# nano-rs/nano architecture

> Architecture diagram of the GitHub repository nano-rs/nano, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-25). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/nano-rs/nano
- Repository: https://github.com/nano-rs/nano

## Overview

nano is an open-core SIEM for security analysts. The principal workflow is log collection and parsing into ClickHouse, followed by nPL search or scheduled/real-time detection, then alert triage in the web UI. The API exposes search, detection, alert, enrichment, marketplace, and administration capabilities; PostgreSQL holds metadata. The graph combines README-documented product behavior with the sampled route, search-service, UI, and core-module evidence. Several subsystem links are documented rather than confirmed by sampled call sites, so uncertain wiring is omitted.

Main entry points: [`nanosiem-api/src/routes.rs`](https://github.com/nano-rs/nano/blob/main/nanosiem-api/src/routes.rs) (API routes), [`nanosiem-search/src/main.rs`](https://github.com/nano-rs/nano/blob/main/nanosiem-search/src/main.rs) (Search service), [`nanosiem-core/src/detection/service/mod.rs`](https://github.com/nano-rs/nano/blob/main/nanosiem-core/src/detection/service/mod.rs) (Detection service), [`nanosiem-web/src/App.tsx`](https://github.com/nano-rs/nano/blob/main/nanosiem-web/src/App.tsx) (Web application)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_ingest["Ingestion"]
  node_vector["Vector collectors"]
  node_ingestion["Event parsing<br/>[parser.rs]"]
  node_events[("Event store")]
  node_parserrepo["Parser repositories<br/>[service.rs]"]
end

subgraph group_search["Search"]
  node_searchsvc["Search service<br/>[main.rs]"]
  node_npl["nPL query parser<br/>[mod.rs]"]
  node_sqlgen["ClickHouse SQL"]
  node_searchhistory["Search history<br/>[search_history.rs]"]
end

subgraph group_detect["Detection"]
  node_detections["Detection service<br/>[mod.rs]"]
  node_scheduler["Detection scheduler<br/>[scheduler.rs]"]
  node_alerts["Alert lifecycle<br/>[alerts.rs]"]
end

subgraph group_api["API and UI"]
  node_web["Web application<br/>[App.tsx]"]
  node_routes["API routes<br/>[routes.rs]"]
  node_alertapi["Alert endpoints<br/>[alerts.rs]"]
end

subgraph group_platform["Enrichment and state"]
  node_metadata[("Metadata store")]
  node_marketplace["Enrichment marketplace<br/>[install_service.rs]"]
  node_enrichment["Enrichment service<br/>[service.rs]"]
  node_auth["Authentication<br/>[service.rs]"]
  node_postgres[("PostgreSQL metadata")]
end

node_analyst(("Security analyst"))

node_vector -->|"sends logs"| node_ingestion
node_ingestion -->|"writes events"| node_events
node_analyst -->|"hunts and triages"| node_web
node_web -->|"calls API"| node_routes
node_routes -->|"dispatches search"| node_searchsvc
node_searchsvc -->|"parses nPL"| node_npl
node_searchsvc -->|"generates SQL"| node_sqlgen
node_searchsvc -->|"queries events"| node_events
node_routes -->|"configures rules"| node_scheduler
node_scheduler -->|"runs rules"| node_detections
node_detections -->|"matches events"| node_events
node_detections -->|"records signals"| node_alerts
node_routes -->|"dispatches alert requests"| node_alertapi
node_alertapi -->|"manages lifecycle"| node_alerts
node_routes -->|"exposes catalog"| node_marketplace
node_marketplace -->|"installs providers"| node_enrichment
node_routes -->|"exposes repositories"| node_parserrepo
node_web -->|"reads and writes history"| node_searchhistory
node_routes -->|"applies authentication"| node_auth
node_searchhistory -->|"stores history"| node_postgres
node_alerts -->|"stores alert metadata"| node_postgres

