monitoring, risk trending, job orchestration, and case management.checked 5 Oct 2026
- Data ingestion
- The dashboard supports ingestion from Spark, Elasticsearch, and CSV data sources.checked 5 Oct 2026
- Data sources
- The site lists Spark, Elasticsearch, and CSV as data sources.checked 5 Oct 2026
- Deployment
- The README describes the platform as Kubernetes-native and says it can be deployed to a Kind development cluster or a production Kubernetes cluster.checked 5 Oct 2026
- Detection
- It analyzes behavior with machine-learning models to identify anomalies and produce risk scores and classifications.checked 5 Oct 2026
- Intended users
- The project README describes OpenUBA as designed for security analysts curious about how models work under the hood.checked 5 Oct 2026
- Job monitoring
- Training and inference jobs expose real-time logs and monitoring through GraphQL subscriptions.checked 5 Oct 2026
- Model format
- The Open Model Standard uses a model.yaml configuration and a MODEL.py with train() and infer() methods.checked 5 Oct 2026
- Model library
- Its model library lists implementations based on scikit-learn, TensorFlow, PyTorch, Keras, and NetworkX.checked 5 Oct 2026
- Model options
- The model hub lists examples using scikit-learn, TensorFlow, PyTorch, Keras, and NetworkX.checked 5 Oct 2026
- Model orchestration
- OpenUBA describes a Kubernetes-native operator using custom CRDs and ephemeral containers for training and inference jobs.checked 5 Oct 2026
- Model standard
- Models use a standard manifest and Python interface with train() and infer() methods.checked 5 Oct 2026
- Monitoring
- The dashboard describes real-time risk scoring and behavioral baselines for tracking 10,000+ users.checked 5 Oct 2026
- Orchestration
- OpenUBA uses a Kubernetes-native operator and ephemeral containers for model training and inference jobs.checked 5 Oct 2026
- Pricing
- The site calls OpenUBA fully open source and presents no paid plans or prices.checked 5 Oct 2026
- Publisher
- The site footer credits Georgia Cyber Warfare Range, Inc.checked 5 Oct 2026
- Purpose
- OpenUBA is an open-source User and Entity Behavior Analytics framework for security analytics.checked 5 Oct 2026
- Rule building
- Rule Studio provides a visual flow-graph builder with drag-and-drop nodes for detection logic.checked 5 Oct 2026
- Rules and alerts
- A visual flow-graph rule builder creates detection logic, and matching rules can trigger real-time alerts.checked 5 Oct 2026
- Security
- The project README says model executions run in isolated Docker containers or Kubernetes jobs, with resource limits to contain misbehaving models.checked 5 Oct 2026
- SIEM compatibility
- The site describes OpenUBA as SIEM agnostic.checked 5 Oct 2026
Alternatives to OpenUBA
- 1
Soda
Free planWebAPILinuxSelf-hosted7.5From $750 a month - 2
Anomalib
Free planOpen sourceWebAPILinuxSelf-hosted7.4Free plan - 3
ManageEngine NetFlow Analyzer
Free planAndroidiOSWebLinux7.1From $172 a month - 4
OpenSearch
Free planWebAPILinuxmacOS6.7Free plan - 5
ObservabilityOS
Free planWebAPISelf-hosted6.5From $29 a month - 6
PyOD
Free planAPILinuxmacOSSelf-hosted6.5Free plan