License & Deployment Mix: 22 tools – 6 OSS, 12 SaaS. (OSS and SaaS counts can overlap when an open-source tool also offers a vendor-hosted edition.)

What Is EDR / XDR?

Endpoint Detection and Response (EDR) is a security technology that continuously monitors endpoints (workstations, servers, laptops, mobile devices) using lightweight agents to detect, investigate, and respond to threats. EDR agents collect telemetry (process execution, file changes, network connections, registry modifications) and apply behavioral analytics to identify malicious activity that signature-based antivirus misses.

Extended Detection and Response (XDR) extends EDR by correlating telemetry across multiple security domains – endpoint, network, cloud, email, and identity – into a unified detection and response platform. Where EDR sees only the endpoint, XDR connects the dots across the entire attack surface to detect sophisticated multi-stage attacks.

Enterprise EDR/XDR platforms provide:

• Agent deployment – lightweight agents installed on endpoints that collect telemetry and enforce response actions; support for Windows, macOS, and Linux; centralized agent management and updates
• Behavioral detection – rule-based and ML-driven analysis of endpoint telemetry to detect known attack techniques (MITRE ATT&CK mapping), anomalous behavior, and living-off-the-land attacks that evade signature-based tools
• Automated response – quarantine files, isolate endpoints from the network, kill processes, block IPs, and roll back changes – automatically or with one-click analyst actions
• Threat hunting – query and search across telemetry data to proactively find threats; query languages (KQL, Lucene, SQL-like) for ad-hoc investigation; saved hunts and scheduled queries
• Forensics and investigation – timeline reconstruction of incidents; process trees; file and registry change history; network connection logs; evidence collection for post-incident analysis
• Managed Detection and Response (MDR) – vendor or third-party SOC analysts monitor, triage, and respond on behalf of the customer; critical for organizations without in-house security teams
• Multi-tenant management – centralized console for managing multiple customers or business units; tenant isolation; per-tenant policies and reporting; essential for MSPs
• SIEM integration – forward alerts and telemetry to SIEM platforms for correlation with other security data sources; syslog, CEF, and API-based integrations

EDR/XDR is foundational to modern endpoint security. Without EDR, organizations rely on signature-based antivirus that cannot detect zero-day exploits, fileless malware, or advanced persistent threats. EDR provides the visibility and response capabilities needed to detect and contain breaches before they cause significant damage.

The information on these pages was researched by a combination of human review and large language models. To suggest an addition or correction, please contact us. Prepared by Rhodium Systems Inc., author of the ResorsIT platform — a unified IT operations management platform for IT teams and MSPs that integrates a curated suite of open-source, commercial, and SaaS applications into a single system with shared identity, single sign-on, access control, and a common audit trail. Use this catalogue only as a starting point for your own research, and review any tool carefully against your own requirements before relying on it. Catalogue data version 2026.197.

Comparison

SSO / OIDC Comparison

OIDC is the preferred SSO protocol.

* = requires extension, plugin, or specific configuration

Best SSO support: CrowdStrike Falcon (OIDC, SAML, SCIM), Microsoft Defender (OIDC, SAML, SCIM), osquery+Fleet (OIDC, SCIM)

No SSO: OSSEC (no web UI), Kaspersky (LDAP/AD only)

API Comparison

Agent Deployment

Lightest agents: LimaCharlie (~20 MB), Velociraptor (~30 MB), Huntress (~30 MB), OSSEC (~40 MB)

Agentless: TheHive+Cortex (server-only IR platform, no endpoint agent)

Built-in: Microsoft Defender is pre-installed on Windows 10+ (no separate agent needed)

Detection Capabilities

Strongest detection: CrowdStrike, SentinelOne, Microsoft Defender, Cortex XDR (all six capabilities)

OSS detection leaders: Wazuh (broadest OSS rule set), Velociraptor (VQL + Yara + memory)

Automated Response

Best automated response: CrowdStrike (Falcon Fusion SOAR), SentinelOne (rollback + STAR), Microsoft Defender (auto-investigation)

OSS response leaders: LimaCharlie (full isolation + D&R), Wazuh (active response scripts)

Multi-Tenant / MSP Features

Best MSP support: Huntress (purpose-built for MSPs), SentinelOne (global console), CrowdStrike (Flight Control), Sophos (Partner Dashboard)

No multi-tenant: OSSEC (single instance only)

Threat Hunting & Forensics

Best hunting: CrowdStrike (FQL + Raptor), Microsoft Defender (KQL Advanced Hunting), Velociraptor (VQL), Cortex XDR (XQL)

Best forensics: Velociraptor (VQL + memory + timeline – purpose-built for DFIR)

Deployment and Licensing

Self-hosted OSS: Wazuh (GPL-2.0), OSSEC (GPL-2.0), Velociraptor (AGPL-3.0), osquery+Fleet (Apache-2.0/MIT), Cortex (AGPL-3.0) – note TheHive 5 itself is now proprietary (only Cortex stays OSS)

License caution: Elastic License 2.0 is not open source (restricts SaaS offering); LimaCharlie agent is Apache-2.0 but the platform is cloud SaaS

Tools

22 tools.

Arctic Wolf

Arctic Wolf is a managed security operations provider, not a traditional endpoint detection and response product.

License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none

Website

Bitdefender GravityZone

Bitdefender GravityZone is an endpoint security platform with consistently top-ranked malware detection capabilities across independent testing organizations including AV-TEST, AV-Comparatives, and MITRE ATT&CK Evaluations.

