Open-core engine in Rust. Sub-second search over billions of events. AI woven through every surface. And settings deep enough to make it actually yours.
Rust at the core, ClickHouse for storage, Vector for ingest. No JVM warmups, no garbage-collection pauses, no surprise memory limits. The whole stack picked for one job, which is getting your team to an answer.
The engine, the detection rules, the parsers, the docs. All in the open. The platform you can audit, fork, and self-host, managed cloud is for convenience, not control.
Pipe-based, left-to-right. Familiar if you've used Splunk. Stricter, faster, and the autocomplete actually knows your schema.
1source_type=auth action=login status=failure
2| stats count as attempts by src_ip, user
3| where attempts > 10
4| sort -attempts
5...1source_type=proxy earliest=-7d
2| prevalence window=7d enrich=true
3| where host_count < 3 AND is_rare=true
4| table dest_host, first_seen, host_count
5...1source_type=sysmon action=process_create
2| tree process root="*powershell*"
3| prevalence enrich=true
4| where depth > 3
5...1source_type=proxy
2| bin span=10m
3| stats count by dest_host, _time
4| streamstats window=6 stdev(count) as jitter by dest_host
5...YAML frontmatter for metadata, pipe-language for the actual hunt. MITRE mapping, risk scoring, and prevalence enrichment are first-class, not glued on with a script.
1---
2title: regular_beacon_interval_detection
3severity: high
4mode: staging
5schedule: "*/10 * * * *"
6mitre_tactics: TA0011
7mitre_techniques: T1095
8---
9source_type = squid_proxy
10| where dest_ip != /^(10\.|192\.168\.)/
11| stats count, dc(timestamp) as unique_times by src_host, dest_ip
12| where count > 20 AND unique_times > 15
13| prevalence enrich=true window=30d
14| risk score=70 entity=src_host factor="Regular beacon pattern"
15| table timestamp, src_host, dest_ip, count, host_count, risk_scoreCases bundle the alert, the evidence, the timeline, and the analyst's notes in one place. Notebooks for ad-hoc hunting. Process trees and identity resolution for the messy parts.
pivt, nano's AI assistant, is woven into every surface. Triage alerts, build parsers, follow playbooks, draft case notes. Configurable, auditable, and never the one closing the ticket without you.
Define steps in YAML. pivt runs them on every alert: pull EDR context, check threat intel, query identity, draft a summary. Stop a step for human approval whenever you want.
Drop a sample log, get a working parser. pivt reads the format, writes the grok, validates against your data. The 80% case in two minutes, not two days.
Write incident response runbooks once. pivt executes them on the right alerts, asking for human confirmation on the steps that need it. Auditable trail of every action.
IPs enriched with GeoIP and ASN. Domains checked against threat intel. Hashes matched to known malware. All automatic, all on ingest. And when our defaults aren't enough, you ship a custom enrichment in a few lines.
1,200+ parsers, detection rules, dashboards, and enrichments. Curated, versioned, one-click install. Or fork them and make them yours.
Full traffic, threat, and config log parsing for PAN-OS 10+ firewalls. 47 source types.
78 nPL detections mapped to the Atomic Red Team library. MITRE-tagged and tested.
Open cases, fresh detections, top entities by risk, fleet health. The default Tier-1 view.
Drop-in VT integration. Caching, rate-limit handling, free-tier friendly defaults.
14-step incident response playbook for email-based phishing. Quarantine, notify, document.
AWS CloudTrail, GCP Audit, Azure Activity. One pack, normalized to a common schema.
The marketplace lives inside nano. Browse and install without leaving the product. Every artifact is open source, so fork and contribute through GitHub.
Risk scores stack across signals. Rules contribute weighted factors, prevalence baselines tell you what's actually rare, and the score updates in real time as more events land.
Dashboards that compose. A health page that runs on autopilot, scanned by pivt every 12 hours. And settings deep enough to make every team's nano feel custom, without a fork.
Five steps. No services engagement. No "professional services" line item on the invoice. Most teams hit step 5 the same afternoon.
Full walkthrough with screenshots in the getting-started guide. About 20 minutes end-to-end.
Read the docs, fork the engine, run the demo. Or sign up and ingest something this afternoon.
Self-host the open core for free · or run managed from $19/mo