Security telemetry from everywhere your code runs
Most EDRs only see what their agent sees. The moment you add cloud workloads, CI/CD pipelines, or Kubernetes, you have a gap. LightEDR ships five purpose-built aggregators that close it - with zero-trust transport, no extra agents for many sources, and live config updates without container restarts.
Five aggregators. One unified timeline.
Syslog
Collect logs from any Linux host, firewall, or network device - no agent required.
- Linux system logs (auth, kernel, daemon, cron, etc.)
- Firewall and router syslogs
- Application logs forwarded via syslog
- Network device alerts and audit events
Works with: rsyslog, syslog-ng, systemd-journald, Cisco IOS, Palo Alto PAN-OS, pfSense, OPNsense, any standard syslog sender
Windows Event Forwarding (WEF)
Collect Windows Security, Sysmon, and Application events from your entire domain - no agent on each host.
- Windows Security event log (logon events, privilege use, object access, policy changes)
- Windows System event log
- Sysmon events (process create, network connect, file create, registry, DNS queries, etc.)
- Windows Application event log
- Any custom Windows event channel
Works with: Windows Server 2012 R2+, Windows 10/11, any domain-joined host via native Group Policy subscriptions
Kubernetes + Docker
Full audit trail for every Kubernetes API call and every container lifecycle event - one webhook, no DaemonSet.
- All Kubernetes API calls (verb, resource, namespace, user, response code)
- High-value operations automatically flagged: exec into pods, listing secrets, privilege escalation, persistence mechanisms
- Container lifecycle events: start, stop, kill, OOM, exec sessions, image pull and push
Works with: Any CNCF-conformant Kubernetes distribution (EKS, GKE, AKS, k3s, RKE, kubeadm), Docker Engine, containerd
OpenTelemetry (OTEL)
If your stack already exports OTEL telemetry, you get logs and traces in LightEDR with no new instrumentation.
- Application logs - all severity levels, service and host attributes
- Distributed traces - span name, trace and span IDs, duration, HTTP status, error spans
- Metrics are accepted and acknowledged (not forwarded to the triage engine in the current release)
Works with: OpenTelemetry SDK (all languages), OpenTelemetry Collector, Jaeger (OTLP mode), Grafana Alloy, any OTLP/HTTP exporter
GitHub Actions / Repository Security
Bring your entire supply chain security signal - code scanning, secret detection, dependency alerts - into the same alert timeline as your endpoint events.
- Code scanning alerts (CodeQL, Trivy, Semgrep, any SARIF-producing scanner)
- Secret scanning alerts - always highest priority
- Dependabot alerts (CVE ID, CVSS score, vulnerable version range, fix version)
- Workflow run results - captures CI failure signals alongside security events
- SARIF findings (direct upload) - any SARIF 2.1.0 file from any scanner; works without GitHub Advanced Security
Works with: github.com, GitHub Enterprise Server, Gitea, Forgejo
See what your current EDR is missing
Most EDRs see what their agent sees. LightEDR also sees your pipelines, your cloud, and your source code.
| Data source | LightEDR | CrowdStrike Falcon | SentinelOne | Microsoft Defender | Huntress |
|---|---|---|---|---|---|
| Linux endpoint events | Native agent | Native agent | Native agent | Native agent | Native agent |
| Windows endpoint events | WEF (no per-host agent) | Native agent | Native agent | Native agent | Native agent |
| Syslog (Linux / network gear) | Native | Falcon LogScale add-on | Singularity add-on | Sentinel / Defender for IoT add-on | × |
| Kubernetes audit log | Native (no DaemonSet) | Falcon Cloud Security add-on | Singularity Cloud add-on | Defender for Containers add-on | × |
| Container events (Docker) | Native | Falcon Container add-on | Singularity Container add-on | Defender for Containers add-on | × |
| GitHub code scanning | Native | × | × | GitHub Advanced Security (separate product) | × |
| GitHub secret scanning | Native | × | × | × | × |
| Dependabot / SCA alerts | Native | × | × | × | × |
| SARIF upload (any scanner) | Native (no GHAS required) | × | × | GitHub Advanced Security only | × |
| OpenTelemetry logs | Native | × | × | Azure Monitor (separate) | × |
| Distributed traces (OTEL) | Native | × | × | Azure Monitor (separate) | × |
| GitHub Enterprise / Gitea / Forgejo | Native | × | × | × | × |
Competitor capabilities based on publicly available documentation as of June 2026. Verify with each vendor.
Every aggregator, zero-trust transport
Every aggregator authenticates to the LightEDR platform using certificate-based mutual TLS. Credentials never transit the network - each aggregator generates its own key material on first start and retains it locally. Configuration including secrets and tokens can be updated live without restarting. All telemetry is compressed and encrypted in transit.
How our zero-trust model works →- Certificate-based mutual TLS
- Key material generated locally - never sent over the network
- Live configuration updates - no restart required
- Encrypted and compressed telemetry in transit
Most aggregators are a single Docker container and two environment variables.
Read the setup docs →