EDR Telemetry

📖 About

A comprehensive comparison of telemetry features from EDR products and endpoint agents like Sysmon. This project enables security practitioners to evaluate telemetry capabilities while promoting vendor transparency.

🌐 Visit our Website for the complete comparison and analysis.

📝 Read more about this project in our initial release blog post.

🎯 Key Features

• Comprehensive telemetry comparison across multiple EDR solutions
• Detailed scoring system for feature evaluation
• Regular updates to reflect the latest capabilities
• Community-driven contributions and verification

📊 Telemetry Comparison

Visit our EDR Telemetry Comparison Table to see:

• Feature-by-feature comparison
• Detailed scoring metrics
• Implementation status
• Latest updates

🤝 Contributing

We welcome contributions! Please check our Contribution Guidelines for details on how to get involved.

⚖️ Scoring System

Our evaluation script assigns scores based on feature implementation:

• ✅ Yes: 1.0
• ⚠️ Partially: 0.5
• 🎚️ Via EnablingTelemetry: 1.0
• 🪵 Via EventLogs: 0.5
• ❌ No: 0.0
• ❓ Pending Response: 0.0

View the complete scoring breakdown on our website.

⚠️ Disclaimer

The data presented reflects only the telemetry capabilities of each product, not their detection or prevention capabilities. For more details, please visit our FAQ page.

📜 License

This work is licensed under a Creative Commons Attribution-NonCommercial 4.0 International License.

This means you are free to:

• Share — copy and redistribute the material in any medium or format
• Adapt — remix, transform, and build upon the material

Under the following terms:

• Attribution — You must give appropriate credit, provide a link to the license, and indicate if changes were made.
• NonCommercial — You may not use the material for commercial purposes without explicit permission from the author.

For commercial use, please contact us.

✨ Contributors Wall

Thanks to these amazing contributors:

Current Primary Maintainers

Kostas - @kostastsale