- Home
- SIEM Software
- nano SIEM
nano SIEM
Danbury, Connecticut, United States
What it is
nano SIEM is an AI-powered security information and event management product for teams handling detection, alerting, investigation, and response. It stores security logs, OpenTelemetry traces, and metrics together, queried through nPL, its single query language. The maker says it can run queries in under a second across billions of events using ClickHouse. Its pivt assistant can generate parsers, queries, detection rules, and investigation summaries from natural-language requests. Detection rules support MITRE ATT&CK mapping, entity risk scoring, and tracking rare or first-seen indicators. Ingestion options include HTTP, Syslog, HEC, and Vector, with parsers for products including Palo Alto, CrowdStrike, Okta, AWS CloudTrail, Microsoft Defender, and Zeek. Deployment choices include a managed service and BYOC; Enterprise lists cloud, on-premises, or air-gapped deployment. The engine is open source under AGPL-3.0 and can be self-hosted without an account or bill. The Hobby plan includes 2 GB/day of ingest, 10 data sources, 300 AI requests monthly, and three team members. Paid plans are listed from $29/mo.
For and against
For
- Combines logs, traces, and metrics in one store.
- Includes detection rules with MITRE ATT&CK mapping.
- Engine can be self-hosted without an account or bill.
- Supports managed service and BYOC deployment.
Against
- Hobby includes 2 GB/day of ingest.
- Hobby is limited to 10 data sources.
- Hobby includes 300 AI requests per month.
- Hobby allows three team members.
The verdict
nano SIEM combines log, trace, and metric search with detection and AI-assisted workflows. The Hobby plan’s ingest, source, request, and team limits are relevant when sizing a deployment.
Who it suits
nano SIEM suits security teams seeking log analytics for detection, investigation, and response. Its self-hosted engine may also suit teams that want to operate the open-source software themselves.
Plans and prices
Hobby
2 GB/day · 365+ days retention · 10 data sources · 300 AI requests/mo
Read 29 Sep 2026 · nano.rs
Startup
5 GB/day · 365+ days retention · 20 data sources · 1k AI requests/mo
Read 29 Sep 2026 · nano.rs
Growth
10 GB/day · 365+ days retention · 30 data sources · 2.5k AI requests/mo
Read 29 Sep 2026 · nano.rs
Team
25 GB/day · 365 days retention · unlimited data sources · 5k AI requests/mo
Read 29 Sep 2026 · nano.rs
Business
50 GB/day · 365 days retention · unlimited data sources and team members · 15k AI requests/mo
Read 29 Sep 2026 · nano.rs
Pro
100 GB/day · 365 days retention · unlimited data sources and team members · 40k AI requests/mo
Read 29 Sep 2026 · nano.rs
Enterprise
200 TB+/day · unlimited retention, sources and seats · SSO/SAML and audit logs · cloud, on-prem or air-gapped
Read 29 Sep 2026 · nano.rs
On the record
- AI assistant
- pivt can generate parsers, queries, detection rules, and investigation summaries from natural language.nano.rs · read 29 Sep 2026
- Compliance
- The trust page labels GDPR active and SOC 2 Type II planned, stating the SOC 2 audit is in progress.nano.rs · read 29 Sep 2026
- Deployment
- nano offers managed service and BYOC deployment, and the Enterprise plan lists cloud, on-prem, or air-gapped deployment.nano.rs · read 29 Sep 2026
- Desktop availability
- pivt desktop offers native signed installers for macOS and Windows and requires a nano instance plus a locally installed coding agent.nano.rs · read 29 Sep 2026
- Detection
- Detection rules support MITRE ATT&CK mapping, entity risk scoring, and prevalence tracking for rare or first-seen indicators.nano.rs · read 29 Sep 2026
- Integrations
- The docs list HTTP, Syslog, HEC, and native Vector protocol for ingestion; the feature page highlights parsers for Palo Alto, CrowdStrike, Okta, AWS CloudTrail, Microsoft Defender, and Zeek.nano.rs · read 29 Sep 2026
- Notable limits
- The Hobby plan includes 2 GB/day ingest, 10 data sources, 300 pivt AI requests per month, and 3 team members.nano.rs · read 29 Sep 2026
- Open source
- The nano engine is open source under AGPL-3.0 and can be self-hosted without an account or bill.nano.rs · read 29 Sep 2026
- Product
- nano describes itself as an AI-powered SIEM for security teams that need fast log analytics and covers detection, alerting, investigation, and response.nano.rs · read 29 Sep 2026
- Search
- The maker says nano supports sub-second queries across billions of events using ClickHouse.nano.rs · read 29 Sep 2026
- Security
- The trust page says connections use TLS 1.2+ and sensitive data is encrypted at rest using AES-256-GCM.nano.rs · read 29 Sep 2026
- Support
- Pricing lists community support for Hobby, email support for Startup through Team, priority support for Business and Pro, and dedicated support plus SLA for Enterprise.nano.rs · read 29 Sep 2026
- Unified data
- It stores security logs, OpenTelemetry traces, and metrics in one store with one query language.nano.rs · read 29 Sep 2026
