nano SIEM
nano SIEM: A self-hostable SIEM with layered detection workflows and paid managed options. Ranked #19 of 28 in SIEM Software by our editors (7.3/10); pricing: Free plan; best for open-source teams wanting modern SIEM workflows.
At a glance
- Editor score7.3 / 10
- PricingFree plan
- Best forOpen-source teams wanting modern SIEM workflows
- Free planYes
- Paid from$29/mo
- Custom detection rulesYes
- Facts checked19 Sep 2026
Where it wins
- Open-source core supports self-hosted ingestion, search, and detection
- Scheduled and near-real-time detection plus risk-based alerting
- Ingests through cloud feeds, Kafka, syslog, and OpenTelemetry
Where it doesn't
- Commercial modules are excluded from the open-source edition
- Paid monthly plans start at $29 and scale to $4,900 before Enterprise
- Enterprise pricing is custom
Our verdict on nano SIEM
nano SIEM collects, stores, searches, and analyzes security logs for teams building detection and investigation workflows. Its features include custom scheduled detection rules, near-real-time detection through materialized views, dashboards, case management, entity risk scoring, and MITRE ATT&CK mapping. The open-source edition is self-hosted and uses an AGPL-3.0 core engine; commercial modules are outside that edition. It is a fit for teams that want to shape their own SIEM stack, as well as organizations that prefer paid plans with defined ingestion and team limits.
The open-source plan has no account or bill, while commercial plans are billed monthly. Hobby costs $29 per month for 2 GB/day ingestion, 10 data sources, 300 AI requests per month, and 3 team members. Startup is $129 for 5 GB/day, 20 sources, 1,000 AI requests, and 8 members; Growth is $299 for 10 GB/day, 30 sources, 2,500 AI requests, and 12 members. Team costs $599 and adds high availability and object storage, with 25 GB/day and 15 members. Business at $1,600 includes SSO/SAML and unlimited sources and members at 50 GB/day. Pro is $4,900 for 100 GB/day and 40,000 AI requests. Enterprise has custom ingestion volume and unlimited retention, sources, and seats, with custom pricing. Several tiers specify 365 or 365+ days of retention.
Integration breadth is useful for teams bringing logs from existing infrastructure: supported sources include AWS S3, GCP Pub/Sub, Kafka, HTTP, Vector, OpenTelemetry, Splunk HEC, Fluentd/Fluent Bit, Filebeat, and Cribl Stream. Deployment options include managed cloud, BYOC, self-hosted, and, on Enterprise, on-premises or air-gapped deployment. AI assistance can help create parsers, queries, and detections, alongside alert triage. Choose nano SIEM if these detection and ingestion workflows match your needs and you can operate the self-hosted edition or justify a paid tier. Teams needing commercial modules without a subscription, or whose ingestion needs exceed published tiers without a custom plan, should consider alternatives.
Your product? Our editors can test nano SIEM in depth and publish a review, labelled as paid · from $149/mo →
nano SIEM pricing
All 8 nano SIEM plans and prices →
nano SIEM fact sheet
| Free plan | Yes |
|---|---|
| Paid from | $29/mo |
| Free ingestion limit | Not verified |
| Data retention | 365 days |
| Custom detection rules | Yes |
| Real-time alerting | Yes |
| Deployment | Hybrid |
| Query language | nPL (nano Pipe Language) |
| Deployment | Cloud, Desktop |
| Platforms | Web, Linux, macOS |
| Integrations | 11 integrations: AWS S3, GCP Pub/Sub, Kafka, HTTP, Vector, Syslog via Vector aggregator … |
| Pricing | Free plan (source) |
| Website | nano.rs |
| Facts checked | 19 Sep 2026 |
nano SIEM integrations
nano SIEM lists 11 integrations on its own site.
- AWS S3
- GCP Pub/Sub
- Kafka
- HTTP
- Vector
- Syslog via Vector aggregator
- OpenTelemetry
- Splunk HEC
- Fluentd/Fluent Bit
- Filebeat
- Cribl Stream
Alternatives to nano SIEM
- Elastic SecurityFlexible SIEM coverage with detection, threat hunting, and response workflows.9.4
- CrowdStrike Falcon Next-Gen SIEMA cloud-only SIEM combining cross-domain search, CQL detections, and automated response.9.2
- FortiSIEMA broad IT/OT SIEM with multivendor collection, analytics, case management, and SOAR.9.0
See all nano SIEM alternatives →
Used nano SIEM? Be the first to review it
The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used nano SIEM for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.
Write a reviewTwo minutes · verified accounts only · read by an editor before it appears
Featured on iTechGuides
nano SIEM is listed in our SIEM Software directory. Add the badge to your site — it links back to this page.
<a href="https://www.itechguides.com/products/nano-siem/"><img src="https://www.itechguides.com/best/badge/nano-siem.svg" alt="Featured on iTechGuides" width="230" height="46"></a>
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update