compare
OpenEDR vs osquery
The same facts for both, read from GitHub every night, and the relation a person reviewed.
| Fact | OpenEDR | osquery |
|---|---|---|
| Language | C++ | C++ |
| Licence | Other | Other |
| Stars | 2.7k | 24k |
| Latest | release-2.5.1 | 5.24.1 |
| Last push | 2026-05-23 | 2026-11-12 |
| Release cadence | too few releases | about 59 days between releases |
| Active contributors | 0 commit authors on the default branch in the last 90 days | 38 commit authors on the default branch in the last 90 days |
| Flags | none | none |
How they relate
Both replace CrowdStrike Falcon. Alternatives to CrowdStrike Falcon →
PartialOpenEDREndpoint agent for Windows that records and analyses host activity; no managed threat hunting.
PartialosqueryQueries endpoint state with SQL; no prevention or managed detection.
OpenEDR
- release-2.5.12022-09-20v2.5.1.0 Release
- 2.0.0.02020-11-122.0.0.0 Releasepre-release
osquery
- 5.24.12026-10-29Update the Mozilla CA certificate bundle (removes eMudhra certificates) (#9206)
- 5.24.02026-10-09file table : lnk-related columns were not always computed on Windows
- 5.23.12026-06-24This is a bug and security fix release.
- 5.23.02026-04-25Add process memory scanning capability to yara table
- 5.22.12026-02-255.22.0 macOS binaries will not execute because the signing certificate is out of sync with the provisioning profile. 5.…
OpenEDR
✓ signed The latest release, release-2.5.1, carries a signature GitHub verified.
Loading the security report
osquery
unsigned The latest release, 5.24.1, carries no signature GitHub could verify.
Loading the security report