About this episode

In this episode, Dan Lussier discusses building a high-scale SIEM using AI and ClickHouse in just two weeks for under $7,000.

Can you build a fully functional, high-scale SIEM in just two weeks for under $7,000? In this episode of the Cloud Security Podcast , hosts Tim Peacock and Kyle Champlin sit down with long-time collaborator Dan Lucier , Founder of Nano , to unpack how he "vibe-coded" an entire SIEM from scratch during his end-of-year holiday break. Dan shares his journey of leveraging bleeding-edge AI code assistants to go from a Postgres prototype to a blazing-fast, production-ready SIEM built on Rust and ClickHouse . In this episode, we cover: 🛠️ The $7,000 Stack: How Dan utilized Claude Code and Kubernetes to build a lean platform running on 2 vCPUs and 4GB RAM while ingesting 10–20 GB of data daily. ⚡ Why ClickHouse? The database architectural decisions behind maintaining sub-second search speeds at massive scale. 🤖 AI-Pilled but Cautious: Why Dan takes a surprisingly conservative approach to AI case closure and triage (and how it compares to Google's Triage and Investigation Agent). 💻 Detection as Code: How MCP (Model Context Protocol) servers and AI are leveling the playing field for smaller security teams. Whether you're an AI enthusiast, a data nerd, or a security leader looking at the…

People in this episode

Hosts: Tim Peacock, Kyle Champlin

Guest: Dan Lussier

Topics covered

• AI in security
• SIEM development
• ClickHouse
• Kubernetes
• data ingestion
• software engineering

Keywords

• SIEM
• AI
• ClickHouse
• Kubernetes
• data ingestion
• software engineering
• Rust
• Claude Code
• Postgres

Mentioned in this episode

Organizations: Nano, Google

Products: Claude Code, Kubernetes, Postgres, Rust, ClickHouse

More episodes of Cloud Security Podcast by Google

• EP287: Creating Trust at Global Scale with Local AI: Reken-ing with Shuman Ghosemajumder · July 20, 2026 · 38 min
• EP285 Scaling Lessons from Leading the NSA to Defending the World with Morgan Adamski · July 6, 2026 · 20 min
• EP284 Closest Alligator to the Canoe: How Transforming SOC Became P0 for Lloyds Bank · June 29, 2026 · 26 min
• EP283: How Google Cloud CISO Chris Betz Uses LLMs to Defend Billions of Users from Vulnerablities · June 22, 2026 · 29 min
• EP282: Debating Coupled or Decoupled SIEM with Alex Hurtado and Christopher Witter · June 15, 2026 · 49 min
• EP281: Deceiving Adversaries at Scale with Kevin Conley · June 8, 2026 · 27 min

Explore listener stats, chart rankings, contacts and more on the Cloud Security Podcast by Google podcast page.