nano
open core siem built on rust and ClickHouse
Last verified:
What is nano?
Nano is a lightweight SIEM (Security Information and Event Management) tool built in Rust on ClickHouse. It provides sub-second search over billions of security events with a dedicated cluster on every plan. The tool features a piped query language, a real detection lifecycle, and AI capabilities that actually work for security analysis.
Key features include fast search powered by ClickHouse, AI included in all plans, infrastructure included, self-hosting options where your data never touches their infrastructure, and open-source core engine under AGPL-3.0 license. It offers flat pricing that is approximately 86% cheaper than legacy SIEMs.
Nano is designed for security teams, growing teams, startups, and enterprises who need modern security monitoring without the complexity and cost of traditional SIEM solutions. It's ideal for teams running homelabs, growing security operations, and enterprise security teams needing audit-ready paperwork and SLAs.
The tool supports a real detection lifecycle for security threats, includes pivt AI settings with encrypted credentials, and offers both cloud-hosted and self-hosted deployment options depending on the plan chosen.
nano pricing
Pricing model: Freemium
Nano offers tiered pricing by capacity with AI included. Hobby plan is $19/mo for evaluating the product or running a small homelab, with option to self-host the open core for free. Startup plan starts at $129/mo for growing teams. Team tier is $599/mo (annual billing). Business tier is $1,600/mo and includes SSO/SAML, priority support, and 15k AI requests. Enterprise pricing is custom with custom capacity, dedicated support, SLAs, and white-glove onboarding. All plans include a dedicated cluster and infrastructure.
nano pros
- Sub-second search over billions of security events
- Built in Rust on ClickHouse for performance
- AI included in all plans at no extra cost
- Dedicated cluster on every plan including hobby
- 86% cheaper than legacy SIEMs
- Open-source core engine under AGPL-3.0
- Self-hosted options where data never touches their infrastructure
- Flat, honest tiered pricing
- Real detection lifecycle for security threats
- Piped query language for easy querying
- Infrastructure included in pricing
- SSO/SAML available on Business tier
- Audit-ready paperwork for enterprises
- Priority support on higher tiers
- White-glove onboarding for enterprise
- Live demo available without setup
- 1-line install for quick deployment
nano cons
- Relatively new tool with smaller community
- Self-hosting requires your own cloud infrastructure
- Enterprise features require custom pricing
- AI requests limited on lower tiers
- May lack some advanced features of legacy SIEMs
- ClickHouse dependency may require additional learning
- Limited documentation compared to established tools
- No free hosted tier - only self-hosted free option
Frequently asked questions about nano
What is nano?
Nano is a lightweight SIEM built in Rust on ClickHouse with sub-second search over billions of security events, a piped query language, a real detection lifecycle, and AI that does actual security work.
Is nano open source?
The core engine is open source under AGPL-3.0 license, so you don't have to take anyone's word for what it does. You can self-host the open core for free.
Where is my data stored?
For cloud plans, data is stored on their dedicated cluster. For self-hosted plans, the tool deploys into your cloud and your data never touches their infrastructure.
How does nano pricing compare to legacy SIEMs?
Nano offers flat pricing that is approximately 86% cheaper than legacy SIEMs, with honest tiered pricing and AI included in all plans.
What AI capabilities does nano include?
Nano includes pivt AI with provider API keys encrypted at rest using AES-256-GCM. All AI gateway communication uses TLS 1.2+ for security. AI requests are tiered by plan.
Can I try nano before buying?
Yes, there is a live demo available at nano.rs that you can poke without standing anything up. It's a shared tenant and is the same environment used for production.
What is the detection lifecycle in nano?
Nano has a real detection lifecycle for security threats, allowing teams to create, test, deploy, and manage security detection rules effectively.
What enterprise features are available?
Enterprise plans include custom capacity, dedicated support, SLAs, white-glove onboarding, procurement-friendly terms, and audit-ready paperwork.
How do I install nano?
Nano has a 1-line install for quick deployment. Self-hosted plans deploy into your cloud infrastructure.
What query language does nano use?
Nano uses a piped query language designed for easy querying of security events with sub-second search performance over billions of events.