Matano

AWS-native security infrastructure, honestly reviewed. What you actually get when you deploy it, and who it’s realistically for.

TL;DR

• What it is: Open-source (Apache-2.0) security data lake built specifically for AWS — ingests petabytes of security logs, normalizes them to ECS format, stores them in Apache Iceberg, and lets you write Python detections-as-code [README][3].
• Who it’s for: Security engineers and DevSecOps teams running on AWS who are drowning in Splunk or Panther bills. Not for non-technical founders — this is infrastructure work, not SaaS configuration.
• Cost savings: Splunk Enterprise runs $100k–$500k/year at scale. Panther starts around $1k/month minimum. Matano’s software is free (Apache-2.0); you pay only AWS costs — S3, Lambda, SQS, Athena queries — which are a fraction of commercial SIEM pricing for equivalent data volumes [README][1].
• Key strength: True data ownership with open formats (Apache Iceberg + ECS) — your security data isn’t locked into a vendor’s proprietary schema. Query it with Athena, Snowflake, Spark, or Trino without moving it [README].
• Key weakness: AWS-only, CDK deployment required, 1,662 GitHub stars suggests a smaller community than mature alternatives like Wazuh or Graylog. No third-party user reviews surfaced in research — adoption appears primarily in security-engineering circles, not mainstream open-source communities [1][3].

---

What is Matano

Matano is an open-source cloud-native security data lake, designed to run entirely inside your AWS account. The GitHub description is direct: “Open source security data lake for threat hunting, detection & response, and cybersecurity analytics at petabyte scale on AWS” [README]. The company also sells a commercial managed Cloud SIEM under the name Matan Security (matanosecurity.com), but the open-source project is Apache-2.0 licensed and fully self-hostable.

The core value proposition is this: traditional SIEMs (Splunk, Elastic Security, QRadar) are expensive partly because they own the storage and query layer. They charge you to store your own data in their proprietary format. Matano breaks that coupling. You still ingest and normalize logs, still run detections, still get alerts — but the data lives in Apache Iceberg tables on your S3 bucket, queryable by any Iceberg-compatible engine. If you decide to migrate off Matano tomorrow, your security data stays with you [README].

What makes this different from just dumping logs into S3 is the normalization layer. Matano maps everything to ECS (Elastic Common Schema), the same schema Elastic uses, which means your CloudTrail, VPC Flow, Zeek, Okta, and CrowdStrike logs all end up in a consistent format you can query uniformly. The transformation pipeline uses VRL (Vector Remap Language — the same language used in the Vector observability pipeline), so you can write custom parsing logic without managing servers [README].

The project is built in Rust and Kotlin, deployed via AWS CDK, and runs fully serverless — Lambda, SQS, S3, and Athena do the heavy lifting. There’s no cluster to manage, no Elasticsearch heap to tune, no Kafka to babysit. You pay for what you use.

---

Why people choose it

The honest answer is that there’s limited third-party review material available for Matano. AlternativeTo lists it with 3 likes and names Wazuh and Graylog as its top alternatives [3][4]. The alteropen.com listing places it in the security/cloud-security category alongside Elastic Search, Splunk, and Panther as comparators [1]. No in-depth user reviews, no community walkthroughs, no “I replaced my SIEM with this” blog posts surfaced in research. The 1,662 GitHub stars and 99 forks suggest a real but niche user base.

What the README implies about why teams choose it breaks down into three categories:

SIEM cost reduction. The README’s first listed use case is “Reduce SIEM costs.” This is the primary pitch. Splunk’s ingest-based pricing can hit $10–$50 per GB/day at enterprise scale. Panther targets mid-market with cheaper rates but still cloud-hosted pricing. Matano’s AWS costs for equivalent workloads — mainly S3 storage and Athena query costs — are dramatically lower for teams already on AWS [README].

Data ownership and portability. The “no vendor lock-in” argument is unusually concrete here. Apache Iceberg is a genuinely open standard with growing adoption across Snowflake, Databricks, AWS Glue, and Trino. Storing security data in Iceberg means you can switch query engines without re-ingesting anything. ECS is open and documented. This matters if you’ve ever tried to export your Splunk data and discovered how unpleasant that process is [README].

