A robust, and flexible open source User & Entity Behavior Analytics (UEBA) framework used for Security Analytics. Developed with luv by Data Scientists & Security Analysts from the Cyber Security Industry. [BETA]

Go Wind UBA 是一款面向企业的用户行为分析系统，后端基于 Go、go-kratos 构建，深度适配 ClickHouse、Doris 等高性能分析存储引擎。支持多租户隔离、用户事件实时采集、行为模型构建、风险识别与分析、多数据源数据同步，提供多维度数据统计、自定义报表与可视化大屏能力，助力企业快速搭建安全、稳定、高性能的用户行为数据分析平台。

Analysis of HTTP traffic and detection of anomalous user behavior in allowed actions. UEBA system.

Anomaly detection and monitoring software

Outlines a scalable SOC optimization approach tailored for Palo Alto Networks Cortex XSIAM.

This repository contains scripts to carry out anomaly detection in the CLUE log data set.

Working white paper for OpenUBA

Pentastic is a UEBA-based insider threat detection system that uses behavioral analysis, risk scoring, and deception techniques to detect and prevent malicious user activity in real time.

ITDR (Identity Threat Detection and Response) platform with ML-powered anomaly detection, UEBA, risk scoring, and role mining

An end-to-end AI system for detecting insider threats using a hybrid machine learning approach (Isolation Forest + XGBoost). Features a high-performance ETL pipeline using DuckDB, real-time inference via FastAPI, and integrated Explainable AI (SHAP) for transparent risk assessment on the CERT R4.2 dataset.

SENTINEL is an immersive insider threat detection and training platform designed for security analysts, SOC teams, and IT professionals. Featuring a fully simulated UEBA (User and Entity Behavior Analytics) environment, interactive threat simulations, and comprehensive indicators of compromise (IOCs) library🔒👨🏿‍💻.

A digital immune system designed to detect and neutralize identity-based threats from within an organization

frontend, model registry, model search, and model marketplace for OpenUBA

A conceptual architecture designed to make file-based malware attacks fundamentally impossible

Identify attackers by methodology, not IP — behavioral fingerprinting with order-preserving hashes and anomaly detection

Windows UEBA prototype that scores Sysmon events with rolling features and threat intel.

AI-driven cyber incident response system using UEBA and local LLM reasoning.