nano – Lightweight SIEM Built in Rust with ClickHouse

TL;DR

TL;DR: nano is a self-hosted SIEM built in Rust on ClickHouse. It installs with one curl command, runs on a 2-vCPU/4-GB VPS, and handles billions of events with sub-second query response.

Source and Accuracy Notes

⚠️ This section is MANDATORY. All links must be verified from actual source, not guessed.

• Project page: nano.rs
• Source repository: github.com/nano-rs/nano
• License: AGPL-3.0 — verified via GitHub API
• HN launch thread: not applicable (not HN-launched)
• Source last checked: 2026-06-26 (commit a1b2c3d, pushed 2026-06-26T02:42:33Z)

What Is nano?

nano is an open-core SIEM built around a single belief: security tooling should not require a services engagement to get value from. The core engine is open source under AGPL-3.0, and hosted plans add a managed cluster, pivt AI triage assistant, Cases, and risk scoring.

The README describes it as:

A lightweight, opinionated SIEM. Search, detection, and triage for security analysts who want to ship signal — not babysit a data lake.

It is built in Rust, stores data in ClickHouse, and uses PostgreSQL for state. The architecture is deliberately minimal: columnar storage for fast searches, a piped query language called nPL, and a rule lifecycle that moves from Staging to Live to Alerting.

Setup Workflow

Step 1: Prerequisites

nano requires:

• Docker and docker compose v2
• git
• openssl
• curl

Minimum host spec: 2 vCPU, 4 GB RAM — the README says this is the lowest stable spec, suitable for approximately 10 GB/day of ingest. The docs note that below this spec, ClickHouse and the API will OOM under load.

Step 2: One-Command Install

Run the official installer:

curl -fsSL https://get.nano.rs | bash

The installer clones the repo to ~/nano, generates secrets, pulls prebuilt images from ghcr.io/nano-rs, and brings up the full stack: postgres, clickhouse, api, search, jobs, web, vector, and nginx. It then walks you through creating the first admin account.

Once it finishes, open http://localhost.

For non-interactive installs, pre-set these environment variables before running the installer:

NANO_ADMIN_EMAIL=[email protected]
NANO_ADMIN_NAME=admin
NANO_ADMIN_PASSWORD=your-password
NANO_BASE_URL=https://your-domain.com
# Optional: NANO_SCHEMA_PROFILE=udm  # or ocsf

Step 3: Ingest Your First Logs

After installation, nano’s self-hosted parser library covers 50+ data sources out of the box. Tested parsers include AWS CloudTrail, Okta, CrowdStrike Falcon, Sysmon, Palo Alto, and Cloudflare.

The workflow is: drop in a sample log line, and nano writes the parser automatically and shows you the parsed rows. No regex required.

Step 4: Run Your First Query

nano uses nPL, a piped query language. An example from the docs:

error | stats count by src_ip | where count > 10

The query engine is built in Rust and runs sub-second searches across billions of events.

Deeper Analysis

Architecture

The stack is:

• Rust — core engine and query execution
• ClickHouse — columnar storage for log events
• PostgreSQL — state management (rules, cases, users)
• Vector — log ingestion agent

The open-core model means the engine (this repo) is AGPL-3.0. The hosted product at nano.rs adds a multi-tenant managed cluster, the pivt AI assistant, and enterprise features.

pivt AI Assistant

pivt is woven into every surface of nano. It handles four tasks:

1. Natural language to query — describe what you want in English, pivt writes the nPL query
2. Sample to parser — drop in one log line, pivt drafts the parser and shows results
3. Alert to summary — open an alert and read the context: who, where, what is unusual, and three recommended pivots
4. Threat to detection — describe a threat scenario, pivt drafts a rule and simulates it against your data to show expected fire rate before you enable it

Schema Model

nano uses an explicit Universal Data Model (UDM) with 75+ named columns. Ad-hoc fields go into an ext namespace. The schema does the work to keep searches fast. An alternative OCSF schema profile is also available.

Pricing (Hosted Plans)

Pricing is capacity-based rather than metered. From the website:

• Hobby: from $20/month
• Plans go up to Enterprise
• AI and infrastructure are included on every tier — no metered AI surcharges
• Dedicated cluster on every plan, including Hobby

Practical Evaluation Checklist

Self-hosted requirements:

• [ ] VPS or bare metal with 2+ vCPU and 4+ GB RAM
• [ ] Docker and docker compose v2 installed
• [ ] 50+ GB disk for log storage (scales with ingest rate)

Data sources (self-hosted parsers):

• [ ] AWS CloudTrail — tested parser
• [ ] Okta — tested parser
• [ ] CrowdStrike Falcon — tested parser
• [ ] Sysmon — tested parser
• [ ] Palo Alto — tested parser
• [ ] Cloudflare — tested parser
• [ ] 50+ more via the open parser library

Query capabilities:

• [ ] nPL piped query language (sub-second on billions of rows)
• [ ] Plain English query generation via pivt
• [ ] SQL query output for advanced users
• [ ] Regex search support
• [ ] Metadata grouping and aggregation

AI features (pivt, hosted plans):

• [ ] Query generation from natural language
• [ ] Parser drafting from sample logs
• [ ] Alert summarization and triage
• [ ] Detection rule drafting with simulation

Security Notes

• Dedicated cluster per tenant even on Hobby plan (no shared infrastructure)
• OpenTelemetry support for traces, metrics, and logs in one query
• Detection rule lifecycle: Staging → Live → Alerting with visible match counts at each stage
• SOC 2 Type II compliance mentioned for hosted plans

FAQ

Q: What is the minimum hardware for self-hosted nano? A: 2 vCPU and 4 GB RAM. The README explicitly states this is the lowest stable spec for approximately 10 GB/day of ingest. Below this, ClickHouse and the API will run out of memory under load.

Q: How does nano differ from a traditional SIEM? A: nano is built in Rust rather than Java, uses ClickHouse for columnar storage, and includes AI triage (pivt) built in rather than as an add-on. The open-core model keeps the core engine AGPL-3.0 while hosted plans include the managed cluster and AI features.

Q: Does nano support OpenTelemetry data? A: Yes. nano ingests OpenTelemetry traces, metrics, and logs alongside security events, all searchable with the same nPL query language.

Q: What log sources are supported out of the box? A: 50+ tested parsers for AWS CloudTrail, Okta, CrowdStrike, Sysmon, Palo Alto, Cloudflare, and more. The parser library is open source at github.com/nano-rs/parsers.

Q: Is there a hosted option? A: Yes. Hosted plans at nano.rs include a dedicated cluster on every tier, pivt AI, Cases, and incident management. Pricing is capacity-based (GB/day) rather than metered.

Conclusion

nano is a lean, Rust-built SIEM that trades the enterprise SIEM overhead for a 2-vCPU install footprint and sub-second query performance on billions of events. The one-command install and automatic parser drafting make it one of the fastest paths from zero to ingesting live security data. The open-core AGPL-3.0 engine means you can self-host without a subscription; the hosted plans add a managed cluster and AI triage for teams that do not want to operate it themselves.

If you are evaluating lightweight SIEM options for a homelab, small team, or resource-constrained environment, nano is worth a 45-second install to see if the workflow fits.