ueba

A robust, and flexible open source User & Entity Behavior Analytics (UEBA) framework used for Security Analytics. Developed with luv by Data Scientists & Security Analysts from the Cyber Security Industry. [BETA]

Analysis of HTTP traffic and detection of anomalous user behavior in allowed actions. UEBA system.

Pentastic is a UEBA-based insider threat detection system that uses behavioral analysis, risk scoring, and deception techniques to detect and prevent malicious user activity in real time.

Anomaly detection and monitoring software

Outlines a scalable SOC optimization approach tailored for Palo Alto Networks Cortex XSIAM.

This repository contains scripts to carry out anomaly detection in the CLUE log data set.

Working white paper for OpenUBA

An end-to-end AI system for detecting insider threats using a hybrid machine learning approach (Isolation Forest + XGBoost). Features a high-performance ETL pipeline using DuckDB, real-time inference via FastAPI, and integrated Explainable AI (SHAP) for transparent risk assessment on the CERT R4.2 dataset.

Top User & Entity Behavior Analytics (UEBA) 🌟 Star if you like it! 🌟

frontend, model registry, model search, and model marketplace for OpenUBA

🧠 Open-source UEBA that catches insider threats — behavioral baselines, ML anomaly detection & MITRE ATT&CK mapping. No enterprise license needed.

SENTINEL is an immersive insider threat detection and training platform designed for security analysts, SOC teams, and IT professionals. Featuring a fully simulated UEBA (User and Entity Behavior Analytics) environment, interactive threat simulations, and comprehensive indicators of compromise (IOCs) library🔒👨🏿‍💻.

A digital immune system designed to detect and neutralize identity-based threats from within an organization

🥇 2025 PNU 캡스톤디자인 금상·인기상 — 모바일 엔드포인트 행동 분석 기반 Policy Engine (UEBA · Zero Trust NAC)

Repurposing cybersecurity UEBA telemetry to sense affect and protect Flow in knowledge work — methodological contribution of a master's thesis (no participant data).

A conceptual architecture designed to make file-based malware attacks fundamentally impossible

Top Insider Risk Management 🌟 Star if you like it! 🌟

Rule-based detection, correlation, and behavioral (UEBA) engine for the Panopticon EDR platform, producing alerts and response recommendations from endpoint telemetry.

AI-aware DLP engine for semiconductor IP — multi-signal detection (regex, exact data match, document fingerprinting, ML classifier) fused by a policy engine into tiered responses, plus GenAI prompt guardrails and behavioral insider-risk analytics. Pure Python, zero dependencies.

Self-hosted application-audit, insider-risk, and agentic security-monitoring platform written in Rust.