> lol no. Commercial EDR software sucks whether it is Crowdstrike or Carbon Black or Cylance. That's like saying commercial firewalls suck. Do you mean the UI

> lol no. Commercial EDR software sucks whether it is Crowdstrike or Carbon Black or Cylance. That's like saying commercial firewalls suck. Do you mean the UI perhaps? They all allow you to specify detection rules like with ids and fw but the out of the box stuff is good enough to catch APTs but obviously not perfect. Althougj out of those I can only recommend crowdstrike falcon, defender ATP is also decent. Red teamers have bypasses for some, it's a cat and mouse game but can you find one instance where an actual threat actor intentionally evaded an EDR?