Detection-as-code workflow. Security teams with engineering culture prefer detections as version-controlled Python code over GUI-based rule builders. Matano supports writing detections in Python directly, plus automatic import of Sigma rules — the open-source detection rule standard with thousands of community-maintained rules [README]. If your team is already writing detections in Python or maintaining a Sigma rule library, Matano slots in cleanly.

---

Features

Based on the README and project documentation:

Log ingestion and normalization:

• 50+ managed log sources with built-in parsers [README]
• AWS-native sources: CloudTrail, VPC Flow, Route53, Config, ELB, S3 Access, S3 Inventory, Inspector, WAF [README]
• Third-party sources: Cloudflare, CrowdStrike Falcon, Duo Security, GitHub Audit, Google Workspace, Microsoft 365, Microsoft Defender, Okta, Zeek, and others [README]
• Custom log sources via VRL scripting for any format not natively supported [README]
• Realtime ingestion pipeline — not batch-only [README]

Data lake and storage:

• Apache Iceberg tables on S3 — open format, no proprietary storage [README]
• ECS normalization applied at ingest — consistent schema across all log types [README]
• Query via AWS Athena, Snowflake, Apache Spark, Trino, or any Iceberg-compatible engine [README]
• No data copying required for external query engines [README]

Detection and alerting:

• Python detections-as-code with full Python library access [README]
• Automatic import of Sigma detection rules [README]
• Realtime detection evaluation as logs are ingested [README]
• Alert routing (specific destination/format details not specified in available documentation)

Enrichment:

• Threat intelligence enrichment from files, S3, and other sources [README]
• Custom enrichment tables — lookup data to add context to alerts [README]
• IP geolocation and other contextual fields [README]

Architecture:

• Fully serverless — Lambda + SQS + S3 + Athena [README]
• Deployed via AWS CDK (Cloud Development Kit) [README]
• Designed for petabyte-scale data volumes [README]
• Multi-source ingestion through S3 and direct integrations [README]

---

Pricing: SaaS vs self-hosted math

Matano open source:

• License cost: $0 (Apache-2.0) [README]
• Infrastructure cost: AWS charges for Lambda invocations, SQS messages, S3 storage, and Athena query scans — highly variable depending on log volume

Rough AWS cost estimate for a mid-size deployment: Data not available from sources — specific AWS cost benchmarks for Matano weren’t published in the materials reviewed. AWS Athena charges $5/TB scanned; S3 runs ~$0.023/GB/month for standard storage; Lambda is effectively free at most security log volumes. A team ingesting 50GB/day of logs could reasonably land in the $200–$800/month range in AWS costs, depending heavily on Athena query frequency and S3 lifecycle policies. This is an estimate based on AWS public pricing, not Matano-specific benchmarks.

Commercial SIEM alternatives for comparison:

• Splunk: Ingest-based pricing, commonly cited at $1,800–$3,600/GB/day at enterprise contracts. A 50GB/day environment runs $90,000–$180,000/year.
• Panther: Cloud SIEM targeting mid-market. No public pricing; reported starting around $12,000–$24,000/year.
• Elastic Security (managed): Elastic Cloud pricing starts around $95/month for minimal deployments, scales significantly with storage and compute.
• Chronicle (Google): Flat-rate pricing reported around $15/user/month, but enterprise-focused with minimum commitments.

The SIEM cost savings argument for Matano is credible at scale — particularly for AWS-native teams already paying for S3 and Athena in other contexts. The catch is that AWS costs aren’t free, and at very high query rates (continuous threat hunting dashboards, real-time enrichment lookups) they can accumulate faster than expected.

Matano commercial (matanosecurity.com):

• Pricing not publicly listed. Contact sales required.

---

Deployment reality check

This is the section that matters most for evaluating fit, and it’s where Matano diverges sharply from typical “self-hosted” tools that run on a $5 VPS via Docker Compose.

