Welcome to OpenUBA Discussions!

Welcome to OpenUBA Discussions

OpenUBA is an open source User & Entity Behavior Analytics (UEBA) framework built for security teams who want full visibility into how their analytics work — no black boxes.

We're opening Discussions as the primary place for the community to connect around the project. This is where you can:

• Ask questions about deploying OpenUBA, writing custom models, or integrating with your stack (Elasticsearch, Spark, SIEM exports, etc.)
• Share models you've built or are working on — anomaly detectors, risk scorers, graph-based detections, whatever you're experimenting with
• Propose ideas for new features, registry adapters, data loaders, or UI improvements
• Report what's working (or not working) in your environment
• Help others get started

What is OpenUBA?

OpenUBA v0.0.2 is a Kubernetes-native UEBA platform with:

• FastAPI + PostgreSQL backend with auto-generated GraphQL via PostGraphile
• Next.js dashboard with model management, anomaly browsing, case management, a rule builder canvas, and a built-in LLM assistant
• Containerized model execution — models run in isolated containers (sklearn, PyTorch, TensorFlow, NetworkX, Spark) as JIT Kubernetes Jobs, not long-lived services
• Pluggable model registry — discover and install models from the OpenUBA Hub, GitHub repos, or local filesystem
• SIEM-agnostic design — bring your own data from any source

The goal has always been to disrupt the black-box UBA market through the power of the open source scientific computing ecosystem. Every model is inspectable, shareable, and runs in a transparent pipeline you control.

Get involved

Drop a comment below and introduce yourself — what's your background, what brought you to OpenUBA, and what are you hoping to build or solve with it? Whether you're a security analyst, data scientist, ML engineer, or just curious about UEBA, we
want to hear from you.

Repo: https://github.com/GACWR/OpenUBA
Discord: https://discord.gg/Ps9p9Wy