Who Matano is for#
Security teams building a data lake
Use Matano when long-retention security logs, detection engineering, and AWS-owned storage matter more than buying a closed SIEM bundle.
Skip if:
Your team needs a fully managed SOC platform with bundled analysts and support.
Detection engineers analyzing cloud logs
Use Matano to normalize cloud security events and build detection workflows against a data lake.
Skip if:
Your security workload is small enough for basic cloud logging and alert rules.
The problem it solves#
Security teams collect more logs than traditional SIEM pricing and storage models can comfortably handle. Cloud, identity, endpoint, and application events all need to be retained, searched, normalized, and used for detection without making every query a budget decision.
The harder problem is ownership of security data. If logs live only in a managed SIEM, teams may struggle with long retention, custom analytics, and direct access to raw historical data.
How it solves it#
AWS security data lake
Builds a security data lake in an AWS account, giving teams a place to store and analyze large volumes of security logs.
Detection and response workflows
Targets threat hunting, detection engineering, response, and cybersecurity analytics rather than generic business intelligence.
Structured log normalization
Normalizes unstructured security logs into structured data so detections and analytics can operate across sources.
Strengths and trade-offs#
Strengths
- Security data stays in your cloud accountMatano's open source data lake model fits teams that want security data under their AWS control instead of only inside a vendor SIEM.
- Built for high-volume analyticsThe project positions itself for petabyte-scale security analytics, which matters for teams priced out of retaining everything in traditional SIEM storage.
Trade-offs
- -AWS-centered architectureMatano is built for AWS security data lake deployments. Teams standardized on another cloud or looking for a simple hosted SIEM should validate fit carefully.
What it's built on#
- Languages
- JavaJavaScriptKotlinPythonRustTypeScript
- Infrastructure
- AWS
FAQ#
What is Matano used for?
Matano is used to build an AWS-based security data lake for threat hunting, detection, response, and security analytics.
Is Matano a SIEM?
Matano overlaps with SIEM use cases, but it is framed around a security data lake and detection workflows rather than a closed managed SIEM product.
Who should use Matano?
Matano fits security teams that want to own high-volume security data in AWS and build custom detection analytics.
Similar open-source tools#
hysteria
Fast and censorship-resistant proxy solution
Local Deep Research
Your AI research assistant, fully local and encrypted.
Maigret
Collect OSINT data by username effortlessly
ClickHouse
Fast open source column-oriented database for analytics
ThingsBoard
Open source IoT platform for device management and dashboards
ClawMetry
Real-time observability dashboard for AI coding agents