Endpoint Security
XDR tools that correlate more than the endpoint (2026)
A 2026 shortlist of XDR platforms that stitch endpoint, identity, and cloud signals. Public docs, not a bake-off.
Expertise: Endpoint Security · Level: Intermediate · 17 min read
A process tree is not an incident.
The ticket still starts on a laptop. A parent that should not have spawned a child. A signed binary. Then the same identity mints a token in a SaaS app, and a mailbox grows a forward rule. EDR saw the host. The account and the cloud session sat in another queue.
That is the XDR argument: stitch the host to the identity and the mailbox before the analyst does it by hand. This page is a 2026 shortlist of platforms that publish that job, plus the open tools teams actually use when they refuse a boxed suite. Public docs. Not a lab bake-off. Vega is not here. It is not an XDR agent.
Six names. One category leader, one hyperscaler, one API-first compose kit, and three GitHub-side tools for hunt, query, and Windows telemetry.
Technical check: we cross-check first-party product pages, license files, and live community threads. Rank is a technical recommendation, not a recap of other lists, and not a lab bake-off. The spec URL for Microsoft Defender XDR under endpoint-security 404s; the live product page sits under SIEM and XDR. CrowdStrike’s older Falcon Insight path now lives on the platform endpoint-security URL.
| Tool | Best for | License |
|---|---|---|
| CrowdStrike Falcon Insight XDR | Endpoint-first XDR with third-party ingest | Commercial, Falcon Enterprise from $184.99/device/year |
| Microsoft Defender XDR | Cross-domain incidents on a Microsoft estate | Included with eligible Microsoft plans |
| LimaCharlie | API-first EDR you compose into XDR | Commercial, Community free for 2 endpoints; Standard EDR $3/endpoint |
| Velociraptor | Hunt and DFIR queries on the endpoint | AGPL-3.0 |
| Fleet | Live osquery plus device management | MIT (free) / Premium $7/host/month |
| OpenEDR | Open Windows EDR telemetry | CASL, no charge for free use |
CrowdStrike Falcon Insight XDR
Best for endpoint-first XDR that still takes third-party data
Falcon Insight XDR is CrowdStrike’s unified EDR and native XDR SKU. The product page is explicit: detection starts on the sensor, then you extend it with identity, cloud, mobile, and data-protection modules in the same console. Native XDR is listed at no additional cost. Third-party visibility is 10 GB/day of free ingest.
Key features
- AI-powered EDR with MITRE ATT&CK mappings, CrowdStrike Signal, and Charlotte AI triage
- Real Time Response for remote system access, plus Falcon Fusion SOAR
- Native XDR context from Falcon identity, cloud, mobile, and data-protection modules
- 10 GB/day of third-party ingest in the same console
- Optional 24/7 managed hunting and Falcon Complete MDR
Why we like it
Use it when the job is still “stop the host,” and you want the identity and cloud panes without standing up a second product. The public pricing page puts Insight-class detection on Falcon Enterprise, not on Falcon Go.
Limits
The 15-day trial on the pricing page is Falcon Prevent, device control, and Express Support. That is not a full Insight XDR trial. Falcon Go is capped at 100 devices and does not include EDR. A July 2024 outage is still the community’s first memory of kernel-mode sensors. CrowdStrike publishes Windows, macOS, and Linux support; check the platform FAQ for versions.
License
Commercial SaaS. Falcon Enterprise is $19.99 per device billed monthly, or $184.99 per device billed annually, on the public pricing page. Falcon Complete MDR is quote-only. Optional add-ons cost extra.
Microsoft Defender XDR
Best for stitching Microsoft endpoints, identity, mail, and SaaS
Microsoft Defender XDR (formerly Microsoft 365 Defender) is the hyperscaler answer: one incident queue across Defender for Endpoint, Identity, Office 365, Cloud Apps, and the other workloads you licensed. The marketing page currently titles as Microsoft Defender Suite. Learn still names the product Defender XDR. The FAQ is blunt: XDR is not a standalone offering.
Key features
- Combined incidents in the Microsoft Defender portal at security.microsoft.com
- Automatic attack disruption across licensed workloads, including device and identity containment
- Self-healing for compromised devices, identities, and mailboxes where the suite products support it
- Cross-product hunting over 30 days of raw signals from the licensed Defender products
- Copilot in Microsoft Defender XDR on the current XDR solution page
Why we like it
Use it when the estate is already Microsoft 365 and Entra. The correlation only fires for products you licensed and provisioned. That is the honest limit, and Microsoft writes it on the overview page.
Limits
Defender XDR does not appear if you only bought consumer Defender. For standalone Defender products, the Suite FAQ says Defender for Endpoint Plan 2 and Defender for Office 365 Plan 2 are required, and XDR turns on when multiple workloads are in use. Automatic attack disruption and threat analytics need Defender for Endpoint Plan 2. Servers are licensed separately. The old /endpoint-security/microsoft-defender-xdr URL 404s.
