nano SIEM review
A self-hostable SIEM with layered detection workflows and paid managed options.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
nano SIEM collects, stores, searches, and analyzes security logs for teams building detection and investigation workflows. Its features include custom scheduled detection rules, near-real-time detection through materialized views, dashboards, case management, entity risk scoring, and MITRE ATT&CK mapping. The open-source edition is self-hosted and uses an AGPL-3.0 core engine; commercial modules are outside that edition. It is a fit for teams that want to shape their own SIEM stack, as well as organizations that prefer paid plans with defined ingestion and team limits.
The open-source plan has no account or bill, while commercial plans are billed monthly. Hobby costs $29 per month for 2 GB/day ingestion, 10 data sources, 300 AI requests per month, and 3 team members. Startup is $129 for 5 GB/day, 20 sources, 1,000 AI requests, and 8 members; Growth is $299 for 10 GB/day, 30 sources, 2,500 AI requests, and 12 members. Team costs $599 and adds high availability and object storage, with 25 GB/day and 15 members. Business at $1,600 includes SSO/SAML and unlimited sources and members at 50 GB/day. Pro is $4,900 for 100 GB/day and 40,000 AI requests. Enterprise has custom ingestion volume and unlimited retention, sources, and seats, with custom pricing. Several tiers specify 365 or 365+ days of retention.
Integration breadth is useful for teams bringing logs from existing infrastructure: supported sources include AWS S3, GCP Pub/Sub, Kafka, HTTP, Vector, OpenTelemetry, Splunk HEC, Fluentd/Fluent Bit, Filebeat, and Cribl Stream. Deployment options include managed cloud, BYOC, self-hosted, and, on Enterprise, on-premises or air-gapped deployment. AI assistance can help create parsers, queries, and detections, alongside alert triage. Choose nano SIEM if these detection and ingestion workflows match your needs and you can operate the self-hosted edition or justify a paid tier. Teams needing commercial modules without a subscription, or whose ingestion needs exceed published tiers without a custom plan, should consider alternatives.
nano SIEM pros and cons
- Where it wins
- Open-source core supports self-hosted ingestion, search, and detection
- Scheduled and near-real-time detection plus risk-based alerting
- Ingests through cloud feeds, Kafka, syslog, and OpenTelemetry
- Where it doesn't
- Commercial modules are excluded from the open-source edition
- Paid monthly plans start at $29 and scale to $4,900 before Enterprise
- Enterprise pricing is custom
nano SIEM fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update