EP286 Building an AI-pilled, solo vibe-coded, Clickhouse-based SIEM with Dan Lussier

The hosts, Tim Peacock and Kyle Champlin, introduce the episode focused on innovative security information and event management (SIEM) architecture. They highlight Dan Lussier, founder of Nano, who single-handedly built a high-scale, AI-enhanced SIEM over a holiday break for under $7,000. The episode promises insights into the technical journey, architectural decisions, and the role of AI, specifically around the use of cutting-edge tools like Claude Code and ClickHouse.

Dan Lussier recounts his experience of developing an entire SIEM system during his time off. He explains how he started from a Postgres prototype and envisioned a scalable, fast, cost-effective solution. Utilizing AI tools such as Claude Code and deploying on Kubernetes with minimal resources, Dan managed to build a system capable of ingesting 10–20 GB of data daily while maintaining sub-second query speeds. He opted for ClickHouse for its speed and efficiency at large scale, carefully architecting a system that balances performance with resource economy.

A deep dive into Dan’s architectural philosophy reveals a preference for a tightly coupled, full-stack design initially, with flexibility for customers to decouple components like ingestion pipelines later. He chose ClickHouse for its indexing and JSON capabilities, enabling rapid keyword searches across massive datasets. The design also supports deployment in multiple environments, including on-premises, influenced by considerations of sovereignty and compliance. This adaptable architecture caters to both cloud-based and localized security operations centers.

Dan discusses integrating AI for triage, detection, and analysis within the SIEM. He explains using 'cheap' AI models to analyze cases, associate related ones, and assist analysts by automating routine searches and data correlation. A cautious approach is taken regarding AI’s role in decision-making, emphasizing that AI currently aids rather than replaces human judgment. The system provides options for users to toggle AI features, ensuring control and reducing the risk of false positives or dangerous outputs.

Dan highlights how he optimized costs—spending around $7,000 on tokens and infrastructure—while achieving a scalable, high-performance SIEM. He emphasizes the importance of evaluating and testing the system with realistic data volumes over extended periods to ensure performance. Flexibility is built into the platform, allowing customers to bring their own infrastructure or deploy in different cloud or on-prem environments, addressing data sovereignty and compliance needs.

The conversation explores how detection rules, traditionally complex and domain-specific, can become more accessible through automation and user-friendly interfaces. Dan advocates for 'detection as code' approaches, with tools like MCP servers supporting smaller teams and enabling them to write rules via API or UI integrations, democratizing security operations. He emphasizes the importance of making these tools approachable for analysts with varying technical skills.

Dan advises security leaders to conduct comprehensive evaluation of their SIEM needs, considering factors like AI integration and speed, over at least a month-long proof of concept. Continuous testing with large datasets is essential. For reading recommendations, he suggests staying updated on AI and security articles to keep pace with evolving technology. The episode concludes with gratitude to Dan for sharing his innovative work and contributions to modern SIEM architecture.