One Stop Anomaly Shop

One Stop Anomaly Shop (OSAS) is Adobe’s open-source toolkit for detecting anomalies in security-related data about running processes. Released under the Apache 2.0 license and holding more than 150 stars on GitHub, it packages the methods from Adobe’s published research into a runnable, Docker-based system.

Overview

OSAS works in two phases. First, a pre-labeling stage enriches raw process data using statistics, natural language processing and static rules, turning noisy telemetry into data that carries useful security context. Second, an anomaly-scoring stage applies supervised and unsupervised machine learning to rank events, surfacing the processes that look genuinely suspicious instead of merely unusual. The system is distributed as a Docker image that bundles the whole stack: you mount a folder containing your own CSV dataset, start the container, and explore results through a Kibana front end, while a JupyterLab console gives analysts direct access to the OSAS command-line tools to configure, train and run their own pipelines. The underlying methods were presented at the HITB Security Conference 2021 in Amsterdam and described in a SciTePress paper, and the repository was still receiving updates in late 2025.

Key Features

• Two-phase detection – statistical and NLP pre-labeling feeds machine-learning anomaly scoring for a stronger signal.
• Security-focused – designed for data about running processes, aimed at threat and anomaly hunting.
• Supervised and unsupervised models – combine labeled training with unsupervised discovery of outliers.
• Kibana dashboards – explore enriched data and anomaly scores in a familiar web interface.
• JupyterLab console – a full analyst workbench for building, training and running custom pipelines.
• Bring your own data – mount any CSV dataset and apply the pipeline to your own environment.
• Docker deployment – use the prebuilt image or build from source, with the full stack in one container.

💳 Pricing

OSAS is free and open source under the Apache 2.0 license. There are no paid tiers and no hosted version — you run the Docker image on your own infrastructure.

Who Is It For

It is for security analysts, detection engineers and data scientists who want a research-grade starting point for anomaly detection on process telemetry, and who are comfortable tuning machine learning pipelines in Python.