Endpoint Detection — OSQuery & EDR

EDR (Endpoint Detection and Response) and its open-source cousins (OSQuery, Wazuh agents, Velociraptor) put eyes on every endpoint. Commercial EDR like CrowdStrike Falcon and SentinelOne dominates the enterprise paid space; the OSQuery + Wazuh + Velociraptor stack is the credible FOSS alternative for blue teams. For runtime / k8s side see Runtime Security. For SIEM consumers of this data see SIEM (Wazuh / Graylog). For DFIR collection see DFIR (Velociraptor).

Open-source endpoint visibility

• ★ ★ OSQuery (Meta) — query the OS as SQL; cross-platform agent for Win / Linux / macOS / FreeBSD; tables for processes, sockets, users, services, kernel modules, hashes, browser plugins, MDM info, etc. Free.
  • Fleet (Fleet Device Management) — open-source OSQuery fleet manager; the modern UI / mgmt layer.
  • Kolide (legacy product) — pivoted away from OSQuery management 2023+.
  • Doorman (older).
• ★ ★ Wazuh agents — feed Wazuh SIEM; FIM, vuln detection, OS auditing, syscalls, MITRE ATT&CK alerts. Free. See SIEM (Wazuh / Graylog).
• ★ Velociraptor agents — endpoint hunting / live response via VQL. Free. See DFIR (Velociraptor).
• Sysmon (Win) + Sysmon for Linux — Microsoft's syscall / process / network event log enricher; FOSS; pair with Sigma rules.
• eBPF agents: Tetragon, Tracee — see Runtime Security.
• auditd (Linux) — built-in syscall audit framework.
• OpenEDR / Comodo OpenEDR — open-source EDR; less popular than Wazuh.
• elastic Defend (formerly Endgame) — paid Elastic-tier; agents free at OSS-level for basic.

Commercial EDR / XDR

• ★ CrowdStrike Falcon — paid; market leader; lightweight agent; cloud-native.
• ★ SentinelOne Singularity — paid; AI-driven; competitive.
• Microsoft Defender for Endpoint — paid (E5 license); integrated with Sentinel + Intune.
• Palo Alto Cortex XDR — paid; ecosystem play.
• Trellix (McAfee + FireEye merged) — paid.
• Sophos Intercept X — paid.
• Bitdefender GravityZone — paid.
• Cybereason / Cynet / Trend Micro Vision One — paid.

"Open EDR" / hybrid

• LimaCharlie — paid; SecOps cloud platform; modular detection content.
• wazuh + eBPF (Tetragon) + Sysmon = a credible OSS EDR-like stack 2024–26.

Anti-virus / malware engines

• ClamAV — open-source; signature-based; mainly used for shared filesystems / mail servers.
• Microsoft Defender Antivirus — built-in Windows; free.
• Sophos / Bitdefender / Kaspersky — paid traditional AV.
• YARA + Loki + THOR — IOC scanners; not classic AV but cover similar ground. See Detection (Sigma / YARA / ATT&CK).

Mobile / endpoint adjacents

• Lookout / Zimperium / Pradeo — paid mobile EDR.
• Microsoft Intune — MDM with security signals.
• Jamf Protect — paid; macOS endpoint security.
• Kandji / Mosyle / Workspace ONE — paid; macOS / cross-platform MDM.
• Fleet — open-source MDM-adjacent for OSQuery fleets.

Browser / cloud workspace

• Push Security / Material Security — paid; SaaS-side detection.
• Nudge Security — SaaS exposure monitoring.
• Okta ThreatInsight / Microsoft Defender for Cloud Apps — paid.

Detection content (link)

• See Detection (Sigma / YARA / ATT&CK) — Sigma rules over Sysmon / Defender / OSQuery, YARA rules in EDR, Atomic Red Team for validation.

What endpoint visibility actually costs

• OSQuery + Fleet + Sysmon + Wazuh — staff time, no license cost.
• CrowdStrike / SentinelOne — typically $4–8/endpoint/month; enterprise contracts vary.
• Defender for Endpoint — bundled if you have Microsoft 365 E5 ($57/user/month list).

Patterns

• ★ Sysmon on every Windows endpoint, configured with SwiftOnSecurity / Olaf Hartong template. Cheap, transformative.
• ★ OSQuery + Fleet for cross-platform queries — "is anyone running this version of Chrome." Live, fleet-wide.
• Wazuh agents on Linux servers — FIM + auth + vuln detection in one.
• Velociraptor for hunting — pull artifacts on demand without running queries 24/7.
• Atomic Red Team weekly — validate your EDR / detection actually catches things; see Detection (Sigma / YARA / ATT&CK).

Pick this if…

• Default FOSS endpoint visibility: OSQuery + Fleet + Sysmon + Wazuh agents.
• Best-in-class commercial EDR: CrowdStrike Falcon or SentinelOne.
• MS-shop: Defender for Endpoint (E5).
• Hunting / on-demand collection: Velociraptor agents.
• Mobile: Lookout / Jamf Protect / Defender for Mobile.
• AV-only on a budget: Defender + ClamAV.