PyOD is a comprehensive Python library for anomaly/outlier detection offering 60+ detectors across tabular, time series, graph, text, image, and audio modalities. It provides a classic scikit-learn-compatible API (fit/predict/decision_function) via pyod.models, a high-level orchestration engine (ADEngine) for automatic profiling, detector selection, consensus scoring, and reporting, and an agentic workflow layer for LLM-driven anomaly detection through CLI, MCP server, and packaged AI skills. The library is primarily a software library (application) with strong data research influence: it comes with benchmark-backed routing rules, academic references, and Jupyter notebooks for research reprocibility. Its architecture follows a three-layer design (classic detectors, ADEngine orchestration, agentic skills) that allows progressive engagement from simple model fitting to full automated pipelines.
OpenUBA is a full-stack User and Entity Behavior Analytics (UEBA) platform for security anomaly detection, investigation, and response. It provides a complete lifecycle for ML models (install, train, infer, version, share) via a pluggable registry supporting OpenUBA Hub, GitHub, HuggingFace, and local filesystem. The platform includes a rule engine with a visual DAG-based builder (ReactFlow), case management, real-time dashboards, multi-backend visualization (matplotlib, plotly, bokeh, etc.), and an LLM-powered assistant. The backend is built on FastAPI with PostgreSQL, SQLAlchemy, JWT/RBAC authentication, and optional Spark/Elasticsearch integrations. The frontend uses Next.js 14 (App Router), Apollo Client (GraphQL), shadcn/ui, and Recharts. A Python SDK enables programmatic access to all features. The system runs on Kubernetes with a Kopf operator managing custom resources (UBATraining, UBAInference, UBAWorkspace, UBAPipeline) for containerized model execution in isolated Docker images per ML framework (sklearn, PyTorch, TensorFlow, NetworkX). While primarily an application, it includes research-oriented components like experiment tracking, feature store, and Jupyter notebook workspaces, making it a hybrid tool for both security operations and data science workflows.