This repository was archived by the owner on Jul 2, 2026. It is now read-only.
Add Nano integration docs - #422
Open
mavam wants to merge 3 commits into
Open
Conversation
Only use semantic cross-reference icons as list markers for lists immediately following a See Also heading. This keeps ordinary prose bullets as bullets when they contain inline operator or function links. Assisted-by: GPT-5 (Codex)
Document how to forward OCSF events from Tenzir to the Nano SIEM:
- New integrations/nano.mdx covering the {event, source_type} wire shape, the
to_clickhouse sink into nanosiem.ocsf_logs_native_raw, and reading events back
from nanosiem.ocsf_logs.
- Add Nano to the Security Tools sidebar section.
- Add reciprocal <Integration>nano</Integration> See Also links to the
to_clickhouse and from_clickhouse operator references.
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
github-actions
Bot
added
reference
Contributor
|
📦 Preview · View → · 🟢 Live Verified for |
mavam
commented
Jun 30, 2026
Comment on lines
+69
to
+81
| Write to `nanosiem.ocsf_logs_native_raw`, not `nanosiem.ocsf_logs_raw`. This is a | ||
| limitation in <Op>to_clickhouse</Op>, not in ClickHouse or your data: on | ||
| `append`, the operator reads the target table's schema and validates every | ||
| column type before it writes any rows, and its type mapping does not recognize | ||
| two types that `ocsf_logs_raw` uses. It expects a plain `String` but finds | ||
| `LowCardinality(String)`, and a bare `DateTime64` but finds a timezone-qualified | ||
| one (`DateTime64(3, 'UTC')`). Either mismatch raises `unsupported ClickHouse | ||
| type`, so the pipeline fails immediately and never inserts a row, even though it | ||
| would only write the `event` and `source_type` columns. | ||
|
|
||
| The native entrypoint avoids this by exposing only `event` (JSON) and a plain | ||
| `source_type` (String). A materialized view forwards from there into | ||
| `ocsf_logs_raw` and on into `nanosiem.ocsf_logs`. |
Member
Author
There was a problem hiding this comment.
@IyeOnline this needs your input. How should we go about this?
| guide](https://nano.rs/docs/ocsf/integrations/direct-ocsf). | ||
| ::: | ||
|
|
||
| {/*DIAGRAM: insert the nano.excalidraw image reference here once the asset is provided.*/} |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a96535b756
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Assisted-by: GPT-5 (Codex)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🔍 Problem
Tenzir has a partnership with the Nano SIEM, and a working
Tenzir → Nano ingest path already ships in nano's OSS repo, but
docs.tenzir.com has no integration page for it.
🛠️ Solution
integrations/nano.mdx: forward OCSF events to Nano by wrapping eachevent in the
{event, source_type}wire shape and writing it withto_clickhouseintonanosiem.ocsf_logs_native_raw; read events back fromnanosiem.ocsf_logswithfrom_clickhouse. Cross-links nano's direct-OCSFingestion guide.
<Integration>nano</Integration>See Also links to theto_clickhouseandfrom_clickhouseoperator references.💬 Review
ocsf_logs_native_rawentrypoint: onappend,to_clickhousevalidates the whole target schema and rejectsocsf_logs_raw'sLowCardinality(String)and timezone-qualifiedDateTime64columns. The caution aside explains this failure mode.tls=falsefor a node colocated with nano; remote clusters useTLS on port 9440.
🤖 Generated with Claude Code