Open Source Tools · Category
Agents and frameworks that query, monitor and collect evidence from endpoints at scale.
Alternatives toCrowdStrike Falcon
4 tools
Query your endpoints with SQL
Exposes the operating system as a relational database so processes, users, packages and configuration can be queried with SQL on Linux, macOS and Windows.
Open-source XDR and SIEM platform
Security platform combining an endpoint agent, a manager and an indexer for log analysis, intrusion detection, file integrity monitoring and compliance.
Runtime threat detection for containers and hosts
CNCF graduated project that watches Linux system calls (via eBPF or a kernel module) and raises alerts when rules detect suspicious behaviour.
Endpoint visibility and digital forensics at scale
DFIR tool that collects forensic artefacts and hunts across fleets of endpoints with its query language VQL, from a single server binary.
