nano SIEM

Overview

nano SIEM is a security analytics platform built around a shared store for logs, traces, and metrics. It will suit teams that want to bring investigation and detection into the same workflow, especially those comfortable with open-source software or choosing a managed deployment. Its breadth is appealing, but the hosted plans impose clear ingest, source, AI-request, and seat ceilings.

Key features

nano stores security logs, OpenTelemetry traces, and metrics together and queries them with nano Pipe Language (nPL). That unified approach can simplify investigations across different telemetry types. The maker says ClickHouse enables sub-second searches across billions of events; search performance is central to the pitch, though the claim does not remove the need to assess fit for a particular workload.

Custom detection rules support MITRE ATT&CK mapping, entity risk scoring, and prevalence tracking for rare or first-seen indicators, alongside real-time alerting. These capabilities help teams add context to detections rather than relying only on raw event searches.

The pivt assistant can generate parsers, queries, detection rules, and investigation summaries from natural-language requests. This could reduce repetitive setup and analysis work, but its usefulness is bounded by monthly request allowances on paid plans and the Hobby tier.

Ingestion supports HTTP, Syslog, HEC, and native Vector protocol. Highlighted parsers cover Palo Alto, CrowdStrike, Okta, AWS CloudTrail, Microsoft Defender, and Zeek, giving security teams several familiar sources to start from.

The nano engine is open source under AGPL-3.0 and can be self-hosted without an account or bill. Managed service and BYOC are also offered, while Enterprise adds cloud, on-premises, or air-gapped deployment. Connections use TLS 1.2+ and sensitive data is encrypted at rest with AES-256-GCM. GDPR is active; SOC 2 Type II is planned, with the audit in progress.

Pricing

The Hobby plan is $26 a month, billed $204/yr · save $24. It includes 2 GB/day ingest, 365+ days retention, 10 data sources, 300 AI requests per month, and 3 team members. Community support and the low ingest ceiling make it a sensible starting point for a small team evaluating the workflow, but not a generous shared service for larger deployments.

Startup costs $116 a month, billed $1,392/yr · save $156, and raises allowances to 5 GB/day, 20 sources, 1k AI requests, and 8 team members, with 365+ days retention. Growth is $269 a month, billed $3,228/yr · save $360, for 10 GB/day, 30 sources, 2.5k AI requests, and 12 members, also with 365+ days retention. Both include email support; Growth is the more capable step up for teams that outgrow Startup's quotas.

Team is $539 a month, billed $6,468/yr · save $720, and includes 25 GB/day, unlimited sources, 5k AI requests, 15 members, high availability, and 365 days retention. Business costs $1,440 a month, billed $17,280/yr · save $1,920, with 50 GB/day, unlimited sources and members, 15k requests, SSO/SAML, and priority support; retention is 365 days. Pro is $4,410 a month, billed $52,920/yr · save $5,880, for 100 GB/day, unlimited sources and members, 40k requests, high availability, SSO/SAML, and priority support, with 365 days retention. Those upper tiers target organizations whose ingest, access-control, or availability needs justify a steep increase in spend.

Enterprise has custom pricing and includes 200 TB+/day, unlimited retention, sources, and seats, SSO/SAML, audit logs, cloud, on-premises, or air-gapped deployment, plus dedicated support and an SLA. Paid plans from $29/mo is the entry price, while the listed annual plan prices above show the cost and quotas for specific tiers. Self-hosting the open-source engine avoids an account or bill, but the paid plans include differing support and service allowances.

Platforms

nano supports API, Linux, macOS, self-hosted, web, and Windows. pivt desktop has signed native installers for macOS and Windows, but requires a nano instance and a locally installed coding agent, so it is not a standalone desktop SIEM.

Who it's for

nano is a strong fit for security teams seeking one place to search logs, traces, and metrics, with custom detections and natural-language assistance. Its open-source engine also gives teams that can operate their own infrastructure a no-bill self-hosting route. Hobby's 2 GB/day ingest, 10-source, 300-request, and 3-member caps suit a small evaluation or modest team more than a growing security operation; larger teams should weigh the higher tiers against their actual quotas and support requirements.

Pros and cons

• Pros: Shared storage and one query language span logs, traces, and metrics, supporting investigations across telemetry types.
• Pros: Custom rules combine ATT&CK mapping, risk scoring, and prevalence tracking, with real-time alerting.
• Pros: Open-source self-hosting, managed service, and BYOC provide meaningful deployment choice.
• Cons: Hobby caps ingest at 2 GB/day and the team at 3 members, limiting its use beyond small deployments.
• Cons: pivt request quotas rise by tier, so teams relying heavily on AI assistance must account for that constraint.
• Cons: Business and Pro carry substantial annual costs, and Enterprise uses custom pricing.
• Cons: SOC 2 Type II is still planned, with the audit in progress.

Alternatives

SIEM Software is the broader category directory for comparing more products. Choose Wazuh if a free, open-source self-hosted option is the priority; its Small plan starts at $571 a month. Vigil is another free option, with unlimited events, Sigma detection rules, threat hunting, and multi-endpoint support.

Consider Elastic Security for a freemium alternative with a free trial. Seceon Open Threat Management is worth considering when licensing based on devices or users fits better. Sumo Logic offers a free plan with 20 daily credits, seven-day log retention, and up to three users; that can suit a smaller evaluation, though its retention is much shorter than nano's paid tiers.

CrowdStrike Falcon Surface is a paid product with a free trial. Rapid7 Surface Command is another paid option with a free trial. UTMStack is worth comparing for its listed 300-device average and 750 GB hot storage.

Verdict

Choose nano SIEM if your team wants unified telemetry, flexible deployment, and detection and investigation tools in one security platform. Its open-source engine makes self-hosting especially compelling, while the hosted tiers offer a defined path to higher quotas and enterprise controls. Look elsewhere if the Hobby ceilings are too restrictive, the paid tiers exceed your budget, or you need SOC 2 Type II assurance now.