A robust, and flexible open source User & Entity Behavior Analytics (UEBA) framework used for Security Analytics. Developed with luv by Data Scientists & Security Analysts from the Cyber Security Industry. [BETA]

Analysis of HTTP traffic and detection of anomalous user behavior in allowed actions. UEBA system.

Anomaly detection and monitoring software

Outlines a scalable SOC optimization approach tailored for Palo Alto Networks Cortex XSIAM.

This repository contains scripts to carry out anomaly detection in the CLUE log data set.

Working white paper for OpenUBA

Pentastic is a UEBA-based insider threat detection system that uses behavioral analysis, risk scoring, and deception techniques to detect and prevent malicious user activity in real time.

ITDR (Identity Threat Detection and Response) platform with ML-powered anomaly detection, UEBA, risk scoring, and role mining

An end-to-end AI system for detecting insider threats using a hybrid machine learning approach (Isolation Forest + XGBoost). Features a high-performance ETL pipeline using DuckDB, real-time inference via FastAPI, and integrated Explainable AI (SHAP) for transparent risk assessment on the CERT R4.2 dataset.

frontend, model registry, model search, and model marketplace for OpenUBA

SENTINEL is an immersive insider threat detection and training platform designed for security analysts, SOC teams, and IT professionals. Featuring a fully simulated UEBA (User and Entity Behavior Analytics) environment, interactive threat simulations, and comprehensive indicators of compromise (IOCs) library🔒👨🏿‍💻.

🧠 Open-source UEBA that catches insider threats — behavioral baselines, ML anomaly detection & MITRE ATT&CK mapping. No enterprise license needed.

A digital immune system designed to detect and neutralize identity-based threats from within an organization

Identify attackers by methodology, not IP — behavioral fingerprinting with order-preserving hashes and anomaly detection

Sentinel Prime is a futuristic Sci-Fi cybersecurity dashboard UI kit built with pure HTML, CSS, and JavaScript. A proof-of-concept interface featuring 8 enterprise security modules and zero external dependencies.

A conceptual architecture designed to make file-based malware attacks fundamentally impossible

AI security analytics prototype with FastAPI, behavioral rules, synthetic data, and dashboard concepts.

Insider risk investigation lab with synthetic SQL detections, UEBA-style analysis, timelines, entity correlation, and analyst workflows.

An explainable, enterprise-grade User and Entity Behavior Analytics (UEBA) platform to detect privilege abuse, compromised credentials, and data exfiltration in access logs.

Agentless UEBA tool utilizing local LLMs to detect insider threats and map anomalies to MITRE ATT&CK.