Cyber security

EDR Telemetry – Capabilities Of Products A Comparative Analysis

This repo provides a list of telemetry features from EDR products and other endpoint agents such as Sysmon broken down by category.

The main motivation behind this project is to enable security practitioners to compare and evaluate the telemetry potential from those tools while encouraging EDR vendors to be more transparent about the telemetry features they do provide to their users and customers.

Besides compliance, investigations and forensics benefits, rich log telemetry empowers cyber defense teams to develop custom hunting, detection and analytics capabilities tailored to their needs.

Read details about this project in the initial release blog post here.

Telemetry Definition

There are many types of telemetry when it comes to Security Instrumentation.

Here we focus on agents or sensors generating telemetry in the form of log data, regardless of the format (json, key-value, csv), as long as the data is automatically generated and transmitted or streamed in near real-time.

FAQ & Contributions

Please check our FAQ page to know more and feel free to get in contact in case you cannot find an answer there.

In case you ware willing to contribute, please check the Contributions page.


The telemetry of the EDR products below could improve with time. The last_updated field is the last time the data sources have been updated.

This might NOT always be up to date with the current telemetry capabilities of each product.

Telemetry Comparison Table


The data below do not represent the capability of each of the EDR products to detect or prevent a threat.

This is ONLY a comparison regarding the available telemetry for each product.

Some products, such as Elastic EDR, make additional telemetry available in free or paid modules.

Add-on modules, as well as signals, will not be taken into consideration for this project. Please read more about this on our FAQ page here.

EDR Evaluation And Scoring Script

This script evaluates and scores Endpoint Detection and Response (EDR) Solutions based on their capabilities.

It reads data from the main JSON file (EDR_telem.json), which contains information about various EDRs and their features.

The script then calculates a score for each EDR based on the presence and absence of certain features, as well as the category of the feature.

Scoring Logic

  • Each feature and category is assigned a weight.
  • The weights represent the importance of the feature or category. For example, a feature with a weight of 1 is considered more important than a feature with a weight of 0.5.
  • The compare.py script multiplies the weight of each feature by the weight of its category, adding this product to the EDR’s total score.
  • If a feature is absent, its weight is considered 0.

This scoring algorithm allows us to quantitatively compare different EDRs based on their capabilities.

The higher the score, the more capable the EDR is. The weights can be adjusted as needed to reflect changes in the importance of different features or categories.

For more information click here.

Varshini

Varshini is a Cyber Security expert in Threat Analysis, Vulnerability Assessment, and Research. Passionate about staying ahead of emerging Threats and Technologies.

Recent Posts

How to Install Docker on Ubuntu (Step-by-Step Guide)

Docker is a powerful open-source containerization platform that allows developers to build, test, and deploy…

2 days ago

Uninstall Docker on Ubuntu

Docker is one of the most widely used containerization platforms. But there may come a…

2 days ago

Admin Panel Dorks : A Complete List of Google Dorks

Introduction Google Dorking is a technique where advanced search operators are used to uncover information…

3 days ago

Log Analysis Fundamentals

Introduction In cybersecurity and IT operations, logging fundamentals form the backbone of monitoring, forensics, and…

4 days ago

Networking Devices 101: Understanding Routers, Switches, Hubs, and More

What is Networking? Networking brings together devices like computers, servers, routers, and switches so they…

4 days ago

Sock Puppets in OSINT: How to Build and Use Research Accounts

Introduction In the world of Open Source Intelligence (OSINT), anonymity and operational security (OPSEC) are…

4 days ago