No. 11 of 19 ·Anomaly Detection Software

OpenUBA

Web · Self-hosted · API

Visit site Alternatives

Freedom report

One barScore 5.5

Free tierNo free tier on record
Open codeNo open-source code on record
Runs widely1 of 6 device platforms
DocumentedPlans, terms and facts published

OpenUBA is ranked #11 of 19 in anomaly detection software on Freedom251. It runs on API, Self-hosted, Web.

Compared on anomaly detection software

Detection method: hybrid
Real-time detection: Yes
Supported data: Elasticsearch, Apache Spark, CSV
Deployment options: self-hosted

Best OpenUBA alternatives

See all 18

Two bars ManageEngine NetFlow Analyzer Free tier No. 1$172/mo6.6 Two bars OpenSearch Free tier No. 2Free6.6 Two bars PyOD Free tier No. 3Free6.6 Two bars Anomalib Free tier No. 4Free6.5 Two bars PySAD Free tier No. 5Free6.5 One bar Soda Free tier No. 6$750/mo6.5

The record

Purpose: OpenUBA is an open-source User and Entity Behavior Analytics framework for security analytics.
Detection: It analyzes behavior with machine-learning models to identify anomalies and produce risk scores and classifications.
Dashboard: The dashboard includes entity monitoring, risk trending, job orchestration, and case management.
Data sources: The site lists Spark, Elasticsearch, and CSV as data sources.
Model standard: Models use a standard manifest and Python interface with train() and infer() methods.
Model options: The model hub lists examples using scikit-learn, TensorFlow, PyTorch, Keras, and NetworkX.
Rules and alerts: A visual flow-graph rule builder creates detection logic, and matching rules can trigger real-time alerts.
Access control: The site describes fine-grained role-based access control and permission-based navigation.
Orchestration: OpenUBA uses a Kubernetes-native operator and ephemeral containers for model training and inference jobs.
Job monitoring: Training and inference jobs expose real-time logs and monitoring through GraphQL subscriptions.
AI assistant: The built-in LLM assistant is described as helping users get insights and automate investigation workflows.
Security: The project README says model executions run in isolated Docker containers or Kubernetes jobs, with resource limits to contain misbehaving models.
Deployment: The README describes the platform as Kubernetes-native and says it can be deployed to a Kind development cluster or a production Kubernetes cluster.
Support and community: The site links to GitHub and Discord and invites users to contribute models and integrations.

Where it ranks on Freedom251

Best Anomaly Detection Software in 2026#11 of 19

Is OpenUBA yours?

Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.

Claim it free Promote OpenUBA

Sources

openuba.org· checked 5 Oct 2026
openuba.org/models· checked 5 Oct 2026
github.com/GACWR/OpenUBA· checked 5 Oct 2026