OpenUBA

5.7easy start · #16 of 19
in Anomaly Detection Software

Free to practise onnot on record
Free trialnot on record
Well documentednot on record
Runs where you worknot on record

Runs on api, self-hosted, Web.

Visit site Alternatives

OpenUBA is ranked #16 of 19 in anomaly detection software on The Geeks Club. It runs on API, Self-hosted, Web.

Compared on anomaly detection software

Detection method: hybrid
Real-time detection: Yes
Supported data: Elasticsearch, Apache Spark, CSV
Deployment options: self-hosted

Best OpenUBA alternatives

See all 18

Metaplane 0 of 4 in the starter kit Lesson 17.6 OpenSearch 0 of 4 in the starter kit Lesson 27.2 Anomalib 0 of 4 in the starter kit Lesson 37.1 ManageEngine NetFlow Analyzer 0 of 4 in the starter kit Lesson 47.1 ObservabilityOS 0 of 4 in the starter kit Lesson 57.1 PyOD 0 of 4 in the starter kit Lesson 67.1

The record

Purpose: OpenUBA is an open-source User and Entity Behavior Analytics framework for security analytics.
Detection: It analyzes behavior with machine-learning models to identify anomalies and produce risk scores and classifications.
Dashboard: The dashboard includes entity monitoring, risk trending, job orchestration, and case management.
Data sources: The site lists Spark, Elasticsearch, and CSV as data sources.
Model standard: Models use a standard manifest and Python interface with train() and infer() methods.
Model options: The model hub lists examples using scikit-learn, TensorFlow, PyTorch, Keras, and NetworkX.
Rules and alerts: A visual flow-graph rule builder creates detection logic, and matching rules can trigger real-time alerts.
Access control: The site describes fine-grained role-based access control and permission-based navigation.
Orchestration: OpenUBA uses a Kubernetes-native operator and ephemeral containers for model training and inference jobs.
Job monitoring: Training and inference jobs expose real-time logs and monitoring through GraphQL subscriptions.
AI assistant: The built-in LLM assistant is described as helping users get insights and automate investigation workflows.
Security: The project README says model executions run in isolated Docker containers or Kubernetes jobs, with resource limits to contain misbehaving models.
Deployment: The README describes the platform as Kubernetes-native and says it can be deployed to a Kind development cluster or a production Kubernetes cluster.
Support and community: The site links to GitHub and Discord and invites users to contribute models and integrations.

Where it ranks on The Geeks Club

Best Anomaly Detection Software in 2026#16 of 19

Is OpenUBA yours?

Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.

Claim it free Promote OpenUBA

Sources

openuba.org· checked 5 Oct 2026
openuba.org/models· checked 5 Oct 2026
github.com/GACWR/OpenUBA· checked 5 Oct 2026