GACWR/OpenUBA

A robust, and flexible open source User & Entity Behavior Analytics (UEBA) framework used for Security Analytics. Developed with luv by Data Scientists & Security Analysts from the Cyber Security Industry. [BETA]

What it solves

OpenUBA is an open-source User and Entity Behavior Analytics (UEBA) framework designed for security analytics. It addresses the "black box" problem common in proprietary UEBA platforms by providing a "white-box" approach where security models are transparent, inspectable, and auditable, allowing analysts to understand exactly how anomalies and risk scores are generated.

How it works

The platform is a Kubernetes-native system that uses a modular architecture to run security models in isolated Docker containers or Kubernetes Jobs. It employs a custom Kubernetes operator to manage ephemeral training and inference runs, ensuring that no long-lived per-model services are required.

Key components include:

  • Model Library & Marketplace: A pluggable system for installing security models from GitHub, the official OpenUBA Hub, or local filesystems.
  • Rule Engine: A visual flow-based canvas where analysts can chain model outputs with logical operators to create complex detection logic without writing code.
  • Execution Plane: Framework-agnostic runners that support scikit-learn, PyTorch, TensorFlow, Keras, and NetworkX.
  • Workspaces: Managed JupyterLab environments connected via a Python SDK for programmatic model registration and visualization.

Who it’s for

It is built for security analysts and data scientists who require transparency in their behavior analytics models for compliance, investigation, and decision-making, as well as those who want a community-driven marketplace for security models.

Highlights

  • Transparent Modeling: Every model is inspectable and auditable, avoiding proprietary "black box" algorithms.
  • Visual Rule Builder: A node-based editor for creating detection circuits and triggering alerts.
  • Isolated Execution: Models run in ephemeral K8s Jobs for security, reliability, and scalability.
  • Multi-Framework Support: Native support for major ML frameworks like PyTorch, TensorFlow and scikit-learn.
  • Integrated LLM Assistant: A context-aware chat overlay supporting Ollama, OpenAI, Claude, and Gemini for analysis.
  • Managed Workspaces: Integrated JupyterLab pods with a dedicated Python SDK for seamless model development.

Related

  • Project
    berylliumsec/nebula

    An AI-powered penetration testing workbench that integrates security tools, AI assistance, and isolated execution environments into a single auditable workspace.

  • Project
    interpretml/interpret

    An open-source framework that provides both inherently interpretable glassbox models and tools to explain complex blackbox machine learning systems.

  • Project
    ttguy0707/CyberClaw

    A LangGraph-based general-purpose AI agent framework that implements a secure two-phase skill execution protocol and sub-agent delegation for observable and extensible workflows.

  • Project
    huggingface/lerobot

    A PyTorch-based library for real-world robotics that provides standardized interfaces for hardware control, scalable dataset formats, and state-of-the-art AI policies.

  • Project
    qiantongtech/qData

    An open-source data middle platform for enterprise data governance and development, featuring ETL, metadata management, and AI-powered Text2SQL data Q&A.