Use the public results to compare visibility, spot gaps, and plan validation in your environment. Telemetry scores measure visibility only. They do not rank overall product quality.

Compare scores

Open Scores for coverage depth, then use Statistics to track changes over time.

Browse categories

Open Telemetry Categories and MITRE Mappings for signal-level detail.

Read eligibility

Check inclusion rules in Eligibility before you treat a product as comparable.

Follow updates

See project context on About and new write-ups on the Blog.

Project Mission

Documenting EDR telemetry visibility

The EDR Telemetry Project documents and compares the endpoint telemetry EDR platforms expose under controlled, versioned tests. Practitioners can see visibility differences while reading the limits of what a telemetry score can show.

Cross-platform telemetry coverage and depth analysis

Controlled activity and evidence-backed validation

Published methodology and community-informed research

Learn More About Our Methodology

Telemetry coverage preview

CategoryABC

Process Creation

Network Connection

File Modification

Registry / Config

Script Execution

Illustrative only. See Scores for live results

Who it's for

Built for Security and Business Teams

Built for people who need telemetry coverage details, not a full product ranking.

Mid-sized Businesses

Check whether your EDR exposes the telemetry you need before you scale the rollout.

Large Enterprises

Compare telemetry evidence across platforms and guide validation in your own environment.

Security Leaders

Show stakeholders what coverage you have and which limits the tests document.

Detection Engineers

Map exposed signals to MITRE ATT&CK and investigate visibility gaps.

Frequently Asked Questions

Is the research vendor-neutral?

The project is vendor-agnostic and applies published evidence and methodology rules. Each result should be read with its documented validation path, configuration, and limitations.

Can we use this to guide procurement?

Use the platform scores, category depth, and eligibility criteria as one source of technical evidence. Telemetry visibility does not measure prevention, detection efficacy, operational fit, support quality, or overall product quality, so it should not determine a procurement decision by itself.

Do you offer help applying the benchmarks?

Yes. See Apply the Research for EDR validation, selection, and advisory support through Defendpoint Consulting.

Compare platform scores

Start with Scores, then open categories and methodology so you know what each result actually means.

View Scores Apply the Research

Transparent Research on EDR Telemetry Visibility

Windows

Linux

macOS

Compare telemetry before you buy or reconfigure