nano SIEM
nano.rs
What it is
nano SIEM is an AI-powered security information and event management product for security teams handling detection, alerting, investigation, and response. It stores security logs, OpenTelemetry traces, and metrics together for queries through nPL, its single query language. The maker says it can search billions of events in under a second using ClickHouse. Its pivt assistant can generate parsers, queries, detection rules, and investigation summaries from natural-language prompts. Detection rules support MITRE ATT&CK mapping, entity risk scoring, and tracking rare or first-seen indicators. Ingestion options include HTTP, Syslog, HEC, and Vector; listed parsers cover Palo Alto, CrowdStrike, Okta, AWS CloudTrail, Microsoft Defender, and Zeek. Deployment choices include managed service and BYOC, while Enterprise lists cloud, on-premises, and air-gapped deployment. The engine is open source under AGPL-3.0 and can be self-hosted without an account or bill. Hobby is listed at $26.00 per month, billed $204/yr, with 2 GB/day ingest and three team members.
Spec sheet
- Product
- nano describes itself as an AI-powered SIEM for security teams that need fast log analytics and covers detection, alerting, investigation, and response.Read 29 Sep 2026 · nano.rs
- Deployment
- nano offers managed service and BYOC deployment, and the Enterprise plan lists cloud, on-prem, or air-gapped deployment.Read 29 Sep 2026 · nano.rs
- Integrations
- The docs list HTTP, Syslog, HEC, and native Vector protocol for ingestion; the feature page highlights parsers for Palo Alto, CrowdStrike, Okta, AWS CloudTrail, Microsoft Defender, and Zeek.Read 29 Sep 2026 · nano.rs
- Security
- The trust page says connections use TLS 1.2+ and sensitive data is encrypted at rest using AES-256-GCM.Read 29 Sep 2026 · nano.rs
- Compliance
- The trust page labels GDPR active and SOC 2 Type II planned, stating the SOC 2 audit is in progress.Read 29 Sep 2026 · nano.rs
- Support
- Pricing lists community support for Hobby, email support for Startup through Team, priority support for Business and Pro, and dedicated support plus SLA for Enterprise.Read 29 Sep 2026 · nano.rs
- Headquarters
- Danbury, Connecticut, United StatesRead 28 Sep 2026 · nano.rs
- AI assistant
- pivt can generate parsers, queries, detection rules, and investigation summaries from natural language.Read 29 Sep 2026 · nano.rs
- Desktop availability
- pivt desktop offers native signed installers for macOS and Windows and requires a nano instance plus a locally installed coding agent.Read 29 Sep 2026 · nano.rs
- Detection
- Detection rules support MITRE ATT&CK mapping, entity risk scoring, and prevalence tracking for rare or first-seen indicators.Read 29 Sep 2026 · nano.rs
- Notable limits
- The Hobby plan includes 2 GB/day ingest, 10 data sources, 300 pivt AI requests per month, and 3 team members.Read 29 Sep 2026 · nano.rs
- Open source
- The nano engine is open source under AGPL-3.0 and can be self-hosted without an account or bill.Read 29 Sep 2026 · nano.rs
- Search
- The maker says nano supports sub-second queries across billions of events using ClickHouse.Read 29 Sep 2026 · nano.rs
- Unified data
- It stores security logs, OpenTelemetry traces, and metrics in one store with one query language.Read 29 Sep 2026 · nano.rs
Plans and prices
Strong points and limits
Strong points
- Stores logs, traces, and metrics together.
- Detection rules support MITRE ATT&CK mapping.
- Engine can be self-hosted without an account or bill.
- Offers managed and BYOC deployments.
- Supports real-time alerting and custom detection rules.
Limits
- Hobby includes 2 GB/day of ingest.
- Hobby is limited to three team members.
- Enterprise pricing is custom and not listed.
- SOC 2 Type II is planned, with audit in progress.
Who it suits
nano SIEM suits security teams that need shared log, trace, and metrics analysis alongside detection and investigation workflows. Its self-hostable engine may suit teams seeking to run the open-source component themselves.
Verdict
nano SIEM brings several security data types and workflows into one query environment, with both managed and self-hosted paths. Compare plan ingest limits and the listed annual billing details against your team's needs.
Where Specifiction places it
- SIEM Software#14 of 297.8