EDR Evaluation Guidelines
Eligibility Criteria & Excluded Products
Comprehensive guidelines for EDR solution implementation, including eligibility requirements, exclusion criteria, and conditional approval processes for enterprise environments.
Key Definitions
Understanding the fundamental concepts of EDR eligibility and implementation
Core Requirements
For an EDR solution to be included in our comparison, it must provide real-time event collection, automated telemetry without manual intervention, and out-of-the-box capabilities as a dedicated EDR solution.
EDR Telemetry Definition
Data or events automatically collected and transmitted by a sensor in real-time as events occur, excluding live querying, artifact access, or correlation-based signals.
Exclusion Factors
Solutions that lack continuous real-time telemetry streaming, require manual collection, or don't provide direct access to raw telemetry data for customer analysis.
Direct vs Inferred
Each telemetry event must represent a distinct system action captured directly rather than inferred. For example, explicit service creation recording vs. assuming service creation from process events.
Eligibility Requirements
Search through EDR solution exclusions
Important Note
The exclusion of a product from this comparison does not reflect on its overall quality or effectiveness. Each solution listed below may excel in its intended use case and could be the ideal choice depending on your specific environment, security requirements, and operational needs.
Our eligibility criteria are specifically designed for comparing traditional EDR telemetry capabilities and should not be the sole factor in evaluating security solutions for your organization.
Product
Primary Limitation
Additional Details
Sandfly
No Real-time Streaming
- Lacks continuous real-time telemetry streaming capabilities of traditional EDR solutions
- Focuses on periodic scanning and threat hunting rather than continuous monitoring
- Designed for point-in-time forensics and incident response rather than real-time detection
Velociraptor
Manual Collection Required
- Relies on manual VQL queries for artifact collection
- No continuous automated telemetry stream
- Better suited for incident response than continuous monitoring
OSquery (standalone)
No Real-time Collection
- Designed for point-in-time queries
- Lacks native event streaming capability
- Requires additional tooling for continuous monitoring
Huntress EDR
Limited EDR Functionality
- Lacks direct access to raw telemetry data for customer analysis and investigation
- Managed threat hunting platform rather than traditional EDR
- Limited endpoint telemetry visibility for customers
Cisco EDR
Limited EDR Functionality
- Lacks direct access to raw telemetry data for customer analysis and investigation
- Requires additional modules and licensing for basic EDR capabilities
- Limited endpoint telemetry visibility in base product
Tanium
Limited Real-Time Telemetry
- Primarily focuses on forensic endpoint visibility rather than real-time telemetry ingestion
- Uses polling-based architecture instead of continuous event streaming, leading to potential telemetry gaps
- Lacks continuous real-time process creation, file modification, and script execution monitoring
Kaspersky
Limited Telemetry Access
- Does not provide open access to detailed raw telemetry data
- Telemetry data is aggregated, limiting granular event-level visibility
Aurora
Not a Full EDR Solution
- Functions as a threat detection engine rather than a complete EDR solution
- Relies on log ingestion and rule-based detection instead of real-time telemetry collection
- Does not stream telemetry data to a centralized location for real-time analysis and monitoring
Wazuh
No Native Telemetry Collection
- Relies on external tools (Sysmon, OSQuery) for basic endpoint telemetry collection
- Functions primarily as a log aggregator rather than direct telemetry collector
- Lacks native real-time event streaming capabilities for endpoint activities
BitDefender EDR
Limited EDR Functionality
- No ability to search logs unless an alert fires
- No continuous event ingestion for full system visibility
- Functions more like an NGAV than a true EDR