License
Not sold alone. Access comes with Microsoft 365 E5/A5, the Microsoft Defender Suite add-on, and several other listed plans. Defender Suite is $12 per user per month paid yearly and requires Microsoft 365 E3, or Office 365 E3 plus Enterprise Mobility + Security E3. One user license covers up to five devices, not servers.
LimaCharlie
Best for API-first EDR you compose into XDR
LimaCharlie is the hidden-gem compose kit. Docs still list endpoint sensors, detection and response rules, LCQL, log adapters, and SIEM outputs. The 2026 homepage leads with Grid, an agentic operator layer for MSSP queues. The infrastructure underneath is the same API-first platform: sensors on Windows, Linux, macOS, and Chrome, plus telemetry you bring in.
Key features
- Endpoint sensors plus detection and response rules with automated actions
- Log adapters and outputs toward SIEMs and other tools
- LCQL for event query, plus Go and Python SDKs
- Bring-your-own LLM. LimaCharlie charges per endpoint, not per seat, and does not resell model tokens
- Multi-tenant billing for MSSPs. Month-to-month, no contract on the public pricing page
Why we like it
Use it when you want to write the detections and keep the economics per endpoint. The docs call this security infrastructure. The homepage now sells queue automation on top of that infrastructure. Both are first-party. Pick the layer you actually need.
LoveKebabble wrote it in May 2019 as a detection engineer: “Cloud based EDR tool, it has a cost, but is not expensive ($1 per endpoint monitored, supports all Linux flavors). It’s a lot easier to deploy and manage, but you’ll have to write your own rules.” That last clause still matches the docs. The dollar figure does not. Standard EDR on the 2026 pricing page is $3 per endpoint, with a free Community tier for two endpoints.
Limits
You write the rules. Grid automates queues in tools clients already run; it is not a replacement for detections you never authored. AI agents use your own provider keys. Telemetry sources are $0.20/GB on Standard. The homepage is now MSSP-shaped. Enterprise engineers still have to read the docs, not only the Grid pitch.
License
Commercial SaaS. Community: free EDR on up to two endpoints, one year of storage, community support. Standard: $3.00 per endpoint for EDR, volume pricing at 5,000 endpoints, telemetry $0.20/GB. Builder Program for MSSPs is discounted and quote-led. CNAPP is listed separately at $150 per organization after a 14-day trial.
Velociraptor
Best for hunt and DFIR queries on the endpoint itself
Velociraptor is an open-source DFIR and endpoint-monitoring platform. The docs say the source of truth is the endpoint: you push targeted VQL, you do not haul every artifact to a lake first. Collect, monitor, and hunt are the three buttons on the home page. That is not a boxed XDR console. It is how a lot of IR teams still get answers Falcon never shipped as a custom artifact.
Key features
- VQL artifacts for forensic collection, triage hunts, and live monitoring (ETW, eBPF, Sigma)
- Client/server deployment, offline collectors, and disk-image analysis through a virtual client
- Notebooks for collaborative analysis, plus export to Zip, cloud, Splunk, or Elastic
- gRPC API for automation. Third-party tools can be pushed and run at scale
- The overview notes LimaCharlie among the remote-management paths that can launch an offline collector
Why we like it
Use it when the question is “what happened on these hosts” and you can write or adapt an artifact. The philosophy page is the tell: collect less, parse on the endpoint, time-box the MFT there instead of shipping it.
Limits
This is not packaged XDR. There is no native identity or mailbox stitch. You operate the server, the ACLs, and the hunts. Docs ask you to update to 0.77.2 for multiple CVEs. The GitHub project is under Velocidex/velociraptor and is AGPL-3.0. Source headers credit Rapid7.
License
GNU Affero General Public License v3. The downloads page states it is free for anyone to use under the AGPL. Network-hosted modifications require source for users of that server.
Fleet
Best for live osquery and device management you can read
Fleet started as an osquery management server. The pricing FAQ says that out loud, then says write and execute MDM came later. Today the homepage is device management, patching, and governance for macOS, Linux, Windows, iOS, and Android. The security-adjacent pieces still matter on an XDR shortlist: live queries, FIM, YARA, vulnerability scores, and a public codebase.
Key features
- Live osquery reports and a single API, with UI or GitOps
- Self-host or let Fleet host. The FAQ says the experience is the same
- Premium table lists file integrity monitoring, file carving, YARA/custom IoCs, continuous scanning, CISA KEVs, and incident response
- MDM for every listed OS, plus software inventory and patching
- Free tier is $0 per host per month, “basic features, no support”
Why we like it
Use it when the question is SQL against the fleet, and you want the agent source sitting in the open. Stripe’s Wes Whetstone is quoted on the homepage for a 10,000-Mac move. That is device management, not XDR. Keep the jobs straight.
