ueba 开源项目推荐（72 个）

GACWR /OpenUBA

A robust, and flexible open source User & Entity Behavior Analytics (UEBA) framework used for Security Analytics. Developed with luv by Data Scientists & Security Analysts from the Cyber Security Industry. [BETA]

Egida-Kassandra /kassandra

Analysis of HTTP traffic and detection of anomalous user behavior in allowed actions. UEBA system.

iam-joel-j /pentastic-ueba

Pentastic is a UEBA-based insider threat detection system that uses behavioral analysis, risk scoring, and deception techniques to detect and prevent malicious user activity in real time.

DjGorillaz /anomaly-detection-and-monitoring

Anomaly detection and monitoring software

Palo-Cortex /soc-optimization

Outlines a scalable SOC optimization approach tailored for Palo Alto Networks Cortex XSIAM.

ait-aecid /clue-lds

This repository contains scripts to carry out anomaly detection in the CLUE log data set.

GACWR /ouba-paper

Working white paper for OpenUBA

AmanJ4588 /insider_threat_detection_ai

An end-to-end AI system for detecting insider threats using a hybrid machine learning approach (Isolation Forest + XGBoost). Features a high-performance ETL pipeline using DuckDB, real-time inference via FastAPI, and integrated Explainable AI (SHAP) for transparent risk assessment on the CERT R4.2 dataset.

m61a /threatlens

🧠 Open-source UEBA that catches insider threats — behavioral baselines, ML anomaly detection & MITRE ATT&CK mapping. No enterprise license needed.

ishandutta2007 /Awesome-User-n-Entity-Behavior-Analytics

该项目在 GitHub 上没有填写描述

GACWR /openuba-model-hub

frontend, model registry, model search, and model marketplace for OpenUBA

Kxrma47 /ml-host-anomaly-detection

Reproducible UEBA-style host anomaly detection with autoencoder scoring, calibrated thresholds, and JSONL reports.

Willie-Conway /SENTINEL

SENTINEL is an immersive insider threat detection and training platform designed for security analysts, SOC teams, and IT professionals. Featuring a fully simulated UEBA (User and Entity Behavior Analytics) environment, interactive threat simulations, and comprehensive indicators of compromise (IOCs) library🔒👨🏿‍💻.

bootaeng /Pnu_Cse_2025_Capstone_KGL

🥇 2025 PNU 캡스톤디자인 금상·인기상 — 모바일 엔드포인트 행동 분석 기반 Policy Engine (UEBA · Zero Trust NAC)

rijal028 /Cognitive-Sentinel-Protocol

A digital immune system designed to detect and neutralize identity-based threats from within an organization

owlsecx /OShield

Login behavior anomaly engine (UEBA) using temporal, geo, velocity and device signals.

rijal028 /Fortress-File-Architecture

A conceptual architecture designed to make file-based malware attacks fundamentally impossible

xulex /affect-telemetry

Repurposing cybersecurity UEBA telemetry to sense affect and protect Flow in knowledge work — methodological contribution of a master's thesis (no participant data).

pranayesse /fabguard

AI-aware DLP engine for semiconductor IP — multi-signal detection (regex, exact data match, document fingerprinting, ML classifier) fused by a policy engine into tiered responses, plus GenAI prompt guardrails and behavioral insider-risk analytics. Pure Python, zero dependencies.

hentorp /garmr

Self-hosted application-audit, insider-risk, and agentic security-monitoring platform written in Rust.