TEteleforce·Apr 3, 2025Submission
Matano: Open-source security data lake for cybersecurity analytics
2 points · Open discussionmatanolabs
matano
Rust2022–2025
matanolabs / matano
matano
Open source security data lake for threat hunting, detection & response, and cybersecurity analytics at petabyte scale on AWS
Data & DatabasesSecurity & PrivacyScience & EngineeringSystems & InfrastructureDevOps & CloudObservability
5Distinct people
15Mentions
0Explicit recommenders
1.7KGitHub stars
What to know before exploring
What it is
Open source security data lake for threat hunting, detection & response, and cybersecurity analytics at petabyte scale on AWS
GitHub
Where it is used
No documented product use has been verified yet.
What people are saying
No recommendation phrase was found in the indexed comments.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
No other repository is repeatedly linked in the same discussions.
This week on Hacker News
Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 3:56:07 PM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by year15 dated mentions
Observed mentions: 2022-08-06 09:58:06 UTC to 2025-04-03 23:17:03 UTC.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| 2022 | 2022-01-01 00:00:00 UTC | 2023-01-01 00:00:00 UTC | 12 | 1 | 11 |
| 2023 | 2023-01-01 00:00:00 UTC | 2024-01-01 00:00:00 UTC | 2 | 0 | 2 |
| 2024 | 2024-01-01 00:00:00 UTC | 2025-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2025 | 2025-01-01 00:00:00 UTC | 2026-01-01 00:00:00 UTC | 1 | 1 | 0 |
What Hacker News says
15 sourcesThis is nice! In Matano, we take a similar approach but with Rust + serverless for pulling SaaS logs (https://github.com/matanolabs/matano/tree/main/lib/rust/log_...) and storing them in a data lake.
In A Software as a Service (SaaS) log collection frameworkExcited to give this a try and follow your progress!
In case anybody else is wondering how Matano compares to Panther (my first thought reading this launch post) there's a comparison on the Matano website[0].
Quick note to the Matano team, the "Elastic Common Schema (ECS)" link in the readme[1] seems to be broken.
[0] https://www.matano.dev/alternative-to/panther
[1] https://github.com/matanolabs/matano#-log-transformation--da...
In Launch HN: Matano (YC W23) – Open-Source Security Lake Platform (SIEM) for AWSI'm on the fence about this one. When I heard it was announced, and that it was created by none other than the creators of the amazing AWS CDK, I was really excited by what could be possible. Having worked on complex infra automation using CDK (we use it extensively for our open source project for analyzing security logs on AWS: https://github.com/matanolabs/matano), I was excited because of the room for improvement with an integration that is language-native.
But after having looked into the abstraction that Winglang, and other "infrastructure-from-code" providers have come up with, I'm admittedly very skeptical. As other have mentioned, cloud primitives are almost by nature a leaky abstraction with many bells and whistles to be tuned. So I'm not sure it is a good idea, or feasible in a complex production application, to build on these v
Read the rest
ery high level primitives such as cloud.Queue without limiting yourself to the lowest common denominator of features. But perhaps this issue is solvable by creating a nicer SDK.
What bothers me the most is having to to write code in a completely new language, that kind of treats runtime code as a second class citizen to be embedded in a configuration oriented language that looks like Typescript with some magic added in. Imo, this is far too much friction and risk vs. the benefit that could come from something like this over using your language of choice along with CDK.
I'm still rooting for Wing, and hoping they can figure out these issues, because the problem they are solving is a massive one. I think Winglang has the potential to do for cloud, what Rust did for memory safety by doing smart things at compile time and enforcing policies that could easily be missed by developers. For example, automatically deriving least privilege and minimal permissions for all infrastructure could be a great way to improve security out of the box.
Good points, I'm building an open source security lake platform for AWS (https://github.com/matanolabs/matano) that lets you ingest petabytes of data and write detections as code, all in your AWS account. We take an IaaC approach so everything from config to detections is managed as code in Git.
In Automating Cloud SecurityZeek can produce a lot of data especially with so many endpoints. If you want an open source low cost way to actually analyze all that data in your own cloud data lake, check out/follow https://github.com/matanolabs/matano.
We're gonna be launching managed support for Zeek soon, where you can just dump Zeek logs in S3 and get out normalized Apache Iceberg tables for all ~43 Zeek logs.
In Zeek is now a component of Microsoft WindowsIt's pretty ridiculous this can happen. With building Matano (https://github.com/matanolabs/matano), an open source security lake, one of our core decisions was to store all data in S3 in Apache Iceberg tables (an open table format that lets you query data from any supporting tool i.e Spark, Presto, Athena, Snowflake, more). This let's you own your data without it being held hostage on some vendors instances in a proprietary format.
-https://github.com/matanolabs/matano
- https://iceberg.apache.org
In Splunk IP suit against CriblWe're building Matano (https://github.com/matanolabs/matano), an open source security lake platform. It's a different approach since we normalize logs from JSON, csv, etc, and ingest them into Apache Iceberg tables, but it allows for massive scale and joins, aggregations, etc using SQL.
In Splunk IP suit against CriblClickhouse is great but the ops and scaling make it notoriously difficult to self host.
If you have a lot of log data and want something open source and serverless you can self host, check out Matano (https://github.com/matanolabs/matano).
In ClickHouse Cloud is now in Public BetaI'm building an open source security lake platform (https://github.com/matanolabs/matano). Basically, some of the core problems we solve are:
- Traditional SIEM tools are not a good fit for large amounts of data — they're either too expensive or come with a high ops burden.
- Your data is locked into vendor specific formats.
We solve this by ingesting and storing all your data in Apache Iceberg tables on S3, (allowing for low cost queries directly on S3 data + an open table format) and building everything using only serverless technologies(Lambda, SQS, S3, Athena, etc.).
We also let you write realtime Python detections as code and are written in Rust, which makes for some interesting technical challenges.
In Ask HN: What interesting problems are you working on?Building Matano, an Open Source security lake platform for AWS
https://github.com/matanolabs/matano
In Ask HN: It's Demo Day. What are you working on?Oclif is pretty nice for NodeJS, we use it for https://github.com/matanolabs/matano . https://github.com/charmbracelet/bubbletea looks really beautiful, if you use Go.
In Ask HN: What do you use to make CLIs?Looks neat, but in what way is this serverless?
It's a pretty complex diagram:
https://github.com/matanolabs/matano/blob/main/website/src/a...
In Show HN: Open-source serverless security lake powered by Rust + Apache IcebergShow HN: Open-source serverless security lake powered by Rust + Apache Iceberg
63 points · Open discussionMatano - (https://github.com/matanolabs/matano), an open source security lake platform on AWS. Let's you run security log analytics on an open data lake, and detections as code in your AWS account.
Cool because it's all OSS, serverless, high scale, low cost, and built with modern technologies like Rust and Apache Iceberg.
In Ask HN: What are you working on and why is it cool?