$ show GACWR/OpenUBA
OpenUBA is a full-stack User and Entity Behavior Analytics (UEBA) platform for security anomaly detection, investigation, and response. It provides a complete lifecycle for ML models (install, train, infer, version, share) via a pluggable registry supporting OpenUBA Hub, GitHub, HuggingFace, and local filesystem. The platform includes a rule engine with a visual DAG-based builder (ReactFlow), case management, real-time dashboards, multi-backend visualization (matplotlib, plotly, bokeh, etc.), and an LLM-powered assistant. The backend is built on FastAPI with PostgreSQL, SQLAlchemy, JWT/RBAC authentication, and optional Spark/Elasticsearch integrations. The frontend uses Next.js 14 (App Router), Apollo Client (GraphQL), shadcn/ui, and Recharts. A Python SDK enables programmatic access to all features. The system runs on Kubernetes with a Kopf operator managing custom resources (UBATraining, UBAInference, UBAWorkspace, UBAPipeline) for containerized model execution in isolated Docker images per ML framework (sklearn, PyTorch, TensorFlow, NetworkX). While primarily an application, it includes research-oriented components like experiment tracking, feature store, and Jupyter notebook workspaces, making it a hybrid tool for both security operations and data science workflows.
The LLM identified 4 files worth highlighting for reuse:
Defines the abstract base class for all registry code adapters (BaseRegistryAdapter) and weights adapters (BaseWeightsAdapter). Implements a clean plugin architecture that allows adding new model sources (GitHub, HuggingFace, local FS, OpenUBA Hub) without modifying existing code. The adapters handle listing, downloading, and verifying model integrity. This pattern is directly reusable in any project needing a pluggable resource registry.
Implements an LLM-powered chat service that supports multiple providers (Ollama, OpenAI, Claude, Gemini) with real-time SSE streaming. It dynamically injects system context by querying the database for current anomaly counts, model stats, and page-specific data, enabling context-aware responses. The service abstracts provider details behind a unified interface and handles streaming, error recovery, and token limit management. This component can be extracted and reused in any application needing a customizable, context-aware AI assistant.
A universal chart rendering component that supports nine visualization backends (matplotlib, seaborn, plotly, bokeh, altair, plotnine, datashader, networkx, geopandas). It dynamically loads the required UMD library from a CDN and renders the chart in an iframe or SVG/PNG. Includes download utilities and a fallback mechanism. This component is fully self-contained and can be dropped into any React project to provide flexible, user-configurable chart rendering.
Provides the OpenUBAClient class, a comprehensive Python SDK that wraps all platform REST endpoints (model registration, training/inference jobs, dataset management, visualizations, dashboards, feature store, experiments, pipelines, UBA queries). Handles authentication, session management, caching, error handling, and automatic retries. Uses environment variables for configuration and supports both sync and async operations. This client can be extracted and used as a template for building SDKs for other REST APIs.