click node_ingestion "https://github.com/nano-rs/nano/blob/main/nanosiem-core/src/ingestion/parser.rs"
click node_web "https://github.com/nano-rs/nano/blob/main/nanosiem-web/src/App.tsx"
click node_routes "https://github.com/nano-rs/nano/blob/main/nanosiem-api/src/routes.rs"
click node_searchsvc "https://github.com/nano-rs/nano/blob/main/nanosiem-search/src/main.rs"
click node_npl "https://github.com/nano-rs/nano/blob/main/nanosiem-core/src/query/ast/mod.rs"
click node_sqlgen "https://github.com/nano-rs/nano/blob/main/nanosiem-core/src/query/clickhouse_sql_gen.rs"
click node_detections "https://github.com/nano-rs/nano/blob/main/nanosiem-core/src/detection/service/mod.rs"
click node_scheduler "https://github.com/nano-rs/nano/blob/main/nanosiem-core/src/detection/scheduler.rs"
click node_alerts "https://github.com/nano-rs/nano/blob/main/nanosiem-core/src/detection/service/alerts.rs"
click node_alertapi "https://github.com/nano-rs/nano/blob/main/nanosiem-api/src/handlers/alerts.rs"
click node_marketplace "https://github.com/nano-rs/nano/blob/main/nanosiem-core/src/marketplace/install_service.rs"
click node_enrichment "https://github.com/nano-rs/nano/blob/main/nanosiem-core/src/enrichment/service.rs"
click node_parserrepo "https://github.com/nano-rs/nano/blob/main/nanosiem-core/src/parser_repository/service.rs"
click node_searchhistory "https://github.com/nano-rs/nano/blob/main/nanosiem-api/src/handlers/search_history.rs"
click node_auth "https://github.com/nano-rs/nano/blob/main/nanosiem-core/src/auth/service.rs"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_vector,node_ingestion,node_events,node_parserrepo toneBlue
class node_searchsvc,node_npl,node_sqlgen,node_searchhistory toneAmber
class node_detections,node_scheduler,node_alerts toneMint
class node_web,node_routes,node_alertapi toneRose
class node_metadata,node_marketplace,node_enrichment,node_auth,node_postgres,node_analyst toneIndigo
```

## Components

### Ingestion

- **Vector collectors**
- [Event parsing](https://github.com/nano-rs/nano/blob/main/nanosiem-core/src/ingestion/parser.rs): `nanosiem-core/src/ingestion/parser.rs`
- **Event store**
- [Parser repositories](https://github.com/nano-rs/nano/blob/main/nanosiem-core/src/parser_repository/service.rs): `nanosiem-core/src/parser_repository/service.rs`

### Search

- [Search service](https://github.com/nano-rs/nano/blob/main/nanosiem-search/src/main.rs): `nanosiem-search/src/main.rs`
- [nPL query parser](https://github.com/nano-rs/nano/blob/main/nanosiem-core/src/query/ast/mod.rs): `nanosiem-core/src/query/ast/mod.rs`
- [ClickHouse SQL](https://github.com/nano-rs/nano/blob/main/nanosiem-core/src/query/clickhouse_sql_gen.rs): `nanosiem-core/src/query/clickhouse_sql_gen.rs`
- [Search history](https://github.com/nano-rs/nano/blob/main/nanosiem-api/src/handlers/search_history.rs): `nanosiem-api/src/handlers/search_history.rs`

### Detection

- [Detection service](https://github.com/nano-rs/nano/blob/main/nanosiem-core/src/detection/service/mod.rs): `nanosiem-core/src/detection/service/mod.rs`
- [Detection scheduler](https://github.com/nano-rs/nano/blob/main/nanosiem-core/src/detection/scheduler.rs): `nanosiem-core/src/detection/scheduler.rs`
- [Alert lifecycle](https://github.com/nano-rs/nano/blob/main/nanosiem-core/src/detection/service/alerts.rs): `nanosiem-core/src/detection/service/alerts.rs`

### API and UI

- [Web application](https://github.com/nano-rs/nano/blob/main/nanosiem-web/src/App.tsx): `nanosiem-web/src/App.tsx`
- [API routes](https://github.com/nano-rs/nano/blob/main/nanosiem-api/src/routes.rs): `nanosiem-api/src/routes.rs`
- [Alert endpoints](https://github.com/nano-rs/nano/blob/main/nanosiem-api/src/handlers/alerts.rs): `nanosiem-api/src/handlers/alerts.rs`

### Enrichment and state

- **Metadata store**
- [Enrichment marketplace](https://github.com/nano-rs/nano/blob/main/nanosiem-core/src/marketplace/install_service.rs): `nanosiem-core/src/marketplace/install_service.rs`
- [Enrichment service](https://github.com/nano-rs/nano/blob/main/nanosiem-core/src/enrichment/service.rs): `nanosiem-core/src/enrichment/service.rs`
- [Authentication](https://github.com/nano-rs/nano/blob/main/nanosiem-core/src/auth/service.rs): `nanosiem-core/src/auth/service.rs`
- **PostgreSQL metadata**

### Other components

- **Security analyst**

## Connections

- Vector collectors → Event parsing: sends logs
- Event parsing → Event store: writes events
- Security analyst → Web application: hunts and triages
- Web application → API routes: calls API
- API routes → Search service: dispatches search
- Search service → nPL query parser: parses nPL
- Search service → ClickHouse SQL: generates SQL
- Search service → Event store: queries events
- API routes → Detection scheduler: configures rules
- Detection scheduler → Detection service: runs rules
- Detection service → Event store: matches events
- Detection service → Alert lifecycle: records signals
- API routes → Alert endpoints: dispatches alert requests
- Alert endpoints → Alert lifecycle: manages lifecycle
- API routes → Enrichment marketplace: exposes catalog
- Enrichment marketplace → Enrichment service: installs providers
- API routes → Parser repositories: exposes repositories
- Web application → Search history: reads and writes history
- API routes → Authentication: applies authentication
- Search history → PostgreSQL metadata: stores history
- Alert lifecycle → PostgreSQL metadata: stores alert metadata