Open-core engine in Rust. Sub-second search over billions of events — security logs, OpenTelemetry traces, and metrics in one store, one language. AI woven through every surface. And settings deep enough to make it actually yours.
Rust at the core, ClickHouse for storage, Vector for ingest. No JVM warmups, no garbage-collection pauses, no surprise memory limits. The whole stack picked for one job, which is getting your team to an answer.
The engine, the detection rules, the parsers, the docs. All in the open. The platform you can audit, fork, and self-host, managed cloud is for convenience, not control.
Pipe-based, left-to-right — familiar if you've used a search-and-pipe SIEM. Stricter, faster, and the autocomplete actually knows your schema.
1source_type=auth action=login status=failure
2| stats count as attempts by src_ip, user
3| where attempts > 10
4| sort -attempts
5...1source_type=proxy earliest=-7d
2| prevalence window=7d enrich=true
3| where host_count < 3 AND is_rare=true
4| table dest_host, first_seen, host_count
5...1source_type=sysmon action=process_create
2| tree process root="*powershell*"
3| prevalence enrich=true
4| where depth > 3
5...1source_type=proxy
2| bin span=10m
3| stats count by dest_host, _time
4| streamstats window=6 stdev(count) as jitter by dest_host
5...YAML frontmatter for metadata, pipe-language for the actual hunt. MITRE mapping, risk scoring, and prevalence enrichment are first-class, not glued on with a script.
1---
2title: regular_beacon_interval_detection
3severity: high
4mode: staging
5schedule: "*/10 * * * *"
6mitre_tactics: TA0011
7mitre_techniques: T1095
8---
9source_type = squid_proxy
10| where dest_ip != /^(10\.|192\.168\.)/
11| stats count, dc(timestamp) as unique_times by src_host, dest_ip
12| where count > 20 AND unique_times > 15
13| prevalence enrich=true window=30d
14| risk score=70 entity=src_host factor="Regular beacon pattern"
15| table timestamp, src_host, dest_ip, count, host_count, risk_scoreCases bundle the alert, the evidence, the timeline, and the analyst's notes in one place. Notebooks for ad-hoc hunting. Process trees and identity resolution for the messy parts.
pivt, nano's AI assistant, is woven into every surface. Triage alerts, build parsers, follow playbooks, draft case notes. Configurable, auditable, and never the one closing the ticket without you.
Define steps in YAML. pivt runs them on every alert: pull EDR context, check threat intel, query identity, draft a summary. Stop a step for human approval whenever you want.
Drop a sample log, get a working parser. pivt reads the format, writes the grok, validates against your data. The 80% case in two minutes, not two days.
Write incident response runbooks once. pivt executes them on the right alerts, asking for human confirmation on the steps that need it. Auditable trail of every action.
IPs enriched with GeoIP and ASN. Domains checked against threat intel. Hashes matched to known malware. All automatic, all on ingest. And when our defaults aren't enough, you ship a custom enrichment in a few lines.
200+ parsers, detection rules, and enrichments. Curated, versioned, one-click install. Or fork them and make them yours.
Traffic, threat, config, and system logs from PAN-OS 10+ firewalls.
EDR detections and telemetry, in both FDR and Streaming API formats.
System Log events: authentication, user lifecycle, MFA, and admin actions.
API calls, user identity, and resource changes across your AWS account.
EDR process, network, file, and logon events.
Network telemetry: conn, dns, http, ssl, files, ssh, and more.
The marketplace lives inside nano. Browse and install without leaving the product. Every artifact is open source, so fork and contribute through GitHub.
Risk scores stack across signals. Rules contribute weighted factors, prevalence baselines tell you what's actually rare, and the score updates in real time as more events land.
Dashboards that compose. A health page that runs on autopilot, scanned by pivt every 12 hours. And settings deep enough to make every team's nano feel custom, without a fork.
Five steps. No services engagement. No "professional services" line item on the invoice. Most teams hit step 5 the same afternoon.
Full walkthrough with screenshots in the getting-started guide. About 20 minutes end-to-end.
Read the docs, fork the engine, run the demo. Or sign up and ingest something this afternoon.
Self-host the open core for free · or run managed from $19/mo