ComodoSecurity/openedr

Health v2 · maintenance only

Flags: no_license

Adoption not part of the score

2716 stars · 520 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

OpenEDR is an open-source Endpoint Detection and Response (EDR) agent written in C++ that records endpoint telemetry, process hierarchies, file/device trajectories, and hashes locally. It forwards collected security events to locally or cloud-hosted Elasticsearch deployments for real-time visibility, breach detection, and root-cause analysis.

Use cases

• detect breaches on endpoints
• monitor endpoint telemetry in real time
• perform root cause analysis of security incidents
• track process hierarchy and file trajectory on Windows machines
• forward endpoint events to Elasticsearch
• map endpoint activity to MITRE ATT&CK framework

When to choose

• you need a free, open-source EDR agent for Windows endpoints
• you already run Elasticsearch and want endpoint telemetry piped into it
• you want granular base-security-event visibility for threat hunting
• you prefer to self-host your endpoint security data

When to avoid

• you need a turnkey EDR with polished console and easy deployment out of the box
• you need cross-platform agents for Linux or macOS
• your organization requires commercial support and SLAs
• you want a lightweight agent with minimal resource footprint

Facets

application · maturity active

security monitoring logging alerting security developer-tools monitoring windows cpp edr endpoint-security telemetry breach-detection elasticsearch xdr

Member repositories

For agents

markdown · JSON · MCP: product_card(name="ComodoSecurity/openedr")