Open Source Tools · Alternatives
CrowdStrike Falcon is a commercial endpoint detection and response (EDR) platform delivered as a cloud service. Open-source tools do not replace a managed EDR one-for-one, but Wazuh, osquery and Velociraptor cover endpoint telemetry, detection rules, hunting and evidence collection.
CrowdStrike Falcon is a commercial product by CrowdStrike (official site). Category: Endpoint visibility and response.
| Tool | Licence | Stars | Last commit | Best for |
|---|---|---|---|---|
 osquery | Apache-2.0 OR GPL-2.0-onlyOpen source | 24k | 4 days ago | Query your endpoints with SQL |
 Wazuh | GPL-2.0-only AND AGPL-3.0-or-laterOpen source | 17k | today | Open-source XDR and SIEM platform |
 Falco | Apache-2.0Open source | 9.5k | today | Runtime threat detection for containers and hosts |
 Velociraptor | AGPL-3.0-onlyOpen source | 4.4k | 2 days ago | Endpoint visibility and digital forensics at scale |
Query your endpoints with SQL
Exposes the operating system as a relational database so processes, users, packages and configuration can be queried with SQL on Linux, macOS and Windows.
Open-source XDR and SIEM platform
Security platform combining an endpoint agent, a manager and an indexer for log analysis, intrusion detection, file integrity monitoring and compliance.
Runtime threat detection for containers and hosts
CNCF graduated project that watches Linux system calls (via eBPF or a kernel module) and raises alerts when rules detect suspicious behaviour.
Endpoint visibility and digital forensics at scale
DFIR tool that collects forensic artefacts and hunts across fleets of endpoints with its query language VQL, from a single server binary.
Product names are trademarks of their owners. ThreatWire is not affiliated with CrowdStrike. The comparison covers what each tool is designed to do, not a feature-by-feature equivalence.
