Best Endpoint Detection & Response (EDR) Software & Tools

EDR reviews covering detection depth, investigation tooling, response actions, alert noise, data retention and per-endpoint pricing.

5 products

CrowdStrike Falcon
CrowdStrike Falcon

by CrowdStrike

No reviews yet

CrowdStrike Falcon is endpoint protection and EDR software for businesses, from next-gen antivirus to managed threat hunting, sold per device in bundles.

Features

Missing Continuous endpoint telemetry recording
Has Process tree view of each alert
Has One-click host network isolation
Has Live response shell
Has Custom detection rules on endpoint telemetry
Missing Query-based threat hunting across endpoints
Missing Alerts grouped into incidents
Has ATT&CK technique tags on detections
Has Automated investigation and remediation
Missing Custom IOC block and allow lists
Missing Command-line and script content capture
Missing Detection exclusions and suppression rules
Missing Telemetry retention of 30 days or more
Missing Telemetry streaming to a SIEM
Missing Forensic package collection from a host
Missing Server and cloud workload sensor
Has Vendor-run threat hunting add-on
Has MITRE ATT&CK Evaluations participant
Visit Profile
Cynet
Cynet

by Cynet

No reviews yet

Cynet is an EDR and XDR platform for MSPs and lean IT teams, sold by quote in three packages, two with Cynet's own CyOps analysts on watch around the clock.

Features

Has Continuous endpoint telemetry recording
Has Process tree view of each alert
Has One-click host network isolation
Has Live response shell
Missing Custom detection rules on endpoint telemetry
Missing Query-based threat hunting across endpoints
Missing Alerts grouped into incidents
Missing ATT&CK technique tags on detections
Has Automated investigation and remediation
Missing Custom IOC block and allow lists
Has Command-line and script content capture
Has Detection exclusions and suppression rules
Missing Telemetry retention of 30 days or more
Has Telemetry streaming to a SIEM
Missing Forensic package collection from a host
Missing Server and cloud workload sensor
Has Vendor-run threat hunting add-on
Has MITRE ATT&CK Evaluations participant
Visit Profile
Huntress
Huntress

by Huntress

No reviews yet

Huntress is a managed security platform for SMBs and MSPs, pairing EDR, identity threat detection, SIEM and awareness training with its own 24/7 SOC.

Features

Missing Continuous endpoint telemetry recording
Missing Process tree view of each alert
Has One-click host network isolation
Missing Live response shell
Missing Custom detection rules on endpoint telemetry
Missing Query-based threat hunting across endpoints
Missing Alerts grouped into incidents
Missing ATT&CK technique tags on detections
Missing Automated investigation and remediation
Missing Custom IOC block and allow lists
Missing Command-line and script content capture
Has Detection exclusions and suppression rules
Missing Telemetry retention of 30 days or more
Has Telemetry streaming to a SIEM
Missing Forensic package collection from a host
Missing Server and cloud workload sensor
Missing Vendor-run threat hunting add-on
Missing MITRE ATT&CK Evaluations participant
Visit Profile
Microsoft Defender for Endpoint

by Microsoft

No reviews yet

Microsoft Defender for Endpoint is endpoint protection and EDR software for Windows, macOS, Linux, iOS and Android, sold alone or inside Microsoft 365 suites.

Features

Has Continuous endpoint telemetry recording
Has Process tree view of each alert
Has One-click host network isolation
Has Live response shell
Has Custom detection rules on endpoint telemetry
Has Query-based threat hunting across endpoints
Has Alerts grouped into incidents
Has ATT&CK technique tags on detections
Has Automated investigation and remediation
Has Custom IOC block and allow lists
Missing Command-line and script content capture
Has Detection exclusions and suppression rules
Has Telemetry retention of 30 days or more
Has Telemetry streaming to a SIEM
Has Forensic package collection from a host
Has Server and cloud workload sensor
Has Vendor-run threat hunting add-on
Has MITRE ATT&CK Evaluations participant
Visit Profile
SentinelOne Singularity
SentinelOne Singularity

by SentinelOne

No reviews yet

SentinelOne Singularity is endpoint protection and EDR software for security teams and MSSPs, with an on-device AI agent that keeps working offline.

Features

Has Continuous endpoint telemetry recording
Has Process tree view of each alert
Has One-click host network isolation
Has Live response shell
Missing Custom detection rules on endpoint telemetry
Has Query-based threat hunting across endpoints
Has Alerts grouped into incidents
Has ATT&CK technique tags on detections
Has Automated investigation and remediation
Missing Custom IOC block and allow lists
Missing Command-line and script content capture
Has Detection exclusions and suppression rules
Has Telemetry retention of 30 days or more
Has Telemetry streaming to a SIEM
Has Forensic package collection from a host
Has Server and cloud workload sensor
Has Vendor-run threat hunting add-on
Has MITRE ATT&CK Evaluations participant
Visit Profile
0 selected