Limits
Fleet is not an XDR incident queue. A March 2025 HN comment from an osquery operator still lands: osquery “works well for monitoring but not detections.” The homepage is MDM-first in 2026. GitHub.com/fleetdm/fleet is the repo; we did not add a second GitHub link. The ee/ tree is separately licensed commercial code.
License
Core is MIT Expat (Fleet Device Management Inc, with a Kolide copyright line). Docs under docs/ are CC BY-SA 4.0. The ee/ directory is the paid edition. Premium is $7.00 per host per month on the public pricing page. Custom is quote-led.
OpenEDR
Best for open Windows EDR telemetry you can inspect
OpenEDR is a live open-source EDR project. The site is up. The public repo is ComodoSecurity/openedr. The README describes a Windows agent that records telemetry locally and ships it to Elasticsearch, with process-hierarchy tracking and MITRE-oriented visibility. Xcitium still sells MDR and “extended detection and response” around the same codebase. The agent is the open part. The SOC service is not.
Key features
- Windows components listed on the site: process, file-system mini-filter, network, registry, self-protection, system monitor
- Analytic detection and root-cause framing against MITRE ATT&CK, per the homepage
- Local telemetry with a path to self-hosted or cloud Elasticsearch
- Site copy mentions SIEM/SOAR integrations and automated isolation
- Xcitium MDR and ZeroDwell isolation are commercial add-ons, not the CASL agent
Why we like it
Use it when you want a real EDR agent you can read, and you will bring your own store and detections. The site’s “free forever” line matches the CASL grant for unpaid use. MSSPs may charge for services built on it. That is in the license, not a slogan.
Limits
Two first-party stories disagree on platforms. The homepage claims Windows, macOS, and Linux. The GitHub getting-started text describes a single agent for Windows endpoints. We could not confirm a public macOS or Linux agent in the repo from the pages we fetched. The license excludes Netfilter SDK and MadCodeHook. Community threads still argue about self-hosted management versus Xcitium’s cloud. This is EDR telemetry, not a cross-domain XDR console.
License
Comodo Available Source License (CASL). Royalty-free use and modification if you do not charge for the software or a free application that embeds it. MSSPs and SOCs may charge for services. Comodo keeps ownership. No promised updates. Binaries also contain separately licensed Netfilter SDK and MadCodeHook code.
What the internet thinks about XDR tools
Live threads. We quoted the argument, not the score.
Hacker News
“XDR is an evolution of EDR (Endpoint Detection and Response) with a bit more in terms of data sources added (and a lot of marketing ‘Our <..>DR is better than yours because we have a cooler letter’ 😛 Basically an XDR looks not only at malware but also at potentially malicious actions.”
wkat4242, 17 Mar 2025, on a ransomware thread. The cooler letter is the whole category fight. We left the permalink off this card because the LimaCharlie quote already uses the one news.ycombinator.com href.
Stack Overflow
“But to use this query in a Defender XDR Custom Detection Rule, we need to include a valid ReportId from one or more pieces of evidence (EmailEvents in this case).”
JTB on KQL for Defender XDR. Cross-domain hunting is real. The schema still wants a concrete email as evidence.
Information Security
“CrowdStrike Falcon uses a Windows kernel-mode driver, and unlike the automated validation of eBPF programs on Linux, Windows kernel-mode drivers do not undergo the same type of in-depth validation to prevent crashes.”
security_paranoid, 22 Jul 2024. The XDR console sits on a kernel agent. That trade is not unique to CrowdStrike, and the thread treats it as the cost of effective EDR.
FAQs
What is the difference between EDR and XDR?
EDR watches the host: processes, files, memory, and the response actions on that endpoint. XDR is supposed to join that host story to identity, mail, cloud, and other telemetry so one incident already has the account and the mailbox. Community threads still call a lot of XDR “EDR plus a cooler letter.” The products on this page that actually publish a joined incident are Falcon Insight XDR and Microsoft Defender XDR. The others give you sensors, queries, or an API to build the join yourself.
Is Microsoft Defender XDR a standalone product?
No. Microsoft’s own Suite FAQ says it is not a standalone offering. XDR capabilities come with eligible Microsoft 365 and Defender plans, and they correlate only the Microsoft security products you licensed and provisioned. Defender Suite is the security add-on priced at $12 per user per month when you already hold E3-class licenses.
Can Velociraptor or Fleet replace an XDR platform?
They replace pieces. Velociraptor hunts and collects on the endpoint with VQL. Fleet runs live osquery and, on Premium, YARA and FIM. Neither ships a cross-domain incident fabric that already joined Entra, mail, and the laptop. If that join is the job, you still buy Falcon, Defender XDR, or you build it on LimaCharlie and a SIEM.
Is this a scored bake-off?
No. Order is editorial. We did not install these in a lab or assign points. A tool is here if it publishes an XDR, EDR, or endpoint-query job on a live first-party page, and if the license is public enough to describe.
