nano SIEM

nano SIEM is a security analytics platform for teams that want logs, traces, and metrics in one investigative workflow. It is particularly suitable for organizations that value an open-source engine and flexible deployment, while its hosted tiers fit teams willing to work within defined ingest, source, AI-request, and seat allowances. The strongest case is unified telemetry with natural-language assistance; the main caution is that meaningful hosted capacity becomes expensive as requirements grow.

Overview

nano combines security information and event management functions across detection, alerting, investigation, and response. Security logs, OpenTelemetry traces, and metrics share a store and the nano Pipe Language (nPL), so analysts can query different telemetry types without switching systems.

The maker says ClickHouse supports sub-second searches across billions of events. That is a strong proposition for large investigations, although the practical result will depend on workload and deployment. The AGPL-3.0 engine can run self-hosted without an account or bill, while managed and bring-your-own-cloud options serve teams that prefer vendor-operated infrastructure.

Key features

• Unified telemetry: One store and query language can reduce the friction of correlating logs, traces, and metrics during an incident.
• Detection context: Custom rules support MITRE ATT&CK mapping, entity risk scoring, and prevalence tracking for rare or first-seen indicators. Real-time alerting is included.
• Natural-language assistance: pivt can create parsers, queries, detection rules, and investigation summaries. This targets repetitive analyst work, but monthly AI-request quotas matter on every paid tier.
• Ingestion and parsing: HTTP, Syslog, HEC, and native Vector protocol are supported. Highlighted parsers cover Palo Alto, CrowdStrike, Okta, AWS CloudTrail, Microsoft Defender, and Zeek.
• Security controls: Connections use TLS 1.2 or newer and data at rest uses AES-256-GCM. GDPR is active, while the SOC 2 Type II audit is in progress.

Pricing

A free self-hosted engine is the clearest low-cost route. Hosted pricing is shown annually, despite monthly-equivalent figures.

Hobby has community support; Startup through Team have email support, and Business and Pro have priority support. Enterprise adds dedicated support and an SLA. The published paid entry point is $29/mo, while the annual Hobby figure is $26 a month.

Platforms

nano supports API, Linux, macOS, self-hosted, web, and Windows deployments. pivt Desktop provides signed native installers for macOS and Windows, but requires a nano instance and a locally installed coding agent. Enterprise can run in cloud, on-premises, or air-gapped environments.

Who it's for

Choose nano for security teams consolidating heterogeneous telemetry, organizations that need custom detections with ATT&CK context, or engineers who want an AGPL-3.0 engine they can self-host. The deployment range also suits teams moving between managed, BYOC, and tightly isolated infrastructure. It is less suitable when a small hosted budget must cover high ingest, many sources, or many AI-assisted investigations.

Pros and cons

Pros

• Open-source engine enables self-hosting without an account or bill.
• Logs, traces, and metrics use one store and query language.
• Detection rules combine ATT&CK mapping, risk scoring, and prevalence tracking.
• Deployment extends from managed service and BYOC to air-gapped Enterprise installations.

Cons

• Hosted tiers cap ingest, sources, AI requests, and seats until higher-priced plans.
• Business and Pro pricing is substantial for organizations that need unlimited sources and members.
• pivt Desktop depends on both a nano instance and a local coding agent.
• SOC 2 Type II is still in progress rather than completed.

Alternatives

Blumira is a paid option with a $12.00-per-month Detect plan, cloud and local-network visibility, pre-tuned detections, and one-year retention; choose it when those packaged capabilities matter more than nano's open-source engine.

Vigil offers a free, open-source plan with unlimited ClickHouse events, Sigma rules, threat hunting, and multi-endpoint support, making it the stronger starting point for a no-cost open-source deployment.

Wazuh provides a free self-hosted open-source plan alongside paid Small deployments; consider it when its established free-to-paid structure fits your operating model.

Elastic Security is a freemium platform with free trials and API, Linux, self-hosted, and web support; it is an alternative for teams already aligned with Elastic's ecosystem.

Sumo Logic has a free tier with 20 daily credits, seven-day log retention, and up to three users; choose it for a small, short-retention starting point.

MaxPatrol SIEM is a paid product with consultation-based pricing and a vendor pilot.

LogSentinel SIEM offers paid, volume-based Enterprise SaaS with unlimited connected applications and extended active and archive retention.

Devo Analytics Cloud provides paid cloud analytics plans with interactive visualizations, multitenancy, advanced analytics, and open APIs.

Verdict

nano SIEM is a strong choice for teams that want unified telemetry, context-rich detections, and the freedom to self-host or select a controlled deployment. Its main reason to look elsewhere is cost and capacity: hosted ingest, AI, source, and seat limits push growing organizations toward expensive tiers, while smaller teams may prefer a simpler free alternative.