matanolabs/matano

Health v2 · maintenance only

Adoption not part of the score

1694 stars · 122 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

Matano is an open-source, cloud-native security data lake that runs in your AWS account, normalizing unstructured security logs into a structured, queryable lake built on Apache Iceberg. It provides realtime detection-as-code in Python with Sigma rule import, VRL-based log transformation pipelines, and integrations with 50+ log sources at petabyte scale.

Use cases

• build a security data lake on AWS
• collect and normalize security logs from many sources
• run threat hunting queries over petabytes of logs
• write realtime detections as code in Python
• import Sigma rules for detection engineering
• replace a commercial SIEM with an open-source alternative
• transform and enrich logs during ingestion with VRL
• do DFIR investigations with Athena SQL queries

When to choose

• you are an AWS-based security team wanting a self-hosted, vendor-neutral SIEM alternative
• you need petabyte-scale log storage with open table formats like Apache Iceberg
• you want detections managed as code with Sigma rule support
• you need realtime log normalization and enrichment without managing servers

When to avoid

• you are not on AWS or need multi-cloud or on-premises deployment
• you want a turnkey managed SIEM with enterprise support out of the box
• your team cannot operate cloud infrastructure and IaC deployments
• you only need small-scale log analytics without security focus

Facets

service · maturity active

database search-engine alerting etl streaming security monitoring security big-data cloud-computing analytics cloud serverless self-hosted rust security-data-lake siem threat-hunting detection-as-code apache-iceberg log-management dfir secops cloud-native sigma-rules

Member repositories

For agents

markdown · JSON · MCP: product_card(name="matanolabs/matano")