Best Open Source Alternatives to Microsoft Defender for Endpoint

Osquery replaces proprietary EDR telemetry with SQL-driven endpoint monitoring, letting teams query Linux, macOS, and Windows host state in real time.

vs Microsoft Defender for Endpoint: a free, open-source option you fully control, licensed Apache-2.0.

Wazuh is an open-source EDR and SIEM alternative to CrowdStrike Falcon that keeps host telemetry and compliance auditing on private infrastructure.

vs Microsoft Defender for Endpoint: a free, open-source option you fully control, licensed GPL-2.0.

OpenEDR is an open-source alternative to CrowdStrike Falcon that streams kernel-level Windows endpoint telemetry directly into self-hosted Elasticsearch.

vs Microsoft Defender for Endpoint: a free, open-source option you fully control, licensed Apache-2.0.