## EDR Market Leaders

Just like SIEM, the EDR market is consolidated around a few major players. You should recognize these names.

### 1. CrowdStrike Falcon
The current market leader in enterprise.
*   **Architecture**: 100% Cloud-native. The sensor on the laptop is extremely lightweight and sends telemetry to the CrowdStrike cloud.
*   **Features**: Famous for its "Overwatch" service (human threat hunters at CrowdStrike who watch your alerts for you).
*   **UI**: Known for its "Process Tree" visualization which set the standard for the industry.

### 2. Microsoft Defender for Endpoint (MDE)
*   **Advantage**: It is built into Windows 10/11. There is no agent to install; you just flip a switch in the cloud.
*   **Integration**: Feeds directly into Azure Sentinel (SIEM).
*   **Capabilities**: went from being a joke (old Windows Defender) to a top-tier Gartner leader. Excellent memory scanning.

### 3. SentinelOne (Singularity)
*   **Focus**: AI and Automation.
*   **Feature**: "Rollback". If ransomware encrypts your files, SentinelOne can use Windows Shadow Copies to *undo* the encryption and restore the files automatically. This is a huge selling point.

### 4. Carbon Black (VMware/Broadcom)
*   One of the pioneers of EDR (formerly Bit9).
*   Very granular control. Often used in high-security environments where you want to whitelist *every single file execution*.

### 5. Cybereason
*   **Focus**: "MalOp" (Malicious Operation). Instead of giving you 50 alerts, it groups them into 1 "Operation" to show the full story.
*   **Visuals**: Very strong visualization of the attack timeline.