OpenUBA

Free plan APISelf-hostedWeb

What OpenUBA is

OpenUBA is an open-source framework for security analytics focused on user and entity behavior. It uses machine-learning models to detect anomalies and assign risk scores and classifications. Its dashboard brings together entity monitoring, risk trends, job orchestration, and case management, with behavioral baselines and real-time risk scoring for tracking 10,000+ users. Data ingestion supports Elasticsearch, Apache Spark, and CSV, and OpenUBA is described as SIEM agnostic.

Analysts can build detection logic in Rule Studio, using a visual flow graph with drag-and-drop nodes. Rules can trigger real-time alerts, while case workflows support triage, escalation, and resolution. Models use an open format made up of a model.yaml configuration and a MODEL.py file with train() and infer() methods. The model library includes examples based on scikit-learn, TensorFlow, PyTorch, Keras, and NetworkX.

A Kubernetes-native operator runs training and inference jobs in ephemeral containers. GraphQL subscriptions provide real-time job logs and monitoring. Model executions run in isolated Docker containers or Kubernetes jobs with resource limits. OpenUBA also includes an LLM assistant for insights and investigation workflows. The project is free and open source, and supports self-hosted deployment to a Kind development cluster or a production Kubernetes cluster.

Who it suits

OpenUBA suits security analysts who want to examine user and entity behavior and work with how detection models operate. It may also suit teams seeking self-hosted, SIEM-agnostic analytics with visual rule building and case workflows.

What it does well

Detects anomalies and assigns risk scores with machine-learning models.
Ingests data from Elasticsearch, Apache Spark, and CSV.
Visual rule builder can trigger real-time alerts.
Includes workflows to triage, escalate, and resolve cases.
Open model format supports multiple listed model libraries.
Free and open source.

What to know first

Deployment is self-hosted and Kubernetes-native.
Models use a defined Python interface and manifest format.

Limits

The listed deployment options are self-hosted and Kubernetes-based. OpenUBA is free and open source; no paid plans are presented.

Getting started

Visit the OpenUBA website.
Choose a Kind development cluster or production Kubernetes cluster for deployment.
Connect data from Elasticsearch, Apache Spark, or CSV.
Use the model.yaml and MODEL.py format with train() and infer() methods for models.
Build detection logic in Rule Studio and use the dashboard to monitor entities, jobs, alerts, and cases.

Verdict

Choose OpenUBA if you want a free, open-source framework for behavior analytics, with configurable models, alert rules, and case workflows. Its self-hosted, Kubernetes-native deployment makes it a better fit for teams prepared to run that environment.

Questions

Is OpenUBA free?

Yes. OpenUBA is described as fully open source and free, with no paid plans or prices presented.

Which data sources does it support?

The listed sources are Elasticsearch, Apache Spark, and CSV.

How are models structured?

Models use a model.yaml configuration and a MODEL.py file with train() and infer() methods.

Can OpenUBA send real-time alerts?

Yes. Rules built with its visual flow-graph builder can trigger real-time alerts.

How can OpenUBA be deployed?

It is self-hosted and Kubernetes-native, with deployment described for a Kind development cluster or a production Kubernetes cluster.

Who publishes OpenUBA?

The site footer credits Georgia Cyber Warfare Range, Inc.

Facts from OpenUBA's own pages

Access control: The site describes fine-grained role-based access control and permission-based navigation. · openuba.org, 5 Oct 2026
AI assistant: The built-in LLM assistant is described as helping users get insights and automate investigation workflows. · openuba.org, 5 Oct 2026
Alerts and cases: The site describes real-time rule alerts and built-in workflows to triage, escalate, and resolve anomaly cases. · openuba.org, 5 Oct 2026
Dashboard: The dashboard includes entity monitoring, risk trending, job orchestration, and case management. · openuba.org, 5 Oct 2026
Data ingestion: The dashboard supports ingestion from Spark, Elasticsearch, and CSV data sources. · openuba.org, 5 Oct 2026
Data sources: The site lists Spark, Elasticsearch, and CSV as data sources. · openuba.org, 5 Oct 2026
Deployment: The README describes the platform as Kubernetes-native and says it can be deployed to a Kind development cluster or a production Kubernetes cluster. · github.com, 5 Oct 2026
Detection: It analyzes behavior with machine-learning models to identify anomalies and produce risk scores and classifications. · openuba.org, 5 Oct 2026
Intended users: The project README describes OpenUBA as designed for security analysts curious about how models work under the hood. · github.com, 5 Oct 2026
Job monitoring: Training and inference jobs expose real-time logs and monitoring through GraphQL subscriptions. · openuba.org, 5 Oct 2026
Model format: The Open Model Standard uses a model.yaml configuration and a MODEL.py with train() and infer() methods. · openuba.org, 5 Oct 2026
Model library: Its model library lists implementations based on scikit-learn, TensorFlow, PyTorch, Keras, and NetworkX. · openuba.org, 5 Oct 2026
Model options: The model hub lists examples using scikit-learn, TensorFlow, PyTorch, Keras, and NetworkX. · openuba.org, 5 Oct 2026
Model orchestration: OpenUBA describes a Kubernetes-native operator using custom CRDs and ephemeral containers for training and inference jobs. · openuba.org, 5 Oct 2026
Model standard: Models use a standard manifest and Python interface with train() and infer() methods. · openuba.org, 5 Oct 2026
Monitoring: The dashboard describes real-time risk scoring and behavioral baselines for tracking 10,000+ users. · openuba.org, 5 Oct 2026
Orchestration: OpenUBA uses a Kubernetes-native operator and ephemeral containers for model training and inference jobs. · openuba.org, 5 Oct 2026
Pricing: The site calls OpenUBA fully open source and presents no paid plans or prices. · openuba.org, 5 Oct 2026
Publisher: The site footer credits Georgia Cyber Warfare Range, Inc. · openuba.org, 5 Oct 2026
Purpose: OpenUBA is an open-source User and Entity Behavior Analytics framework for security analytics. · openuba.org, 5 Oct 2026
Rule building: Rule Studio provides a visual flow-graph builder with drag-and-drop nodes for detection logic. · openuba.org, 5 Oct 2026
Rules and alerts: A visual flow-graph rule builder creates detection logic, and matching rules can trigger real-time alerts. · openuba.org, 5 Oct 2026
Security: The project README says model executions run in isolated Docker containers or Kubernetes jobs, with resource limits to contain misbehaving models. · github.com, 5 Oct 2026
SIEM compatibility: The site describes OpenUBA as SIEM agnostic. · openuba.org, 5 Oct 2026

Where OpenUBA stands on Freedom251

Anomaly Detection Software#10 of 22