Introduction to nano
Introduction to nano
nano is an AI-powered SIEM for security teams that need fast log analytics.
Whether you're ingesting 2 GB/day on Hobby or running unlimited volume on Enterprise, nano covers the full workflow: detection, alerting, investigation, and response. Events are stored in ClickHouse for fast queries, with pivt AI for parser, query, and detection assistance.
Why nano?
Fast
- Sub-second queries across billions of events using ClickHouse
- Real-time detection with sub-30s latency via materialized views
- High-throughput ingestion with Vector: HTTP, Syslog, HEC, and native Vector protocol
AI-Powered
- pivt AI generates parsers, queries, detection rules, and investigation summaries from natural language
- Auto-tuning reduces false positives by analyzing historical detection matches
- Shadow Investigation autonomously hunts for threats when cases are created
- Multi-provider: Anthropic, OpenAI, and Google, routed through Cloudflare AI Gateway
Query Language
- nPL (nano Pipe Language): piped syntax, e.g.
source_type="cloudtrail" | stats count by user | sort -count - 100+ eval functions, including security-specific ones like
cidrmatch,ispublicip,defang, andentropy - Advanced analytics with timecharts, window functions, and statistical analysis
Security-First
- Risk-based alerting with per-entity risk scoring
- Prevalence tracking: flag rare and first-seen indicators automatically
- MITRE ATT&CK mapping for all detection rules
- Unified Data Model: 505 normalized fields across 26 categories for cross-source correlation
- Case management with AI-powered investigation timelines
Architecture
Key Components
| Component | Technology | Purpose |
|---|---|---|
| Log Collector | Vector | High-performance ingestion, parsing, and routing |
| Log Storage | ClickHouse | Time-series log storage with sub-second analytics |
| Metadata Store | PostgreSQL | Rules, alerts, dashboards, users, configuration |
| API | Rust (Axum) | Management API for rules, alerts, settings, ingestion |
| Search | Rust (Axum) | Query execution, field stats, async jobs |
| Frontend | React | Web interface with lazy-loaded components |
| AI Assistant | pivt (via Cloudflare AI Gateway) | Parser creation, query building, detection tuning, investigation |
| Marketplace | Built-in | Enrichments, threat intel feeds, and community integrations |
Deployment Options
nano deploys as a managed service or into your own cloud (BYOC):
| Tier | Capacity | Infrastructure |
|---|---|---|
| Hobby / Startup | 2-5 GB/day | Single VPS (Docker Compose) |
| Growth | 10 GB/day | Kubernetes (single pool) |
| Team / Business | 25-50 GB/day | Kubernetes with HA |
| Pro | 100 GB/day | Multi-pool Kubernetes |
| Enterprise | Unlimited | ClickHouse Cloud + managed PostgreSQL |
See Deployment Architecture for full details on each tier.
Get Started
- Set Up Your First Feed: import a pre-built parser or create one with the AI wizard
- Search Your Data: learn nPL to hunt through your logs
- Create Detection Rules: automate threat detection
- Configure pivt AI: set up providers, models, and organizational guidance
- Deploy On-Prem Collection: collect Windows, Linux, and network logs