Endpoint Security
EDR tools that sit on the box, not only in the console (2026)
A 2026 shortlist of agents on the laptop and server. Public docs, not a lab bake-off.
Expertise: Endpoint Security · Level: Intermediate · 12 min read
A console without an agent is a wish.
The process is on the laptop. The XDR list is the SOC console that may already include two of these names. This page is the agent. We overlap on purpose and we say so.
Six agents. One host SQL. One Elastic agent. Two known EDR shelves. One commercial responder. One open EDR. Public docs. Not a bake-off.
Technical check: we cross-check first-party product pages, public licenses, and live documentation. Rank is a technical recommendation, not a recap of other lists, and not a lab bake-off.
| Tool | Best for | License |
|---|---|---|
| osquery | SQL on the host you own | Apache-2.0 / GPL-2.0 |
| Elastic Defend | Endpoint agent on an Elastic stack | Elastic License / subscription |
| CrowdStrike Falcon | Known EDR agent | Commercial |
| Microsoft Defender for Endpoint | Known agent on a Microsoft estate | Microsoft 365 / Defender plans |
| SentinelOne | Commercial autonomous-response EDR | Commercial |
| OpenEDR | Open EDR you operate | GPL-2.0 (see repo) |
osquery
Best for sQL on the host you own
osquery is also on the detection-as-code list as SQL. Here it is the agent you deploy to ask the box.
Key features
- SQL tables
- Scheduled queries
- Works with Fleet
- You operate it
Why we like it
When the EDR console is dark, SQL on the host is the honest fallback.
Limits
Not a blocker. Not a malware family pack. You write the query.
Elastic Defend
Best for endpoint agent on an Elastic stack
Elastic Defend is the agent next to Elastic Security. The SIEM list already rows Elastic. This is the box.
Key features
- Endpoint prevention
- On Elastic
- Self-host or cloud
- Tied to Elastic SIEM
Why we like it
If the SIEM is already Elastic, this is the agent that does not add a fourth vendor.
Limits
You own the stack. License is not Apache. Not a CrowdStrike clone.
CrowdStrike Falcon
Best for known EDR agent
CrowdStrike is on the XDR list. Here it is the agent. We will not reprint that page.
Key features
- Cloud agent
- Detection and response
- Threat intel add-ons
- Sales-led
Why we like it
Known shelf. Link XDR for the console job.
Limits
Commercial. We did not run a tenant. Overlap is declared.
Microsoft Defender for Endpoint
Best for known agent on a Microsoft estate
Defender for Endpoint is the Microsoft agent. The XDR list rows Defender XDR. This is the device plan.
Key features
- Windows-first depth
- M365 integration
- Automatic investigation features they document
- Licensed by plan
Why we like it
If the laptop is already Entra-joined, start here before a third agent.
Limits
Plan SKUs split features. We did not run E5. Link identity for the IdP.
SentinelOne
Best for commercial autonomous-response EDR
SentinelOne sells an agent that can contain on the host. The brochure says autonomous. Treat that as first-party language.
Key features
- Agent on the host
- Containment they document
- Console
- Commercial
Why we like it
A third known shelf so the list is not only Microsoft and CrowdStrike.
Limits
Commercial. We did not measure autonomy. You still own the policy.
OpenEDR
Best for open EDR you operate
OpenEDR is on the XDR list as the open agent. Here it stays the open EDR row.
Key features
- Open agent
- You operate the server
- Windows-focused roots
- GPL
Why we like it
If the requirement is source you can read, this is the EDR-shaped option.
Limits
You staff it. Not a CrowdStrike replacement in a quarter. Link XDR for the console story.
What the internet thinks about EDR tools
osquery’s launch thread is still the honest pitch: SQL on the host. That is the agent question this page asks.
marpaia on Hacker News, Oct 2014: “You’re totally right in that the SQL interface is very similar to WMI. Some core differences with osquery are: it’s cross platform and supports many *nix operating systems.”
Prove osquery still publishes
Confirm osquery still publishes a site. Deploying an agent is a change on a host you own, not a prove-it against a stranger.
curl -fsSIL https://osquery.io/ | head -n 8FAQs
Is this the XDR list?
No. XDR is the console job. This page is the agent. Two names overlap on purpose.
Does EDR replace MDM?
No. MDM ships the policy. EDR watches the process. Different door.
Can I skip an agent if I have a SIEM?
Only if you like being blind on the host. Logs you never sent are the SIEM list’s hole.
Is this a scored bake-off?
No. Order is editorial. We did not detonate malware.