License: Proprietary (proprietary) · Kind: web · Deploy: native, saas · SSO: none

Website

Carbon Black (Broadcom)

Carbon Black is an endpoint detection and response platform originally developed by Bit9 (founded 2002), later renamed Carbon Black, acquired by VMware in 2019, and subsequently transferred to Broadcom as part of the VMware acquisition in 2…

License: Proprietary (proprietary) · Kind: web · Deploy: native · SSO: none

Website

Cortex XDR (Palo Alto Networks)

Cortex XDR from Palo Alto Networks is the first purpose-built extended detection and response platform, and the product that coined the term “XDR.” Unlike EDR solutions that focus primarily on endpoint telemetry, Cortex XDR was designed fro…

License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none

Website

CrowdStrike Falcon

CrowdStrike Falcon is a cloud-native endpoint protection platform delivering next- gen antivirus, EDR, XDR, and managed threat hunting through a single lightweight agent and modular cloud architecture.

License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC

Website

Cybereason

Cybereason is an endpoint detection and response platform founded in 2012 by former members of the Israeli Defense Forces’ Unit 8200 intelligence unit.

License: Proprietary (proprietary) · Kind: web · Deploy: native, saas · SSO: none

Website

Cynet

Cynet 360 AutoXDR is an all-in-one extended detection and response platform that consolidates endpoint detection (EDR), network detection (NDR), user behavior analytics (UEBA), deception technology, and automated response (SOAR) into a sing…

License: Proprietary (proprietary) · Kind: web · Deploy: native, saas · SSO: none

Website

Elastic Security

Elastic Security is the security solution built on top of the Elastic Stack (formerly ELK), combining SIEM capabilities with endpoint detection and response (EDR) through the Elastic Agent’s Endpoint Security integration.

License: LicenseRef-Elastic-2.0 (source-available) · Kind: web · Deploy: native · SSO: none

Website

ESET PROTECT

ESET PROTECT (formerly ESET Remote Administrator) is the unified management platform for ESET endpoint security products.

License: Proprietary (proprietary) · Kind: web · Deploy: native · SSO: none

Website

Huntress

Huntress is a managed detection and response (MDR) platform purpose-built for managed service providers (MSPs) and small-to-medium businesses (SMBs).

License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none

Website

Kaspersky Endpoint Security

Kaspersky Endpoint Security (KES) is the enterprise endpoint protection platform from Kaspersky Lab, a Russian cybersecurity company founded in 1997.

License: Proprietary (proprietary) · Kind: web · Deploy: native · SSO: none

Website

LimaCharlie

LimaCharlie is a SecOps cloud platform that provides endpoint detection and response through a lightweight sensor deployed on endpoints and a cloud-based detection and response engine.

License: Apache-2.0 (OSS) · Kind: web · Deploy: saas · SSO: none

Website · Source

Microsoft Defender for Endpoint

Microsoft Defender for Endpoint (MDE) is Microsoft’s enterprise endpoint detection and response solution, deeply integrated into the Windows operating system and the broader Microsoft 365 security ecosystem.

License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none

Website

osquery + Fleet

osquery is an endpoint visibility framework originally developed at Facebook (Meta) that exposes operating system state as a relational database queryable via SQL.

License: Apache-2.0 (OSS) · Kind: web · Deploy: native · SSO: OIDC

Website · Source

OSSEC

OSSEC (Open Source Security Event Correlator) is the original open-source host-based intrusion detection system (HIDS) that pioneered many of the concepts found in modern EDR platforms.

License: GPL-2.0-only (OSS) · Kind: web · Deploy: native · SSO: none

Website · Source

SentinelOne Singularity

SentinelOne Singularity is an autonomous AI-driven endpoint protection platform that provides prevention, detection, response, and remediation through a single agent.

License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC

Website

Sophos Intercept X

Sophos Intercept X is an advanced endpoint protection platform that combines traditional anti-malware with deep learning-based threat detection, anti-ransomware (CryptoGuard), anti-exploit technology, and EDR/XDR capabilities.

License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none

Website

TheHive + Cortex

TheHive is a SOC incident-response platform (SIRP). TheHive 5 is proprietary freemium (ex-AGPL); the companion Cortex engine stays AGPL-3.0.

License: Proprietary (proprietary) · Kind: web · Deploy: native, saas · SSO: none

Website · Source

Trellix (McAfee + FireEye)

Trellix was formed in January 2022 from the merger of McAfee Enterprise and FireEye, combining McAfee’s endpoint security and ePolicy Orchestrator (ePO) management platform with FireEye’s advanced threat detection and multi-vector virtual e…

License: Proprietary (proprietary) · Kind: web · Deploy: native · SSO: none

Website

Trend Micro Vision One

Trend Micro Vision One is a broad XDR platform that unifies security across endpoints, email, network, cloud workloads, and IoT/OT environments.

License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none

Website

Velociraptor

Velociraptor is a premier open-source digital forensics and incident response (DFIR) tool designed for large-scale endpoint visibility, threat hunting, and forensic investigation.

License: AGPL-3.0-only (OSS) · Kind: web · Deploy: native · SSO: OIDC

Website · Source

Wazuh

Wazuh is the strongest open-source XDR and SIEM platform available, providing comprehensive endpoint detection, threat intelligence, log analysis, file integrity monitoring, vulnerability detection, security configuration assessment, incide…

License: GPL-2.0-only (OSS) · Kind: web · Deploy: native · SSO: OIDC

Website · Source