What you actually need:

• An AWS account
• AWS CDK installed and configured (CDK is AWS’s infrastructure-as-code framework, built on CloudFormation)
• Familiarity with AWS IAM — Matano creates Lambda functions, SQS queues, S3 buckets, Glue catalog tables, and more. Each needs appropriate permissions
• AWS Athena enabled in your region
• The CLI toolchain: Node.js (for CDK), AWS CLI, and the Matano CLI

What the deployment looks like: Matano deploys via its own CLI (matano deploy) which wraps AWS CDK. You configure log sources in YAML, define detection rules in Python, and run the deploy command. CDK synthesizes CloudFormation templates and deploys the full serverless infrastructure stack. This is fundamentally different from docker-compose up — it’s provisioning real cloud infrastructure.

What can go sideways:

• IAM permission errors during deployment are the most common early blocker for CDK-based tools. Getting the policy boundaries right for all the services Matano touches requires AWS comfort.
• Athena costs can spike unexpectedly if detections or queries aren’t written with partition pruning in mind. A detection that scans all historical logs instead of just recent data will generate large Athena bills.
• The project has 1,662 stars and 99 forks [1] — it’s not a widely-deployed tool with a massive support community. GitHub issues may have slower response times than larger projects.
• No third-party setup guides or community tutorials were found in research, which adds friction for first-time deployments.
• The last commit date wasn’t available in the data provided, and the commercial pivot to matanosecurity.com raises questions about the pace of open-source development going forward.

Realistic time estimate: A security engineer comfortable with AWS CDK: 2–4 hours to a working deployment. An engineer new to CDK but comfortable with AWS: a full day. Someone unfamiliar with AWS infrastructure: this is not the right starting point.

---

Pros and Cons

Pros

• Apache-2.0 license. Genuinely permissive — deploy, fork, embed, use commercially without restrictions [README][1].
• No vendor lock-in by design. Apache Iceberg + ECS means your security data is portable and queryable outside Matano forever. This is architecturally rare in the security space [README].
• Fully serverless on AWS. No cluster management, no capacity planning, no on-call for infrastructure. Pay-per-use scales naturally from small environments to petabyte workloads [README].
• 50+ managed log sources with VRL for custom sources — covers most common AWS and SaaS log types without custom parsers [README].
• Detection-as-code in Python with Sigma rule import. Engineers who want detections in version control and CI/CD pipelines will find this natural [README].
• Open query layer — Athena, Snowflake, Spark, Trino all work against the same Iceberg tables. You’re not locked into one query engine [README].
• ECS normalization means a single detection can match behavior across log sources without source-specific field mapping [README].

Cons

• AWS-only. No support for GCP, Azure, or on-premises. If you’re not on AWS, this tool doesn’t exist for you [README].
• CDK deployment required. Not Docker-friendly. Requires AWS infrastructure knowledge to deploy and maintain.
• Small community. 1,662 stars [1], no substantial user review ecosystem surfaced in research. Compare to Wazuh (10k+ stars) or Graylog (a commercial product with years of community). Thin community means thinner support resources.
• Commercial fork concerns. The README explicitly directs users to matanosecurity.com for enterprise support. When the people who built the open-source project are running a commercial alternative, questions about the pace and direction of open-source development are legitimate.
• No public pricing for managed version. If you want a managed deployment, you’re in contact-sales territory with no floor to anchor expectations.
• Query costs can be unpredictable. Athena’s per-scan pricing rewards careful query design. Poorly written detections that skip partitioning can generate AWS bills that undercut the savings argument.
• Limited documentation on operations. The README covers architecture and features well; day-two operations (backup, DR, scaling, log retention policies) aren’t extensively documented in publicly available materials.

---

Who should use this / who shouldn’t

Use Matano if:

• You’re an AWS-native security team with Splunk or Panther bills in the $50k+ range that you’re trying to reduce.
• You have engineers who are comfortable with AWS CDK and Python — this is an engineer’s tool, not a point-and-click platform.
• Data sovereignty is a hard requirement — you need security logs in your own AWS account, in open formats, with no vendor able to restrict access.
• You’re already using ECS-normalized log formats and want Sigma detection rules to work across your entire log estate.
• You want to run security analytics from Snowflake or Databricks directly against your security data without syncing it first.

