How nano-rs/nano works
nano is an open-core SIEM for security analysts. The principal workflow is log collection and parsing into ClickHouse, followed by nPL search or scheduled/real-time detection, then alert triage in the web UI. The API exposes search, detection, alert, enrichment, marketplace, and administration capabilities; PostgreSQL holds metadata. The graph combines README-documented product behavior with the sampled route, search-service, UI, and core-module evidence. Several subsystem links are documented rather than confirmed by sampled call sites, so uncertain wiring is omitted.
Main entry points: routes.rs API routes · main.rs Search service · mod.rs Detection service · App.tsx Web application
Components 20
Ingestion
- Vector collectors
- Event parsing
nanosiem-core/src/ingestion/parser.rs - Event store
- Parser repositories
nanosiem-core/src/parser_repository/service.rs
Search
- Search service
nanosiem-search/src/main.rs - nPL query parser
nanosiem-core/src/query/ast/mod.rs - ClickHouse SQL
nanosiem-core/src/query/clickhouse_sql_gen.rs - Search history
nanosiem-api/src/handlers/search_history.rs
Detection
- Detection service
nanosiem-core/src/detection/service/mod.rs - Detection scheduler
nanosiem-core/src/detection/scheduler.rs - Alert lifecycle
nanosiem-core/src/detection/service/alerts.rs
API and UI
- Web application
nanosiem-web/src/App.tsx - API routes
nanosiem-api/src/routes.rs - Alert endpoints
nanosiem-api/src/handlers/alerts.rs
Enrichment and state
- Metadata store
- Enrichment marketplace
nanosiem-core/src/marketplace/install_service.rs - Enrichment service
nanosiem-core/src/enrichment/service.rs - Authentication
nanosiem-core/src/auth/service.rs - PostgreSQL metadata
Other components
- Security analyst
Connections 21
- Vector collectors → Event parsing: sends logs
- Event parsing → Event store: writes events
- Security analyst → Web application: hunts and triages
- Web application → API routes: calls API
- API routes → Search service: dispatches search
- Search service → nPL query parser: parses nPL
- Search service → ClickHouse SQL: generates SQL
- Search service → Event store: queries events
- API routes → Detection scheduler: configures rules
- Detection scheduler → Detection service: runs rules
- Detection service → Event store: matches events
- Detection service → Alert lifecycle: records signals
- API routes → Alert endpoints: dispatches alert requests
- Alert endpoints → Alert lifecycle: manages lifecycle
- API routes → Enrichment marketplace: exposes catalog
- Enrichment marketplace → Enrichment service: installs providers
- API routes → Parser repositories: exposes repositories
- Web application → Search history: reads and writes history
- API routes → Authentication: applies authentication
- Search history → PostgreSQL metadata: stores history
- Alert lifecycle → PostgreSQL metadata: stores alert metadata