OpenUBA (Open User Behavior Analytics)

A robust, and flexible open source User & Entity Behavior Analytics (UEBA) framework used for Security Analytics. Developed with luv by Data Scientists & Security Analysts from the Cyber Security Industry.

This project is a work in progress and in a pre-alpha state; input and contributions are warmly welcome

Status Type	Status
Master Build
Development Build
Issues
Closed Issues
Last Commit
UI Docker Stars
UI Docker Pulls
UI Docker Automated
UI Docker Build
Server Docker Stars
Server Docker Pulls
Server Docker Automated
Server Docker Build
License
Releases
Latest Release
Top Language
Code Size
Chat

Architecture

Goals

To Build a lightweight, SIEM Agnostic, UEBA Framework focused on providing:

• Modeling
  • Model Management
  • Community-driven Model Library
  • Model Version Control
  • Ready-to-use model modules
  • Feedback Loop for continuous model training
  • "Shadow Mode" for model and risk score experimentation
  • Simple model configuration workflow
• Dashboard
  • Modern stack
  • Modular components
  • Live updating
• Features
  • Rule Storage/Management
  • Case Management
  • Peer-oriented/community intel
  • Lightweight, SIEM-agnostic architecture
  • Flexible/open dataset support
  • Alerting/Ticketing system

Stack

• Client Dashboard
  • React
  • Bootstrap
  • Node JS
  • Express JS
  • D3.js
• Model Server (Remote or Local)
• API Server
  • Flask
• Visualization
  • Data Shader
  • Kibana
  • Matplotlib
  • NetworkX
• Modeling
  • Tensorflow
  • Scikit Learn
  • Keras
  • GP Learn
  • DEAP
  • Graphx
  • MLlib
• Compute Engine
  • Spark
  • Elastic Search
• Supported Data Formats (for now)
  • CSV
  • Parquet
  • Flat File

User Interface (placeholder, UI being updated now)

The interface is meant to observe system events, and anomalies

Views

• Dashboard (index)
• Anomalies
• Cases
• Modeling
• Settings

Installation/Usage

Go to INSTALL.md

Get the updated code & documentation on XS code here

Our main development, and documentation branches are first pushed to our sponsorship repository, and then eventually pushed to our public free repository. To obtain the most updated code, and documentation for OpenUBA, subscribe to our XS Code repository.

Discord (Main Server, and Dev Chat)

Discord Server: https://discord.gg/Ps9p9Wy

Telegram (Backup server, other communications)

Telegram: https://t.me/GACWR