Notifications
Clear all
Endpoint / EDR / XDR
1
Posts
1
Users
0
Reactions
0
Views
Topic starter
17/07/2026 6:43 am
We run OSQuery fleet-wide alongside CrowdStrike. It's not overlap, it's complementary.
EDR gives you the real-time alerts and blocking. OSQuery is for proactive hunting and historical data.
* Use OSQuery for: inventory (what software is installed, network listening ports), compliance checks (user accounts, config drift), and targeted hunts across specific tables.
* Use EDR for: behavior-based detection, memory analysis, and automated response.
We pipe OSQuery logs to our SIEM. EDR stays focused on prevention. Lets us answer "what changed before the alert?" without bogging down the EDR console.