Today, a faulty CrowdStrike update crashed Windows machines around the world. I wrote about why in the causes of widespread outages. The obvious next question is whether open source tools could do the same job without the same risk.
The honest answer has two parts. Open source tools can cover a lot of what an endpoint detection and response product does, and some of them are excellent. And open source wouldn't have prevented today on its own. A bad update to a privileged agent crashes machines whoever wrote it. What open source gives you is visibility and control, and those are the things today showed we lacked.
What CrowdStrike actually does
To compare fairly, it helps to separate the product into its parts:
- An agent on every machine that watches processes, files, network connections and logins.
- Detection logic that decides what looks malicious, constantly updated by the vendor's researchers.
- Response: isolating a machine, killing a process, quarantining a file.
- A cloud console where all of it is collected, searched and correlated.
- People: threat intelligence and, for many customers, a managed team watching around the clock.
Open source tools can replace parts of 1, 3 and 4 well. Number 2 and especially number 5 are where the real cost of a commercial product lives, and where an open source deployment needs your own staff.
The tools
Host monitoring and detection
- Wazuh is the most complete open source option: an agent for Linux, Windows and macOS, a server, and a dashboard covering log analysis, file integrity monitoring, vulnerability detection, configuration assessment and active response. It began as a fork of OSSEC, the older host intrusion detection system, which is still around.
- osquery, created at Facebook and now a Linux Foundation project, exposes the operating system as a set of SQL tables. "Show me every process listening on a port that isn't from a package" becomes a query you can run across a whole fleet. It's an outstanding visibility tool, best paired with a manager like FleetDM.
- Velociraptor is a powerful tool for collecting forensic evidence and hunting for threats across thousands of machines, built for incident responders.
Linux and containers
- Falco, which graduated from the Cloud Native Computing Foundation this February, watches system calls in real time and alerts on suspicious behavior: a shell spawned in a container, an unexpected write to
/etc, a process opening a network connection it shouldn't. - Tetragon, from the Cilium project, goes further and can block such behavior as it happens.
Both use eBPF, and that matters a great deal after today. eBPF programs run inside the Linux kernel, but they must pass a verifier before they load, which checks that they can't loop forever, read memory they shouldn't or crash the kernel. A buggy eBPF rule fails to load. A buggy kernel driver brings the machine down. CrowdStrike's own Linux sensor can also run in an eBPF-based mode, for exactly this reason.
Network
- Suricata is a high-performance network intrusion detection and prevention engine, and Zeek turns network traffic into rich, searchable logs. Neither runs on endpoints, so a bad update to either can't brick your laptops. That's a point in their favor today.
- Snort, the original open source IDS, is still maintained by Cisco.
Malware scanning
- ClamAV is useful for scanning email and file uploads. It isn't an endpoint protection product and shouldn't be treated as one.
Building it so today doesn't happen to you
Whatever you choose, open source or commercial, the lessons of today are about how you run it:
- Control the update schedule. Test new detection rules and agent versions on a small group of machines before they reach everything. With open source tools you own this completely. With a commercial product, demand it.
- Prefer designs that fail safe. eBPF over kernel modules on Linux. Agents that crash themselves, not the operating system.
- Don't put everything in one basket. A network sensor plus a host agent from a different source means one failure doesn't blind you completely.
- Plan for the agent to be the problem. Know how you'd remove or disable it on a thousand machines that won't boot.
- Budget for people. The software is free. Someone has to write and tune the detection rules, watch the alerts at 2 a.m. and respond. If you can't staff that, a managed service on top of open source tools, or a commercial product with the controls above, may be the right call.
A realistic stack
For a Linux-heavy organization: Wazuh agents everywhere for logs, file integrity and vulnerability data; Falco on Kubernetes nodes; osquery for fleet-wide questions; Suricata and Zeek at the network edge; Velociraptor ready for incidents; everything feeding a central store like OpenSearch. It takes real effort to run. It also means you can read every line of what's running on your machines, decide when it changes and switch out any piece of it.
That's not a guarantee against outages. It is the kind of control everyone wished they had this morning.
Since then
Added October 2026. Microsoft has since started letting security vendors run their Windows agents outside the kernel, in a platform it began previewing in 2025. I followed the CrowdStrike story through its post-mortem and root cause analysis.