Smiley 1.0 – Release Announcement

GallowGlass AI, the enterprise AI solutions provider focused on process automation, data governance, and compliance with emerging AI regulations, today announces the release of Smiley 1.0, an open-source User and Entity Behavior Analytics (UEBA) platform. Smiley processes login events, establishes per-user behavioral baselines, and generates explainable anomaly scores so security teams can triage identity risk without opaque black-box scoring.

"The more identities a man has, the more they express the person they conceal."

— John le Carré

Built for SOC analysts, detection engineers, and security researchers

Smiley ingests login events — synthetic or real — learns each user's typical hours, geographies, and devices, and surfaces outliers through an explainable risk score with clearly labeled drivers, not an unexplained number. A case desk lets analysts review high-risk identities, ask "what changed?", mark false positives that feed back into the next scoring cycle, and export a case pack with evidence and recommendations. Graph-based investigation via Memgraph reveals shared-device and peer-group relationships that a flat event log would miss.

Key capabilities

• Baseline learning — Per-user models of typical hours, geos, and devices.
• Explainable anomaly scoring — Weighted, labeled risk drivers instead of an opaque score.
• Detection signals — Off-hours login, new geo / impossible travel, unrecognized device, failure burst then success, privilege change, and shared device/IP/peer group via Memgraph.
• Case Desk — Investigate high-risk identities and drill into "what changed?"
• Assist chat — Optional, local LLM-grounded narration of case evidence (llama.cpp or Ollama) — scoring itself stays rule-based.
• False-positive feedback loop — Analyst suppressions feed back into the next worker cycle.
• Case pack export — Markdown export with risk drivers, next checks, and timeline.
• Connectors — Okta fixture ingest ready today; Microsoft Entra ID and Google Workspace stubs planned.

Local-first by design

Smiley runs on your own infrastructure: PostgreSQL as the system of record, Memgraph for entity-relationship investigation, and an independent worker loop for baseline and scoring. Assist chat, when enabled, reaches local LLM daemons (Ollama or llama.cpp) on the host rather than a third-party API — no login or authentication data leaves your environment.

Stack

• Backend: Python 3.12+, FastAPI
• Data: PostgreSQL, Memgraph (Bolt / Cypher)
• AI: Ollama and/or llama.cpp on the host (optional, for Assist chat only)
• Frontend: React, Vite, Tailwind CSS
• Deployment: Docker Compose

Get started

Repository: github.com/byronichero/smiley

git clone https://github.com/byronichero/smiley.git
cd smiley
cp .env.example .env
docker compose up --build

On first boot the API auto-seeds a synthetic corpus. UI: http://localhost:8501 · API docs: http://localhost:8000/docs. See the repository README and docs/LAB_UEBA.md for configuration and connector setup.

Smiley's name honors George Smiley and author John le Carré; the maintainer claims no copyright, trademark, or other ownership in the name or le Carré's works (see the repository's TRADEMARK file). The codebase itself is Apache License 2.0.

Contact: ppk@gallowglass.ai