tsale/EDR-Telemetry resource

Health v2 · maintenance only

Flags: no_license

Adoption not part of the score

1978 stars · 200 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

An open, vendor-neutral research project that compares the endpoint telemetry exposed by EDR products and agents like Sysmon across Windows, Linux, and macOS. It publishes a scored, evidence-backed comparison table plus a Python scoring script, maintained by Defendpoint Consulting.

Use cases

• compare telemetry coverage of EDR products before buying one
• find visibility gaps in my current EDR deployment
• evaluate which endpoint events Sysmon vs commercial EDRs expose
• validate EDR telemetry during a proof of concept
• research endpoint event coverage for detection engineering
• check which EDRs expose scheduled task creation or registry events

When to choose

• you need an independent, evidence-backed comparison of EDR telemetry visibility
• you are evaluating or validating EDR platforms across Windows, Linux, and macOS
• you want a public reference to push vendors toward telemetry transparency
• you are doing detection engineering or threat hunting research on endpoint event sources

When to avoid

• you want a tool that ranks overall EDR protection, detection efficacy, or prevention quality
• you need a runnable telemetry collection agent rather than a comparison dataset
• you require a commercially licensed dataset for commercial use (CC BY-NC 4.0)
• you need real-time monitoring or alerting from the project itself

Facets

dataset · maturity active

security monitoring analytics benchmarking security developer-tools monitoring windows cross-platform edr telemetry endpoint-security detection-engineering sysmon vendor-comparison threat-hunting research linux macos

Member repositories

For agents

markdown · JSON · MCP: product_card(name="tsale/EDR-Telemetry")