Partnership Tenzir × nano

The SIEM you couldn't build. Now in two pieces that fit.

Teams have tried for a decade to escape per-gigabyte SIEM pricing by building on a data lake. A lake alone gives analysts no search bar, no detections, no cases. A SIEM without a programmable pipeline still inherits dirty data and runaway ingest. It takes both halves at once — and now both exist, meeting in ClickHouse.

Tenzir collects your telemetry, normalizes it to OCSF, and streams it into nano's ClickHouse over the native protocol. nano is the SIEM on top of those same tables: sub-second search, detections as code, and AI-led triage from alert to closed case.

See how it fits together → Read the solution brief → Visit Tenzir →

LIVE · Tenzir streaming into nano

Pipelines make the data right. The SIEM makes it actionable. The lake and the SIEM are the same ClickHouse tables.

OCSF on arrival· native ClickHouse protocol· no second ingestion path· flat capacity pricing

fig 01 — Tenzir pipelines feeding nano's ClickHouse in real time.

Why together

Each does one job well.

Tenzir owns everything upstream of storage: collection, parsing, OCSF normalization, in-stream enrichment, and volume reduction. nano owns everything on top: search, detections, alert queues, triage, and cases. No duplicate copy, no second pipeline to operate — they compose on the same OCSF tables in ClickHouse.

· makes the data right

Collect, normalize, enrich, reduce.

01Collect telemetry from any source: endpoint, identity, network, cloud, SaaS.

02Parse and map to stable OCSF event classes before anything lands.

03Enrich in-stream with geo, asset, and threat-intel context at ingest.

04Deduplicate, filter, and route low-value logs to object storage — shrinking the hot path.

to_clickhouse

· makes it actionable

Search, detect, triage, close.

01A search bar your team stops avoiding: sub-second over billions of events, a year deep.

02Detections as code, running directly on the OCSF tables Tenzir lands.

03When a rule fires, AI investigates first — pulling entities, running the queries an analyst would, writing the story with the next pivots.

04Cases bundle alert, evidence, timeline, and notes; playbooks keep response consistent.

The data flow

From raw telemetry to a queryable OCSF row.

Tenzir streams structured, columnar data into ClickHouse over the native protocol — never row-by-row JSON, never through a second ingestion layer. The tables it writes are the tables nano searches and detects on.

01 · Sources

endpoint · edr identity · okta network · suricata cloud · saas

02 · Tenzir pipeline

parse · map to OCSF enrich · dedupe · reduce route low-value → object store to_clickhouse (native, columnar)

03 · nano on ClickHouse

ocsf.* tables — lake & SIEM in one search · sub-second, a year deep detections · risk scoring · AI triage alert → investigation → closed case

fig 02 — One path. Source-specific parsing stays out of the database; ClickHouse stays fast.

The economics

Cut the bill twice.

Per-gigabyte SIEM pricing punishes you for collecting more of what you should be collecting. This stack replaces the meter with two independent controls on cost.

01 · Reduce upstream

Shrink the hot path.

Tenzir deduplicates, filters, and routes low-value logs to object storage before the write. Daily hot-path volume drops; nothing is lost — the full-fidelity copy stays in the lake, in open formats.

02 · Flat tiers downstream

No per-gigabyte meter.

nano prices by flat capacity tier, AI and infrastructure included. Upstream reduction compounds: a leaner hot path can move the whole deployment into a smaller tier.

03 · Start free

Open at the core.

Both halves are open-source at the core. Start with open-source nano and Tenzir pipelines, prove the model, then move to hosted capacity on dedicated infrastructure.

In practice

From alert to closed case, on clean data.

Because Tenzir keeps the data model stable upstream, nano's rules do not break when sources change. Detections graduate from staging to live to alerting, earning trust on real data before they page anyone. Risk scoring per user, host, or IP means analysts triage accumulated risk, not raw alert volume.

And retention stops being an archive: retro-hunts over months of lake telemetry feel like searching yesterday's logs.

Read the full solution brief →

land-in-nano.tql

// collect, normalize, reduce, land
from "suricata/eve.json", follow=true
read_suricata
ocsf::map
enrich threat_intel
deduplicate
to_clickhouse table="ocsf.network_activity"
// nano searches & detects on this table

Put it against your current SIEM.

Land one high-volume source as OCSF in ClickHouse with Tenzir, point nano at it, and measure search speed, detection coverage, and monthly cost against what you run today.

Start the evaluation → Read the solution brief

Visit Tenzir · tenzir.com

Open-source editions of both · native ClickHouse protocol · no second ingestion path