Skip it (consider Wazuh instead) if:

• You need an endpoint detection and response (EDR) component alongside log management — Wazuh covers both and has a much larger community [3].
• You’re running a hybrid or multi-cloud environment — Wazuh deploys anywhere; Matano deploys only to AWS.
• You want a GUI-first experience for your security analysts rather than a code-first workflow.

Skip it (consider Graylog instead) if:

• You want a mature log management platform with a real GUI, proven at scale, with a larger support community [3][4].
• You’re not on AWS or don’t want AWS infrastructure dependencies.
• Your team is comfortable with Elasticsearch-based tooling and doesn’t need Apache Iceberg portability.

Skip it entirely if:

• You’re a non-technical founder looking to escape SaaS bills on business tools. Matano is security infrastructure for security engineers — it’s not in the same category as self-hosted Zapier or self-hosted Notion.
• You don’t have an AWS account or don’t want one.
• Your security needs are covered by a $30/month log aggregation service — Matano’s complexity overhead isn’t justified at small scale.

---

Alternatives worth considering

• Wazuh — The most downloaded open-source security platform according to its own site. SIEM + XDR + EDR in one. Runs anywhere (not AWS-only). Much larger community. Best alternative if you need endpoint monitoring alongside log analysis [3].
• Graylog — Freemium open-source log management, widely deployed, good UI, active community. Better for teams wanting a maintained GUI and not needing the data lake / Iceberg portability angle [3][4].
• Elastic Security (ELK Stack) — Mature, powerful, ECS-native (Matano actually uses ECS partly because of Elastic’s work on it). More complex to operate, more expensive at scale on managed cloud. Self-hosted is free but resource-heavy [1].
• Panther — Commercial cloud-native SIEM with similar detection-as-code philosophy. Easier to deploy than Matano, but closed-source and significantly more expensive [1].
• Splunk — Enterprise SIEM incumbent. Best-in-class features and ecosystem, worst-in-class pricing. The tool Matano’s cost pitch is most directly arguing against [1].
• OpenSearch + Security Analytics — AWS-managed alternative to Elastic, with built-in security analytics. Less purpose-built than Matano but backed by AWS directly and more straightforward for teams already using OpenSearch.

---

Bottom line

Matano occupies a specific and legitimate niche: AWS-native teams that have hit the pain threshold on commercial SIEM pricing and have the engineering capability to deploy serverless AWS infrastructure. The Apache-2.0 license, Apache Iceberg storage, and ECS normalization are genuine architectural advantages that commercial alternatives don’t match — your security data stays portable, vendor-neutral, and queryable by any engine you choose. For a security engineering team running at scale on AWS with a Splunk bill north of $100k/year, the math for evaluating Matano is obvious.

What it isn’t: a general-purpose self-hosted security tool that non-technical founders can spin up on a VPS. The CDK deployment, AWS dependency, and engineering-first workflow put it firmly in the infrastructure category. The relatively modest community size (1,662 stars, limited third-party review presence) also means you’re taking on more operational risk than with more widely-deployed alternatives like Wazuh. For teams willing to accept that trade-off in exchange for genuine data ownership and open formats, Matano is worth a serious evaluation. Everyone else should start with Wazuh.

---

Sources

1. AlterOpen — Matano: Top Alternatives (listing, alteropen.com). https://alteropen.com/alternative/matanolabs-matano
2. AlternativeTo — Log Management Tools Category (Matano listed, 3 likes; best alternatives: Wazuh, Graylog). https://alternativeto.net/category/networking-and-admin/log-management/
3. AlternativeTo — Apps with Logging Feature (Matano listed; Apache-2.0, Self-Hosted). https://alternativeto.net/feature/logging/

Primary sources:

• GitHub repository and README: https://github.com/matanolabs/matano (1,662 stars, Apache-2.0 license, Rust/Kotlin)
• Official website: https://www.matano.dev
• Commercial managed SIEM: https://matanosecurity.com